AWSTemplateFormatVersion: 2010-09-09 Description: IAM role for Datadog AWS Integration Parameters: ExternalId: Description: >- External ID for the Datadog role (generate at https://app.datadoghq.com/account/settings#integrations/amazon-web-services) Type: String IAMRoleName: Description: Customize the name of IAM role for Datadog AWS integration Type: String Default: DatadogIntegrationRole BasePermissions: Description: >- Customize the base permissions for the Datadog IAM role. Select "Core" to only grant Datadog permissions to a very limited set of metrics and metadata (not recommended). Type: String Default: Full AllowedValues: - Full - Core LogArchives: Description: >- S3 paths to store log archives for log rehydration. Separate multiple paths with comma, e.g., "my-bucket,my-bucket-with-path/path". Type: String Default: "" CloudTrails: Description: >- S3 buckets for the Datadog CloudTrail integration. Separate multiple buckets with commas, e.g., "bucket1,bucket2". Permissions will be automatically added to the Datadog integration IAM role. https://docs.datadoghq.com/integrations/amazon_cloudtrail/ Type: String Default: "" CloudSecurityPostureManagementPermissions: Type: String Default: false AllowedValues: - true - false Description: >- Set this value to "true" to add permissions for Datadog's Cloud Security Posture Management product to monitor your AWS cloud resource configurations. You need this set to "true" to use Cloud Security Posture Management. You will also need "BasePermissions" set to "Full". DdAWSAccountId: Description: >- Datadog AWS account ID allowed to assume the integration IAM role. DO NOT CHANGE! Type: String Default: "464622532012" Conditions: GrantFullPermissions: Fn::Equals: - Ref: BasePermissions - Full ShouldInstallCSPMPolicy: Fn::Equals: - Ref: CloudSecurityPostureManagementPermissions - true Resources: DatadogIntegrationRole: Type: "AWS::IAM::Role" Metadata: cfn-lint: config: # cfn-lint does not yet support "Fn::Transform" ignore_checks: - E3002 - E3003 Properties: AssumeRolePolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Principal: AWS: !Sub - "arn:aws:iam::${DdAWSAccountId}:root" - { DdAWSAccountId: !Ref DdAWSAccountId } Action: - "sts:AssumeRole" Condition: StringEquals: "sts:ExternalId": !Ref ExternalId Path: / RoleName: !Ref IAMRoleName ManagedPolicyArns: !If [ ShouldInstallCSPMPolicy, ["arn:aws:iam::aws:policy/SecurityAudit"], !Ref AWS::NoValue, ] Policies: - PolicyName: DatadogAWSIntegrationPolicy PolicyDocument: Version: 2012-10-17 Statement: - !If - GrantFullPermissions - Effect: Allow Resource: "*" Action: - "account:GetAccountInformation" - "airflow:GetEnvironment" - "airflow:ListEnvironments" - "apigateway:GET" - "appsync:ListGraphqlApis" - "autoscaling:Describe*" - "backup:List*" - "batch:DescribeJobDefinitions" - "bcm-data-exports:GetExport" - "bcm-data-exports:ListExports" - "budgets:ViewBudget" - "cloudfront:GetDistributionConfig" - "cloudfront:ListDistributions" - "cloudtrail:DescribeTrails" - "cloudtrail:GetTrail" - "cloudtrail:GetTrailStatus" - "cloudtrail:ListTrails" - "cloudtrail:LookupEvents" - "cloudwatch:Describe*" - "cloudwatch:Get*" - "cloudwatch:List*" - "codebuild:BatchGetProjects" - "codebuild:ListProjects" - "codedeploy:BatchGet*" - "codedeploy:List*" - "cur:DescribeReportDefinitions" - "directconnect:Describe*" - "dms:DescribeReplicationInstances" - "dynamodb:Describe*" - "dynamodb:List*" - "ec2:Describe*" - "ecs:Describe*" - "ecs:List*" - "eks:DescribeCluster" - "eks:ListClusters" - "elasticache:Describe*" - "elasticache:List*" - "elasticfilesystem:DescribeAccessPoints" - "elasticfilesystem:DescribeFileSystems" - "elasticfilesystem:DescribeTags" - "elasticloadbalancing:Describe*" - "elasticmapreduce:Describe*" - "elasticmapreduce:List*" - "es:DescribeElasticsearchDomains" - "es:ListDomainNames" - "es:ListTags" - "events:CreateEventBus" - "fsx:DescribeFileSystems" - "fsx:ListTagsForResource" - "health:DescribeAffectedEntities" - "health:DescribeEventDetails" - "health:DescribeEvents" - "iam:ListAccountAliases" - "kinesis:Describe*" - "kinesis:List*" - "lambda:List*" - "logs:DeleteSubscriptionFilter" - "logs:DescribeDeliveries" - "logs:DescribeDeliverySources" - "logs:DescribeLogGroups" - "logs:DescribeLogStreams" - "logs:DescribeSubscriptionFilters" - "logs:GetDeliveryDestination" - "logs:PutSubscriptionFilter" - "logs:TestMetricFilter" - "network-firewall:DescribeLoggingConfiguration" - "network-firewall:ListFirewalls" - "oam:ListAttachedLinks" - "oam:ListSinks" - "organizations:Describe*" - "organizations:List*" - "rds:Describe*" - "rds:List*" - "redshift-serverless:ListNamespaces" - "redshift:DescribeClusters" - "redshift:DescribeLoggingStatus" - "route53:List*" - "route53resolver:ListResolverQueryLogConfigs" - "s3:GetBucketLocation" - "s3:GetBucketLogging" - "s3:GetBucketNotification" - "s3:GetBucketTagging" - "s3:ListAllMyBuckets" - "s3:PutBucketNotification" - "ses:Get*" - "ses:List*" - "sns:GetSubscriptionAttributes" - "sns:List*" - "sns:Publish" - "sqs:ListQueues" - "ssm:GetServiceSetting" - "ssm:ListCommands" - "states:DescribeStateMachine" - "states:ListStateMachines" - "support:DescribeTrustedAdvisor*" - "support:RefreshTrustedAdvisorCheck" - "tag:GetResources" - "tag:GetTagKeys" - "tag:GetTagValues" - "timestream:DescribeEndpoints" - "wafv2:ListLoggingConfigurations" - "xray:BatchGetTraces" - "xray:GetTraceSummaries" - Effect: Allow Resource: "*" Action: - "cloudwatch:Get*" - "cloudwatch:List*" - "ec2:Describe*" - "tag:GetResources" - "tag:GetTagKeys" - "tag:GetTagValues" - Fn::Transform: - Name: "DatadogPolicy" Parameters: PolicyType: LogArchive LogArchives: !Ref LogArchives - Fn::Transform: - Name: "DatadogPolicy" Parameters: PolicyType: CloudTrail CloudTrails: !Ref CloudTrails DatadogIntegrationRoleManagedPolicy1: Type: "AWS::IAM::ManagedPolicy" Condition: GrantFullPermissions Properties: ManagedPolicyName: !Sub - "${IAMRoleName}-ManagedPolicy-1" - { IAMRoleName: !Ref IAMRoleName } Roles: - !Ref DatadogIntegrationRole PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Resource: "*" Action: - "account:GetContactInformation" - "amplify:ListApps" - "amplify:ListBackendEnvironments" - "amplify:ListBranches" - "amplify:ListDomainAssociations" - "amplify:ListJobs" - "amplify:ListWebhooks" - "aoss:BatchGetCollection" - "aoss:ListCollections" - "app-integrations:GetApplication" - "app-integrations:GetDataIntegration" - "app-integrations:ListApplicationAssociations" - "app-integrations:ListApplications" - "app-integrations:ListDataIntegrationAssociations" - "app-integrations:ListDataIntegrations" - "app-integrations:ListEventIntegrationAssociations" - "app-integrations:ListEventIntegrations" - "appflow:DescribeConnector" - "appflow:DescribeConnectorProfiles" - "appflow:DescribeFlow" - "appflow:ListConnectors" - "application-signals:GetServiceLevelObjective" - "application-signals:ListServiceLevelObjectives" - "appstream:DescribeAppBlockBuilders" - "appstream:DescribeAppBlocks" - "appstream:DescribeApplications" - "appstream:DescribeFleets" - "appstream:DescribeImageBuilders" - "appstream:DescribeImages" - "appstream:DescribeStacks" - "appsync:GetGraphqlApi" - "aps:DescribeRuleGroupsNamespace" - "aps:DescribeScraper" - "aps:DescribeWorkspace" - "aps:ListRuleGroupsNamespaces" - "aps:ListScrapers" - "aps:ListWorkspaces" - "athena:BatchGetNamedQuery" - "athena:BatchGetPreparedStatement" - "auditmanager:GetAssessment" - "auditmanager:GetAssessmentFramework" - "auditmanager:GetControl" - "b2bi:GetCapability" - "b2bi:GetPartnership" - "b2bi:GetProfile" - "b2bi:GetTransformer" - "b2bi:ListCapabilities" - "b2bi:ListPartnerships" - "b2bi:ListProfiles" - "b2bi:ListTransformers" - "backup-gateway:GetGateway" - "backup-gateway:GetHypervisor" - "backup-gateway:GetVirtualMachine" - "backup-gateway:ListGateways" - "backup-gateway:ListHypervisors" - "backup-gateway:ListVirtualMachines" - "backup:DescribeFramework" - "backup:GetLegalHold" - "backup:ListBackupPlans" - "backup:ListFrameworks" - "backup:ListLegalHolds" - "backup:ListProtectedResources" - "backup:ListRecoveryPointsByBackupVault" - "batch:DescribeJobQueues" - "batch:DescribeJobs" - "batch:DescribeSchedulingPolicies" - "batch:ListJobs" - "batch:ListSchedulingPolicies" - "bedrock:GetAgent" - "bedrock:GetAgentActionGroup" - "bedrock:GetAsyncInvoke" - "bedrock:GetBlueprint" - "bedrock:GetDataSource" - "bedrock:GetEvaluationJob" - "bedrock:GetFlow" - "bedrock:GetFlowVersion" - "bedrock:GetGuardrail" - "bedrock:GetKnowledgeBase" - "bedrock:GetModelInvocationJob" - "bedrock:GetPrompt" - "bedrock:ListAgentCollaborators" - "bedrock:ListAsyncInvokes" - "bedrock:ListBlueprints" - "bedrock:ListKnowledgeBaseDocuments" - "billingconductor:ListBillingGroups" - "billingconductor:ListCustomLineItems" - "billingconductor:ListPricingPlans" - "billingconductor:ListPricingRules" - "cassandra:Select" - "ce:DescribeCostCategoryDefinition" - "ce:GetAnomalyMonitors" - "ce:GetAnomalySubscriptions" - "ce:GetCostCategories" - "cloudformation:DescribeGeneratedTemplate" - "cloudformation:DescribeResourceScan" - "cloudformation:ListGeneratedTemplates" - "cloudformation:ListResourceScans" - "cloudformation:ListTypes" - "cloudhsm:DescribeBackups" - "cloudhsm:DescribeClusters" - "codeartifact:DescribeDomain" - "codeartifact:DescribePackageGroup" - "codeartifact:DescribeRepository" - "codeartifact:ListDomains" - "codeartifact:ListPackageGroups" - "codeartifact:ListPackages" - "codeguru-profiler:ListFindingsReports" - "codeguru-profiler:ListProfilingGroups" - "codeguru-reviewer:ListCodeReviews" - "codeguru-reviewer:ListRepositoryAssociations" - "codeguru-security:GetFindings" - "codeguru-security:GetScan" - "codeguru-security:ListScans" - "codepipeline:GetActionType" - "codepipeline:ListActionTypes" - "codepipeline:ListWebhooks" - "connect:DescribeAgentStatus" - "connect:DescribeAuthenticationProfile" - "connect:DescribeContactFlow" - "connect:DescribeContactFlowModule" - "connect:DescribeHoursOfOperation" - "connect:DescribeInstance" - "connect:DescribeQueue" - "connect:DescribeQuickConnect" - "connect:DescribeRoutingProfile" - "connect:DescribeSecurityProfile" - "connect:DescribeUser" - "connect:ListAgentStatuses" - "connect:ListAuthenticationProfiles" - "connect:ListContactFlowModules" - "connect:ListContactFlows" - "connect:ListHoursOfOperations" - "connect:ListQueues" - "connect:ListQuickConnects" - "connect:ListRoutingProfiles" - "connect:ListSecurityProfiles" - "connect:ListUsers" - "controltower:GetLandingZone" - "controltower:ListEnabledBaselines" - "controltower:ListEnabledControls" - "controltower:ListLandingZones" - "databrew:ListDatasets" - "databrew:ListRecipes" - "databrew:ListRulesets" - "databrew:ListSchedules" - "datazone:GetDomain" - "datazone:ListDomains" - "deadline:GetBudget" - "deadline:GetLicenseEndpoint" - "deadline:GetQueue" - "deadline:ListBudgets" - "deadline:ListFarms" - "deadline:ListFleets" - "deadline:ListLicenseEndpoints" - "deadline:ListMonitors" - "deadline:ListQueues" - "deadline:ListWorkers" - "devicefarm:ListDeviceInstances" - "devicefarm:ListDevicePools" - "devicefarm:ListDevices" - "devicefarm:ListInstanceProfiles" - "devicefarm:ListNetworkProfiles" - "devicefarm:ListRemoteAccessSessions" - "devicefarm:ListTestGridProjects" - "devicefarm:ListTestGridSessions" - "devicefarm:ListUploads" - "devicefarm:ListVPCEConfigurations" - "dlm:GetLifecyclePolicies" - "dlm:GetLifecyclePolicy" - "docdb-elastic:GetCluster" - "docdb-elastic:GetClusterSnapshot" - "docdb-elastic:ListClusterSnapshots" - "drs:DescribeJobs" - "drs:DescribeLaunchConfigurationTemplates" - "drs:DescribeRecoveryInstances" - "drs:DescribeReplicationConfigurationTemplates" - "drs:DescribeSourceNetworks" - "drs:DescribeSourceServers" - "dsql:GetCluster" - "dsql:ListClusters" - "dynamodb:DescribeBackup" - "dynamodb:DescribeStream" - "ec2:GetAllowedImagesSettings" - "ec2:GetEbsDefaultKmsKeyId" - "ec2:GetInstanceMetadataDefaults" - "ec2:GetSerialConsoleAccessStatus" - "ec2:GetSnapshotBlockPublicAccessState" - "ec2:GetVerifiedAccessEndpointPolicy" DatadogIntegrationRoleManagedPolicy2: Type: "AWS::IAM::ManagedPolicy" Condition: GrantFullPermissions Properties: ManagedPolicyName: !Sub - "${IAMRoleName}-ManagedPolicy-2" - { IAMRoleName: !Ref IAMRoleName } Roles: - !Ref DatadogIntegrationRole PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Resource: "*" Action: - "ec2:GetVerifiedAccessEndpointTargets" - "ec2:GetVerifiedAccessGroupPolicy" - "eks:DescribeAccessEntry" - "eks:DescribeAddon" - "eks:DescribeIdentityProviderConfig" - "eks:DescribeInsight" - "eks:DescribePodIdentityAssociation" - "eks:DescribeUpdate" - "eks:ListAccessEntries" - "eks:ListAddons" - "eks:ListAssociatedAccessPolicies" - "eks:ListEksAnywhereSubscriptions" - "eks:ListIdentityProviderConfigs" - "eks:ListInsights" - "eks:ListPodIdentityAssociations" - "elasticmapreduce:ListInstanceFleets" - "elasticmapreduce:ListInstanceGroups" - "emr-containers:ListManagedEndpoints" - "emr-containers:ListSecurityConfigurations" - "emr-containers:ListVirtualClusters" - "fis:GetAction" - "fis:GetExperiment" - "fis:GetExperimentTemplate" - "fis:ListActions" - "fis:ListExperimentTemplates" - "fis:ListExperiments" - "frauddetector:DescribeDetector" - "frauddetector:DescribeModelVersions" - "frauddetector:GetBatchImportJobs" - "frauddetector:GetBatchPredictionJobs" - "frauddetector:GetDetectorVersion" - "frauddetector:GetEntityTypes" - "frauddetector:GetEventTypes" - "frauddetector:GetExternalModels" - "frauddetector:GetLabels" - "frauddetector:GetListsMetadata" - "frauddetector:GetModels" - "frauddetector:GetOutcomes" - "frauddetector:GetRules" - "frauddetector:GetVariables" - "gamelift:DescribeGameSessionQueues" - "gamelift:DescribeMatchmakingConfigurations" - "gamelift:DescribeMatchmakingRuleSets" - "gamelift:ListAliases" - "gamelift:ListContainerFleets" - "gamelift:ListContainerGroupDefinitions" - "gamelift:ListGameServerGroups" - "gamelift:ListLocations" - "gamelift:ListScripts" - "geo:DescribeGeofenceCollection" - "geo:DescribeKey" - "geo:DescribeMap" - "geo:DescribePlaceIndex" - "geo:DescribeRouteCalculator" - "geo:DescribeTracker" - "geo:ListGeofenceCollections" - "geo:ListKeys" - "geo:ListPlaceIndexes" - "geo:ListRouteCalculators" - "geo:ListTrackers" - "glacier:GetVaultNotifications" - "glue:ListRegistries" - "grafana:DescribeWorkspace" - "greengrass:GetBulkDeploymentStatus" - "greengrass:GetComponent" - "greengrass:GetConnectivityInfo" - "greengrass:GetCoreDevice" - "greengrass:GetDeployment" - "greengrass:GetGroup" - "imagebuilder:GetContainerRecipe" - "imagebuilder:GetDistributionConfiguration" - "imagebuilder:GetImageRecipe" - "imagebuilder:GetInfrastructureConfiguration" - "imagebuilder:GetLifecyclePolicy" - "imagebuilder:GetWorkflow" - "imagebuilder:ListComponents" - "imagebuilder:ListContainerRecipes" - "imagebuilder:ListDistributionConfigurations" - "imagebuilder:ListImagePipelines" - "imagebuilder:ListImageRecipes" - "imagebuilder:ListImages" - "imagebuilder:ListInfrastructureConfigurations" - "imagebuilder:ListLifecyclePolicies" - "imagebuilder:ListWorkflows" - "iotfleetwise:GetCampaign" - "iotfleetwise:GetSignalCatalog" - "iotfleetwise:GetStateTemplate" - "iotfleetwise:GetVehicle" - "iotfleetwise:ListCampaigns" - "iotfleetwise:ListDecoderManifests" - "iotfleetwise:ListFleets" - "iotfleetwise:ListSignalCatalogs" - "iotfleetwise:ListStateTemplates" - "iotfleetwise:ListVehicles" - "iotsitewise:DescribeAsset" - "iotsitewise:DescribeAssetModel" - "iotsitewise:DescribeDashboard" - "iotsitewise:DescribeDataset" - "iotsitewise:DescribePortal" - "iotsitewise:DescribeProject" - "iotsitewise:ListAssets" - "iotsitewise:ListDashboards" - "iotsitewise:ListDatasets" - "iotsitewise:ListPortals" - "iotsitewise:ListProjects" - "iotsitewise:ListTimeSeries" - "iottwinmaker:GetComponentType" - "iottwinmaker:GetEntity" - "iottwinmaker:GetScene" - "iottwinmaker:GetWorkspace" - "iottwinmaker:ListComponentTypes" - "iottwinmaker:ListEntities" - "iottwinmaker:ListScenes" - "iotwireless:GetDeviceProfile" - "iotwireless:GetMulticastGroup" - "iotwireless:GetNetworkAnalyzerConfiguration" - "iotwireless:GetServiceProfile" - "iotwireless:GetWirelessDevice" - "iotwireless:GetWirelessGateway" - "iotwireless:ListDestinations" - "iotwireless:ListDeviceProfiles" - "iotwireless:ListMulticastGroups" - "iotwireless:ListNetworkAnalyzerConfigurations" - "iotwireless:ListServiceProfiles" - "iotwireless:ListWirelessDevices" - "iotwireless:ListWirelessGateways" - "ivs:GetChannel" - "ivs:GetComposition" - "ivs:GetEncoderConfiguration" - "ivs:GetIngestConfiguration" - "ivs:GetPublicKey" - "ivs:GetRecordingConfiguration" - "ivs:GetStage" - "ivs:ListChannels" - "ivs:ListCompositions" - "ivs:ListEncoderConfigurations" - "ivs:ListIngestConfigurations" - "ivs:ListPlaybackKeyPairs" - "ivs:ListPlaybackRestrictionPolicies" - "ivs:ListPublicKeys" - "ivs:ListRecordingConfigurations" - "ivs:ListStages" - "ivs:ListStorageConfigurations" - "ivs:ListStreamKeys" - "ivschat:GetLoggingConfiguration" - "ivschat:GetRoom" - "ivschat:ListLoggingConfigurations" - "ivschat:ListRooms" - "kendra:DescribeAccessControlConfiguration" - "kendra:DescribeDataSource" - "kendra:DescribeExperience" - "kendra:DescribeFaq" - "kendra:DescribeFeaturedResultsSet" - "kendra:DescribeQuerySuggestionsBlockList" - "kendra:DescribeThesaurus" - "kendra:ListAccessControlConfigurations" - "kendra:ListExperiences" - "kendra:ListFaqs" - "kendra:ListFeaturedResultsSets" - "kendra:ListQuerySuggestionsBlockLists" - "kendra:ListThesauri" - "lakeformation:GetDataLakeSettings" - "lakeformation:ListPermissions" - "lambda:GetFunction" - "lambda:GetMicrovmImageVersion" - "launchwizard:GetDeployment" - "launchwizard:ListDeployments" - "lightsail:GetAlarms" - "lightsail:GetCertificates" - "lightsail:GetDistributions" - "lightsail:GetInstancePortStates" - "lightsail:GetRelationalDatabaseParameters" - "lightsail:GetRelationalDatabaseSnapshots" - "lightsail:GetRelationalDatabases" - "lightsail:GetStaticIps" - "macie2:GetAllowList" - "macie2:GetCustomDataIdentifier" - "macie2:GetMacieSession" - "macie2:ListAllowLists" - "macie2:ListCustomDataIdentifiers" - "macie2:ListMembers" - "managedblockchain:GetAccessor" - "managedblockchain:GetMember" - "managedblockchain:GetNetwork" - "managedblockchain:GetNode" - "managedblockchain:GetProposal" DatadogIntegrationRoleManagedPolicy3: Type: "AWS::IAM::ManagedPolicy" Condition: GrantFullPermissions Properties: ManagedPolicyName: !Sub - "${IAMRoleName}-ManagedPolicy-3" - { IAMRoleName: !Ref IAMRoleName } Roles: - !Ref DatadogIntegrationRole PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Resource: "*" Action: - "managedblockchain:ListAccessors" - "managedblockchain:ListInvitations" - "managedblockchain:ListMembers" - "managedblockchain:ListNodes" - "managedblockchain:ListProposals" - "mediaconvert:ListJobTemplates" - "mediaconvert:ListPresets" - "mediaconvert:ListQueues" - "medialive:ListChannelPlacementGroups" - "medialive:ListCloudWatchAlarmTemplateGroups" - "medialive:ListCloudWatchAlarmTemplates" - "medialive:ListClusters" - "medialive:ListEventBridgeRuleTemplateGroups" - "medialive:ListEventBridgeRuleTemplates" - "medialive:ListInputDevices" - "medialive:ListInputSecurityGroups" - "medialive:ListInputs" - "medialive:ListMultiplexes" - "medialive:ListNetworks" - "medialive:ListNodes" - "medialive:ListReservations" - "medialive:ListSdiSources" - "medialive:ListSignalMaps" - "mediapackage-vod:DescribeAsset" - "mediapackage-vod:ListAssets" - "mediapackage-vod:ListPackagingConfigurations" - "mediapackage:ListChannels" - "mediapackage:ListHarvestJobs" - "mediapackagev2:GetChannel" - "mediapackagev2:GetChannelGroup" - "mediapackagev2:GetChannelPolicy" - "mediapackagev2:GetOriginEndpoint" - "mediapackagev2:GetOriginEndpointPolicy" - "mediapackagev2:ListChannelGroups" - "mediapackagev2:ListChannels" - "mediapackagev2:ListHarvestJobs" - "mediapackagev2:ListOriginEndpoints" - "mediatailor:ListChannels" - "mediatailor:ListLiveSources" - "mediatailor:ListPlaybackConfigurations" - "mediatailor:ListPrefetchSchedules" - "mediatailor:ListSourceLocations" - "mediatailor:ListVodSources" - "memorydb:DescribeAcls" - "memorydb:DescribeMultiRegionClusters" - "memorydb:DescribeParameterGroups" - "memorydb:DescribeReservedNodes" - "memorydb:DescribeSnapshots" - "memorydb:DescribeSubnetGroups" - "memorydb:DescribeUsers" - "mobiletargeting:GetApps" - "mobiletargeting:GetCampaigns" - "mobiletargeting:GetChannels" - "mobiletargeting:GetEventStream" - "mobiletargeting:GetSegments" - "mobiletargeting:ListJourneys" - "mobiletargeting:ListTemplates" - "network-firewall:DescribeTLSInspectionConfiguration" - "network-firewall:DescribeVpcEndpointAssociation" - "network-firewall:ListTLSInspectionConfigurations" - "network-firewall:ListVpcEndpointAssociations" - "networkmanager:GetConnectPeer" - "networkmanager:GetConnections" - "networkmanager:GetCoreNetwork" - "networkmanager:GetDevices" - "networkmanager:GetLinks" - "networkmanager:GetSites" - "networkmanager:ListAttachments" - "networkmanager:ListConnectPeers" - "networkmanager:ListCoreNetworks" - "networkmanager:ListPeerings" - "omics:GetAnnotationStore" - "omics:GetAnnotationStoreVersion" - "omics:GetSequenceStore" - "omics:GetVariantStore" - "omics:GetWorkflow" - "omics:GetWorkflowVersion" - "omics:ListAnnotationStoreVersions" - "omics:ListAnnotationStores" - "omics:ListReadSets" - "omics:ListReferenceStores" - "omics:ListReferences" - "omics:ListSequenceStores" - "omics:ListVariantStores" - "omics:ListWorkflowVersions" - "omics:ListWorkflows" - "osis:GetPipeline" - "osis:GetPipelineBlueprint" - "osis:ListPipelineBlueprints" - "osis:ListPipelines" - "outposts:ListOutposts" - "outposts:ListSites" - "payment-cryptography:GetKey" - "payment-cryptography:ListAliases" - "payment-cryptography:ListKeys" - "pca-connector-ad:ListConnectors" - "pca-connector-ad:ListDirectoryRegistrations" - "pca-connector-ad:ListTemplates" - "pca-connector-scep:ListConnectors" - "personalize:DescribeAlgorithm" - "personalize:DescribeBatchInferenceJob" - "personalize:DescribeBatchSegmentJob" - "personalize:DescribeCampaign" - "personalize:DescribeDataDeletionJob" - "personalize:DescribeDataset" - "personalize:DescribeDatasetExportJob" - "personalize:DescribeDatasetImportJob" - "personalize:DescribeEventTracker" - "personalize:DescribeFeatureTransformation" - "personalize:DescribeFilter" - "personalize:DescribeMetricAttribution" - "personalize:DescribeRecipe" - "personalize:DescribeRecommender" - "personalize:DescribeSchema" - "personalize:DescribeSolution" - "personalize:ListBatchInferenceJobs" - "personalize:ListBatchSegmentJobs" - "personalize:ListCampaigns" - "personalize:ListDataDeletionJobs" - "personalize:ListDatasetExportJobs" - "personalize:ListDatasetImportJobs" - "personalize:ListDatasets" - "personalize:ListEventTrackers" - "personalize:ListFilters" - "personalize:ListMetricAttributions" - "personalize:ListRecipes" - "personalize:ListRecommenders" - "personalize:ListSchemas" - "personalize:ListSolutions" - "pipes:ListPipes" - "proton:GetComponent" - "proton:GetDeployment" - "proton:GetEnvironment" - "proton:GetEnvironmentAccountConnection" - "proton:GetEnvironmentTemplate" - "proton:GetEnvironmentTemplateVersion" - "proton:GetRepository" - "proton:GetService" - "proton:GetServiceInstance" - "proton:GetServiceTemplate" - "proton:GetServiceTemplateVersion" - "proton:ListComponents" - "proton:ListDeployments" - "proton:ListEnvironmentAccountConnections" - "proton:ListEnvironmentTemplateVersions" - "proton:ListEnvironmentTemplates" - "proton:ListEnvironments" - "proton:ListRepositories" - "proton:ListServiceInstances" - "proton:ListServiceTemplateVersions" - "proton:ListServiceTemplates" - "proton:ListServices" - "qbusiness:GetApplication" - "qbusiness:GetDataAccessor" - "qbusiness:GetDataSource" - "qbusiness:GetIndex" - "qbusiness:GetPlugin" - "qbusiness:GetRetriever" - "qbusiness:GetWebExperience" - "qbusiness:ListDataAccessors" - "ram:GetResourceShareInvitations" - "rbin:GetRule" - "rbin:ListRules" - "redshift-serverless:GetSnapshot" - "redshift-serverless:ListEndpointAccess" - "redshift-serverless:ListManagedWorkgroups" - "redshift-serverless:ListNamespaces" - "redshift-serverless:ListRecoveryPoints" - "redshift-serverless:ListSnapshots" - "refactor-spaces:ListApplications" - "refactor-spaces:ListEnvironments" - "refactor-spaces:ListRoutes" - "refactor-spaces:ListServices" DatadogIntegrationRoleManagedPolicy4: Type: "AWS::IAM::ManagedPolicy" Condition: GrantFullPermissions Properties: ManagedPolicyName: !Sub - "${IAMRoleName}-ManagedPolicy-4" - { IAMRoleName: !Ref IAMRoleName } Roles: - !Ref DatadogIntegrationRole PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Resource: "*" Action: - "resiliencehub:DescribeApp" - "resiliencehub:DescribeAppAssessment" - "resiliencehub:ListAppAssessments" - "resiliencehub:ListApps" - "resiliencehub:ListResiliencyPolicies" - "resource-explorer-2:GetIndex" - "resource-explorer-2:GetManagedView" - "resource-explorer-2:GetView" - "resource-explorer-2:ListManagedViews" - "resource-explorer-2:ListViews" - "resource-groups:GetGroup" - "resource-groups:ListGroups" - "route53-recovery-readiness:ListCells" - "route53-recovery-readiness:ListReadinessChecks" - "route53-recovery-readiness:ListRecoveryGroups" - "route53-recovery-readiness:ListResourceSets" - "route53profiles:GetProfile" - "route53profiles:ListProfileAssociations" - "route53profiles:ListProfiles" - "rum:GetAppMonitor" - "rum:ListAppMonitors" - "s3-outposts:ListRegionalBuckets" - "scheduler:GetSchedule" - "scheduler:ListScheduleGroups" - "scheduler:ListSchedules" - "securitylake:ListDataLakes" - "securitylake:ListSubscribers" - "serverlessrepo:GetApplication" - "servicecatalog:DescribePortfolio" - "servicecatalog:DescribeProduct" - "servicecatalog:GetApplication" - "servicecatalog:GetAttributeGroup" - "servicecatalog:ListApplications" - "servicecatalog:ListAttributeGroups" - "servicecatalog:ListPortfolios" - "servicecatalog:SearchProducts" - "servicediscovery:GetNamespace" - "servicediscovery:GetService" - "servicediscovery:ListNamespaces" - "servicediscovery:ListServices" - "ses:GetArchive" - "ses:GetContactList" - "ses:GetCustomVerificationEmailTemplate" - "ses:GetDedicatedIpPool" - "ses:GetIdentityMailFromDomainAttributes" - "ses:GetIngressPoint" - "ses:GetMultiRegionEndpoint" - "ses:GetRelay" - "ses:GetRuleSet" - "ses:GetTemplate" - "ses:GetTrafficPolicy" - "ses:ListAddonInstances" - "ses:ListAddonSubscriptions" - "ses:ListAddressLists" - "ses:ListArchives" - "ses:ListContactLists" - "ses:ListCustomVerificationEmailTemplates" - "ses:ListIngressPoints" - "ses:ListMultiRegionEndpoints" - "ses:ListRelays" - "ses:ListRuleSets" - "ses:ListTemplates" - "ses:ListTrafficPolicies" - "signer:GetSigningProfile" - "signer:ListSigningProfiles" - "sms-voice:DescribeConfigurationSets" - "sms-voice:DescribeOptOutLists" - "sms-voice:DescribePhoneNumbers" - "sms-voice:DescribePools" - "sms-voice:DescribeProtectConfigurations" - "sms-voice:DescribeRegistrationAttachments" - "sms-voice:DescribeRegistrations" - "sms-voice:DescribeSenderIds" - "sms-voice:DescribeVerifiedDestinationNumbers" - "snowball:DescribeCluster" - "snowball:DescribeJob" - "sns:ListPlatformApplications" - "social-messaging:GetLinkedWhatsAppBusinessAccount" - "social-messaging:ListLinkedWhatsAppBusinessAccounts" - "sqs:GetQueueUrl" - "ssm-incidents:GetIncidentRecord" - "ssm-incidents:GetReplicationSet" - "ssm-incidents:GetResponsePlan" - "ssm-incidents:ListIncidentRecords" - "ssm-incidents:ListReplicationSets" - "ssm-incidents:ListResponsePlans" - "ssm:GetMaintenanceWindow" - "ssm:GetPatchBaseline" - "states:ListActivities" - "states:ListExecutions" - "states:ListStateMachineAliases" - "storagegateway:DescribeFileSystemAssociations" - "storagegateway:DescribeSMBFileShares" - "textract:GetAdapter" - "textract:GetAdapterVersion" - "textract:ListAdapterVersions" - "textract:ListAdapters" - "timestream:ListScheduledQueries" - "timestream:ListTables" - "transcribe:GetCallAnalyticsJob" - "transcribe:GetMedicalScribeJob" - "transcribe:GetMedicalTranscriptionJob" - "transcribe:GetTranscriptionJob" - "transcribe:ListMedicalScribeJobs" - "translate:GetParallelData" - "translate:GetTerminology" - "verifiedpermissions:GetPolicyStore" - "verifiedpermissions:ListIdentitySources" - "verifiedpermissions:ListPolicies" - "verifiedpermissions:ListPolicyStores" - "verifiedpermissions:ListPolicyTemplates" - "vpc-lattice:GetListener" - "vpc-lattice:GetResourceConfiguration" - "vpc-lattice:GetResourceGateway" - "vpc-lattice:GetRule" - "vpc-lattice:GetService" - "vpc-lattice:GetServiceNetwork" - "vpc-lattice:GetTargetGroup" - "vpc-lattice:ListAccessLogSubscriptions" - "vpc-lattice:ListListeners" - "vpc-lattice:ListResourceConfigurations" - "vpc-lattice:ListResourceEndpointAssociations" - "vpc-lattice:ListResourceGateways" - "vpc-lattice:ListRules" - "vpc-lattice:ListServiceNetworkResourceAssociations" - "vpc-lattice:ListServiceNetworkServiceAssociations" - "vpc-lattice:ListServiceNetworkVpcAssociations" - "vpc-lattice:ListServiceNetworks" - "vpc-lattice:ListServices" - "vpc-lattice:ListTargetGroups" - "waf-regional:GetRule" - "waf-regional:GetRuleGroup" - "waf-regional:ListRuleGroups" - "waf-regional:ListRules" - "waf:GetRule" - "waf:GetRuleGroup" - "waf:ListRuleGroups" - "waf:ListRules" - "wafv2:GetIPSet" - "wafv2:GetRegexPatternSet" - "wafv2:GetRuleGroup" - "wellarchitected:GetLens" - "wellarchitected:GetProfile" - "wellarchitected:GetReviewTemplate" - "wellarchitected:GetWorkload" - "wellarchitected:ListLenses" - "wellarchitected:ListProfiles" - "wellarchitected:ListReviewTemplates" - "wellarchitected:ListWorkloads" - "wisdom:ListAssistantAssociations" - "wisdom:ListAssistants" - "wisdom:ListContents" - "wisdom:ListKnowledgeBases" - "wisdom:ListQuickResponses" - "workmail:DescribeOrganization" - "workmail:ListOrganizations" - "workspaces-web:GetBrowserSettings" - "workspaces-web:GetDataProtectionSettings" - "workspaces-web:GetIdentityProvider" - "workspaces-web:GetIpAccessSettings" - "workspaces-web:GetNetworkSettings" - "workspaces-web:GetTrustStore" - "workspaces-web:GetUserAccessLoggingSettings" - "workspaces-web:GetUserSettings" - "workspaces-web:ListBrowserSettings" - "workspaces-web:ListDataProtectionSettings" - "workspaces-web:ListIdentityProviders" - "workspaces-web:ListIpAccessSettings" - "workspaces-web:ListNetworkSettings" - "workspaces-web:ListPortals" - "workspaces-web:ListTrustStores" - "workspaces-web:ListUserAccessLoggingSettings" - "workspaces-web:ListUserSettings" Metadata: AWS::CloudFormation::Interface: ParameterGroups: - Label: default: Required Parameters: - ExternalId - IAMRoleName - BasePermissions - Label: default: Optional Parameters: - LogArchives - CloudTrails - CloudSecurityPostureManagementPermissions