{ "AWSTemplateFormatVersion": "2010-09-09", "Outputs": { "OrcaRoleArn": { "Value": { "Fn::GetAtt": [ "OrcaSecurityRole", "Arn" ] } } }, "Parameters": { "ExternalId": { "Type": "String" }, "SecretManagerAccess": { "Type": "String", "Default": "true", "AllowedValues": [ "true", "false" ] }, "DeployRdsScanner": { "Type": "String", "Default": "true", "AllowedValues": [ "true", "false" ] } }, "Conditions": { "SecretManagerAccessAllowed": { "Fn::Equals": [ { "Ref": "SecretManagerAccess" }, "true" ] }, "DeployRdsScanner": { "Fn::Equals": [ { "Ref": "DeployRdsScanner" }, "true" ] } }, "Resources": { "OrcaSecurityPolicy": { "Type": "AWS::IAM::ManagedPolicy", "Properties": { "Description": "Orca Security Account Policy", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*::snapshot/*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "Orca" ] }, "StringEquals": { "ec2:CreateAction": [ "CreateSnapshot", "CreateSnapshots", "CopySnapshot" ] } } }, { "Effect": "Allow", "Action": [ "ec2:DeleteSnapshot" ], "Resource": "*", "Condition": { "StringLike": { "ec2:ResourceTag/Orca": "*" }, "StringNotLikeIfExists": { "ec2:ResourceTag/OrcaOptOut": "*" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateSnapshots", "ec2:CreateSnapshot", "ec2:CopySnapshot", "ec2:ModifySnapshotAttribute" ], "Resource": "*", "Condition": { "StringNotLikeIfExists": { "ec2:ResourceTag/OrcaOptOut": "*" } } }, { "Effect": "Allow", "Action": [ "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKeyWithoutPlaintext", "kms:CreateGrant" ], "Resource": "*", "Condition": { "StringNotLikeIfExists": { "aws:ResourceTag/OrcaOptOut": "*" }, "StringLike": { "kms:ViaService": "ec2.*.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "kms:PutKeyPolicy" ], "Resource": "*", "Condition": { "StringNotLikeIfExists": { "aws:ResourceTag/OrcaOptOut": "*" } } } ] } } }, "OrcaSecuritySecretsManagerPolicy": { "Type": "AWS::IAM::ManagedPolicy", "Condition": "SecretManagerAccessAllowed", "Properties": { "Description": "Orca Security Secrets Manager Policy", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": "arn:aws:secretsmanager:*:*:secret:*", "Condition": { "StringLike": { "secretsmanager:ResourceTag/Orca": "SecretAccess" } } }, { "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/Orca": "SecretAccess", "kms:ViaService": [ "secretsmanager.*.amazonaws.com" ] } } } ] } } }, "OrcaSecurityViewOnlyExtrasPolicy": { "Type": "AWS::IAM::ManagedPolicy", "Properties": { "Description": "Orca Security Extras For View Only Policy", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "access-analyzer:ListAnalyzers", "acm:DescribeCertificate", "acm:GetCertificate", "apigateway:GET", "application-autoscaling:Describe*", "appsync:Get*", "appsync:List*", "autoscaling-plans:Describe*", "backup:Get*", "backup:List*", "cassandra:Select", "cloudfront:Get*", "cloudhsm:DescribeClusters", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudwatch:Describe*", "codebuild:BatchGet*", "codebuild:List*", "codecommit:GetRepository", "codepipeline:GetPipeline", "config:Get*", "dlm:Get*", "dms:Describe*", "dynamodb:Describe*", "dynamodb:List*", "ec2:Describe*", "ec2:GetEbsEncryptionByDefault", "ec2:List*", "ec2:SearchTransitGatewayRoutes", "ecr:BatchGetImage", "ecr:Describe*", "ecr:Get*", "ecr:List*", "eks:Describe*", "eks:List*", "elasticache:Describe*", "elasticfilesystem:Describe*", "elasticfilesystem:List*", "elasticloadbalancing:Describe*", "elasticmapreduce:DescribeSecurityConfiguration", "elasticmapreduce:DescribeCluster", "es:Describe*", "es:List*", "events:List*", "glacier:Describe*", "glacier:Get*", "globalaccelerator:List*", "glue:GetDataCatalogEncryptionSettings", "glue:GetDatabases", "glue:GetDevEndpoints", "glue:GetResourcePolicy", "glue:GetSecurityConfigurations", "guardduty:Get*", "guardduty:List*", "iam:Generate*", "iam:Get*", "iam:Simulate*", "kafka:Describe*", "kafka:List*", "kinesis:DescribeStream", "kms:Describe*", "kms:Get*", "kms:List*", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:ListResources", "lambda:Get*", "logs:FilterLogEvents", "logs:Get*", "logs:ListTagsLogGroup", "logs:StartQuery", "logs:TestMetricFilter", "memorydb:Describe*", "memorydb:List*", "mq:Describe*", "mq:List*", "network-firewall:List*", "network-firewall:Describe*", "organizations:Describe*", "qldb:DescribeLedger", "qldb:ListLedgers", "rds:List*", "redshift:Describe*", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "route53:Test*", "route53domains:Check*", "route53domains:Get*", "route53domains:View*", "s3:Get*", "s3:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "ses:GetIdentityDkimAttributes", "ses:GetIdentityPolicies", "ses:GetIdentityVerificationAttributes", "sns:Get*", "sqs:GetQueueAttributes", "sqs:ListQueueTags", "ssm:Describe*", "ssm:GetParameter*", "ssm:GetParametersByPath", "ssm:List*", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListAccountAssignments", "sso:ListInstances", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", "states:DescribeStateMachine", "timestream:ListDatabases", "identitystore:DescribeGroup", "identitystore:DescribeUser", "identitystore:ListGroups", "identitystore:ListUsers", "identitystore:ListGroupMemberships", "tag:Get*", "waf-regional:Get*", "waf:Get*" ], "Resource": "*" } ] } } }, "OrcaRdsSnapshotCreatePolicy": { "Type": "AWS::IAM::ManagedPolicy", "Condition": "DeployRdsScanner", "Properties": { "Description": "Orca Security RDS Snapshot Creation Policy", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds:AddTagsToResource", "rds:DeleteDBSnapshot", "rds:DeleteDBClusterSnapshot" ], "Resource": [ "arn:aws:rds:*:*:snapshot:*", "arn:aws:rds:*:*:cluster-snapshot:*" ], "Condition": { "StringLike": { "aws:ResourceTag/Orca": "*" }, "StringNotLikeIfExists": { "aws:ResourceTag/OrcaOptOut": "*" } } }, { "Effect": "Allow", "Action": [ "rds:CreateDBSnapshot", "rds:CreateDBClusterSnapshot", "rds:CopyDBSnapshot", "rds:CopyDBClusterSnapshot" ], "Resource": [ "arn:aws:rds:*:*:db:*", "arn:aws:rds:*:*:cluster:*", "arn:aws:rds:*:*:snapshot:*", "arn:aws:rds:*:*:cluster-snapshot:*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "Orca" }, "StringNotLikeIfExists": { "aws:ResourceTag/OrcaOptOut": "*" } } } ] } } }, "OrcaRdsSnapshotReencryptPolicy": { "Type": "AWS::IAM::ManagedPolicy", "Condition": "DeployRdsScanner", "Properties": { "Description": "Orca Security RDS Snapshot Re-Encryption Policy", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "CreateGrantForDbSnapshotReencryption", "Effect": "Allow", "Action": "kms:CreateGrant", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "ForAllValues:StringLike": { "kms:GrantOperations": [ "DescribeKey", "Decrypt", "Encrypt", "GenerateDataKeyWithoutPlaintext", "CreateGrant", "RetireGrant" ] }, "Bool": { "kms:GrantIsForAWSResource": true }, "StringLike": { "aws:ResourceAccount": "${aws:PrincipalTag/OrcaScannerAccountId, '*'}" }, "ForAnyValue:StringLike": { "kms:ViaService": "rds.*.amazonaws.com" } } }, { "Sid": "DescribeKeyForDbSnapshotReencryption", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringLike": { "aws:ResourceAccount": "${aws:PrincipalTag/OrcaScannerAccountId, '*'}" }, "ForAnyValue:StringLike": { "kms:ViaService": "rds.*.amazonaws.com" } } }, { "Sid": "Tag", "Effect": "Allow", "Action": "rds:AddTagsToResource", "Resource": [ "arn:aws:rds:*:*:snapshot:*", "arn:aws:rds:*:*:cluster-snapshot:*" ], "Condition": { "StringLike": { "aws:ResourceTag/Orca": "*" }, "StringNotLikeIfExists": { "aws:ResourceTag/OrcaOptOut": "*" } } }, { "Sid": "CopyDbSnapshots", "Effect": "Allow", "Action": [ "rds:CopyDBSnapshot", "rds:CopyDBClusterSnapshot" ], "Resource": [ "arn:aws:rds:*:*:snapshot:*", "arn:aws:rds:*:*:cluster-snapshot:*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "Orca" }, "StringNotLikeIfExists": { "aws:ResourceTag/OrcaOptOut": "*" } } } ] } } }, "OrcaRdsSnapshotSharePolicy": { "Type": "AWS::IAM::ManagedPolicy", "Condition": "DeployRdsScanner", "Properties": { "Description": "Orca Security RDS Snapshot Sharing Policy", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "ModifyDbSnapshots", "Effect": "Allow", "Action": [ "rds:ModifyDBSnapshotAttribute", "rds:ModifyDBClusterSnapshotAttribute" ], "Resource": [ "arn:aws:rds:*:*:snapshot:*", "arn:aws:rds:*:*:cluster-snapshot:*" ], "Condition": { "StringLike": { "aws:ResourceTag/Orca": "*" }, "StringNotLikeIfExists": { "aws:ResourceTag/OrcaOptOut": "*" } } } ] } } }, "OrcaSecurityRole": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::976280145156:root" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:ExternalId": { "Ref": "ExternalId" } } } } ] }, "ManagedPolicyArns": { "Fn::Split": [ ",", { "Fn::Join": [ "", [ { "Fn::Join": [ ",", [ "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess", { "Ref": "OrcaSecurityPolicy" }, { "Ref": "OrcaSecurityViewOnlyExtrasPolicy" } ] ] }, { "Fn::If": [ "SecretManagerAccessAllowed", { "Fn::Sub": [ ",${SecretsManagerPolicyArn}", { "SecretsManagerPolicyArn": { "Ref": "OrcaSecuritySecretsManagerPolicy" } } ] }, "" ] }, { "Fn::If": [ "DeployRdsScanner", { "Fn::Sub": [ ",${RdsCreateSnapshotPolicyArn},${RdsReencryptSnapshotPolicyArn},${RdsShareSnapshotPolicyArn}", { "RdsCreateSnapshotPolicyArn": { "Ref": "OrcaRdsSnapshotCreatePolicy" }, "RdsReencryptSnapshotPolicyArn": { "Ref": "OrcaRdsSnapshotReencryptPolicy" }, "RdsShareSnapshotPolicyArn": { "Ref": "OrcaRdsSnapshotSharePolicy" } } ] }, "" ] } ] ] } ] } } } } }