Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

enables opt-in region for guardduty logging #1222

Merged
merged 2 commits into from
Apr 11, 2024
Merged

enables opt-in region for guardduty logging #1222

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f9dc99d
add opt-in region for guardduty
rjjaegeraws Apr 1, 2024
64b2347
fix eslint errors
rjjaegeraws Apr 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 25 additions & 2 deletions src/deployments/cdk/src/deployments/guardduty/guardduty.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,19 +182,42 @@ export async function step3(props: GuardDutyStep3Props) {
export async function enableGuardDutyPolicy(props: GuardDutyStep3Props) {
const { logBucket } = props;

const servicePrincipals = [new iam.ServicePrincipal('guardduty.amazonaws.com')];
const optinRegions = [
'af-south-1',
'ap-east-1',
'ap-south-2',
'ap-southeast-3',
'ap-southeast-4',
'ca-west-1',
'eu-central-2',
'eu-south-1',
'eu-south-2',
'il-central-1',
'me-central-1',
'me-south-1',
];

optinRegions.map(optinRegion => {
if (props.config['global-options']['supported-regions'].includes(optinRegion)) {
// Ideally want to query aws account list-regions --region-opt-status-contains ENABLED, and intersect with what is configured
servicePrincipals.push(new iam.ServicePrincipal(`guardduty.${optinRegion}.amazonaws.com`));
}
});

// Grant GuardDuty permission to logBucket: https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html
logBucket.addToResourcePolicy(
new iam.PolicyStatement({
actions: ['s3:GetBucketLocation', 's3:PutObject'],
principals: [new iam.ServicePrincipal('guardduty.amazonaws.com')],
principals: servicePrincipals,
resources: [logBucket.bucketArn, logBucket.arnForObjects('*')],
}),
);

logBucket.encryptionKey?.addToResourcePolicy(
new iam.PolicyStatement({
sid: 'Allow Guardduty to use the key',
principals: [new iam.ServicePrincipal('guardduty.amazonaws.com')],
principals: servicePrincipals,
actions: ['kms:GenerateDataKey', 'kms:Encrypt'],
resources: ['*'],
}),
Expand Down
Loading