Skip to content

setting extended_resource_collection to default true#155

Merged
jvanbrie merged 3 commits intomasterfrom
jon.vanbriesen/aws-quickstart-extended-resource-collection-default
Nov 5, 2024
Merged

setting extended_resource_collection to default true#155
jvanbrie merged 3 commits intomasterfrom
jon.vanbriesen/aws-quickstart-extended-resource-collection-default

Conversation

@jvanbrie
Copy link
Contributor

@jvanbrie jvanbrie commented Nov 4, 2024

What does this PR do?

Changes 2 things:

  1. ResourceCollection can be set via the quickstart cloudformation template and will default to "True"
  2. The SecurityAudit policy getting attached to the role will now depend on ResourceCollection value, rather than CSPM state

I've also added a verification rule to ensure CSPM isn't set to True with ResourceCollection set to False. This is an invalid state.

Testing Guidelines

Ran taskcat, and ran it manually as well.

- 'wafv2:ListLoggingConfigurations'
- 'xray:BatchGetTraces'
- 'xray:GetTraceSummaries'
Metadata:
Copy link
Contributor Author

@jvanbrie jvanbrie Nov 5, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorted this list, and added new permissions.

@jvanbrie jvanbrie merged commit da5701c into master Nov 5, 2024
@jvanbrie jvanbrie deleted the jon.vanbriesen/aws-quickstart-extended-resource-collection-default branch November 5, 2024 17:56
Type: String
Default: DatadogIntegrationRole
CloudSecurityPostureManagementPermissions:
ResourceCollectionPermissions:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Renaming this parameter breaks main_extended.yaml

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants