cloudformation_prisma_template.json

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Prisma Remediation Integration build ...",
  "Outputs": {
    "PrismaRemediationLambda": {
      "Description": "The Lambda function that will run the remediation runbooks.",
      "Value": {
        "Ref": "LambdaFunction"
      }
    },
    "PrismaRemediationSQSQueue": {
      "Description": "Remediation SQS Queue URL.",
      "Value": {
        "Ref": "PrismaRemedySQSQueue"
      }
    },
    "PrismaRemediationParentId": {
      "Description": "Parent AWS Account ID.",
      "Value": {
        "Ref": "AWS::AccountId"
      }
    },
    "PrismaCrossAccountIAMRole": {
      "Description": "Child AWS Account Remediation IAM Role.",
      "Value": {
        "Ref": "CrossAccountRoleName"
      }
    }
  },
  "Parameters": {
    "SourceCodeKeyPath": {
      "Default": "aws/lambda/PrismaRemediate-latest.zip",
      "MinLength": "4",
      "Type": "String",
      "Description": "Specify the S3 path for the Lambda source code. Uses the latest release by default."
    },
    "CrossAccountRoleName": {
      "Default": "CrossAccountRemediationRole",
      "MinLength": "4",
      "Type": "String",
      "Description": "The Role name to be assumed by Lambda for remediation on another account."
    }
  },
  "Resources": {
    "PrismaRemedySQSQueue": {
      "Type": "AWS::SQS::Queue",
      "Properties": {
        "QueueName": "PrismaRemediationQueue",
        "VisibilityTimeout": 1800
      }
    },
    "LambdaRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "ManagedPolicyArns": [
          "arn:aws:iam::aws:policy/service-role/AWSLambdaSQSQueueExecutionRole"
        ],
        "Policies": [
          {
            "PolicyName": "AssumeRole",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Action": [
                    "sts:AssumeRole"
                  ],
                  "Resource": "*",
                  "Effect": "Allow"
                }
              ]
            }
          },
          {
            "PolicyName": "PrismaRemediation",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Action": [
                    "sts:GetCallerIdentity",
                    "s3:CreateBucket",
                    "s3:GetBucketLogging",
                    "s3:PutBucketLogging",
                    "ec2:DescribeSecurityGroups",
                    "ec2:RevokeSecurityGroupIngress",
                    "ec2:AuthorizeSecurityGroupIngress",
                    "iam:AttachRolePolicy",
                    "iam:CreateRole",
                    "iam:CreateUser",
                    "iam:GetPolicy",
                    "cloudtrail:DescribeTrails",
                    "s3:GetBucketAcl",
                    "s3:PutBucketAcl",
                    "ec2:CreateSnapshot",
                    "ec2:DescribeSnapshots",
                    "ec2:DeleteSecurityGroup",
                    "lambda:ListFunctions",
                    "rds:DescribeDBSnapshotAttributes",
                    "rds:ModifyDBSnapshotAttribute",
                    "iam:PutRolePolicy",
                    "iam:GetRole",
                    "logs:CreateLogGroup",
                    "logs:PutRetentionPolicy",
                    "ec2:CreateFlowLogs",
                    "ec2:RevokeSecurityGroupEgress",
                    "s3:PutBucketVersioning",
                    "ec2:DescribeAddresses",
                    "ec2:ReleaseAddress",
                    "s3:PutEncryptionConfiguration",
                    "kms:EnableKeyRotation",
                    "logs:DescribeLogGroups",
                    "cloudtrail:UpdateTrail",
                    "ec2:DescribeImageAttribute",
                    "ec2:ModifyImageAttribute",
                    "cloudformation:DescribeStacks",
                    "cloudformation:UpdateTerminationProtection",
                    "s3:PutBucketPolicy",
                    "config:PutConfigurationRecorder",
                    "config:PutDeliveryChannel",
                    "config:StartConfigurationRecorder",
                    "rds:DescribeDBInstances",
                    "rds:ModifyDBInstance",
                    "ec2:DescribeSnapshotAttribute",
                    "ec2:ModifySnapshotAttribute",
                    "s3:GetBucketLocation",
                    "kms:CreateAlias",
                    "kms:CreateKey",
                    "elasticloadbalancing:DescribeLoadBalancerAttributes",
                    "elasticloadbalancing:ModifyLoadBalancerAttributes",
                    "s3:PutObject",
                    "s3:PutBucketPublicAccessBlock",
                    "elasticloadbalancing:DescribeLoadBalancers",
                    "iam:UpdateAccountPasswordPolicy",
                    "iam:GetAccessKeyLastUsed",
                    "iam:UpdateAccessKey",
                    "iam:CreatePolicyVersion",
                    "kms:DescribeKey",
                    "kms:DisableKey",
                    "kms:CancelKeyDeletion",
                    "redshift:DescribeClusters",
                    "redshift:ModifyCluster",
                    "ec2:DeleteInternetGateway",
                    "ec2:DeleteNetworkAcl",
                    "ec2:DeleteRouteTable",
                    "ec2:DeleteSubnet",
                    "ec2:DeleteVpc",
                    "ec2:DescribeInternetGateways",
                    "ec2:DescribeNetworkAcls",
                    "ec2:DescribeNetworkInterfaces",
                    "ec2:DescribeRouteTables",
                    "ec2:DescribeSubnets",
                    "ec2:DescribeVpcs",
                    "ec2:DetachInternetGateway",
                    "iam:PassRole"
                  ],
                  "Resource": [
                    "*"
                  ],
                  "Effect": "Allow",
                  "Sid": "PrismaRemedy20200623"
                }
              ]
            }
          }
        ],
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Sid": "PrismaRemedyLambda",
              "Effect": "Allow",
              "Principal": {
                "Service": "lambda.amazonaws.com"
              }
            }
          ]
        }
      }
    },
    "LambdaFunction": {
      "Type": "AWS::Lambda::Function",
      "DependsOn": [
        "LambdaRole"
      ],
      "Description": "Prisma Remediation Lambda function",
      "Properties": {
        "Code": {
          "S3Bucket": {
            "Fn::Join": [
              "-",
              [
                "prisma-enhanced-remediation",
                {
                  "Ref": "AWS::Region"
                }
              ]
            ]
          },
          "S3Key": {
            "Ref": "SourceCodeKeyPath"
          }
        },
        "Environment": {
          "Variables": {
            "CROSS_ACCOUNT_ROLE_NAME": {
              "Ref": "CrossAccountRoleName"
            }
          }
        },
        "Handler": "index_prisma.lambda_handler",
        "Role": {
          "Fn::GetAtt": [
            "LambdaRole",
            "Arn"
          ]
        },
        "Timeout": "300",
        "Runtime": "python3.6"
      }
    },
    "PrismaLambdaTrigger": {
      "Type": "AWS::Lambda::EventSourceMapping",
      "DependsOn": [
        "PrismaRemedySQSQueue",
        "LambdaFunction"
      ],
      "Properties": {
        "Enabled": true,
        "BatchSize": 10,
        "EventSourceArn": {
          "Fn::GetAtt": [
            "PrismaRemedySQSQueue",
            "Arn"
          ]
        },
        "FunctionName": {
          "Fn::GetAtt": [
            "LambdaFunction",
            "Arn"
          ]
        }
      }
    }
  }
}