rl-read-only.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: Prisma IAM Role to set read permissions
Parameters:
  PrismaRoleName:
    Type: String
    Description: 'Provide an role ARN name (Example: PrismaReadOnlyRole)'
    AllowedPattern: '[-_a-zA-Z0-9]*'
    Default: "PrismaReadOnlyRole"
  ExternalID:
    Type: String
    Description: 'Provide an ExternalID (Example: Xoih821ddwf)'
    MinLength: '1'
    AllowedPattern: '[a-zA-Z0-9\=\,\.\@\:\/\-_]*'
    ConstraintDescription: 'ExternalID must contain alphanumeric characters and only
      these special characters are allowed =,.@:/-. '
  PrismaUsername:
    Type: String
    Description: 'Provide the Prisma.io username, preferably an onboarding only account.'
    MinLength: '1'
    AllowedPattern: '[a-zA-Z0-9\=\,\.\@\:\/\-_]*'
  PrismaPassword:
    Type: String
    Description: 'Password for Prisma.io'
    MinLength: '1'
  PrismaCustomerName:
    Type: String
    Description: 'The designed company name assigned within Prisma.io'
    MinLength: '1'
    AllowedPattern: '[a-zA-Z0-9\=\,\.\@\:\/\-_\s]*'
  PrismaAccountName:
    Type: String
    Description: 'Provide a unique name for the AWS account within Prisma.io'
    MinLength: '1'
    AllowedPattern: '[a-zA-Z0-9\=\,\.\@''\:\/\-_\s]*'
  PrismaTenant:
    Type: String
    Description: 'Specify the Prisma.io tenant your account is provisioned on'
    MinLength: '1'
    AllowedValues: ["app", "app2", "app3", "app.eu", "app.anz"]
  PrismaAccountGroup:
    Type: String
    Description: 'Specify the Prisma account group name'
    MinLength: '5'
    AllowedPattern: '[a-zA-Z0-9\=\,\.\@\:\/\-_\s]*'
    Default: 'Default Account Group'
  CreatePrismaAccount:
    Type: String
    Description: 'Set to true to create Prisma account, set to false to just update AWS settings (including role)'
    Default: 'false'
    AllowedValues: ["true", "false"]
  EnableCloudTrailLogs:
    Type: String
    Description: 'Check for multi-region trail and create a new one if one does not exist'
    Default: 'false'
    AllowedValues: ["true", "false"]
  EnableVpcFlowLogs:
    Type: String
    Description: 'Enable VpcFlowLogs for each of the Vpcs in your account if one does not exist'
    Default: 'false'
    AllowedValues: ["true", "false"]
Conditions:
  ShouldCreateCloudTrail:
    !Equals [true, !Ref EnableCloudTrailLogs]
  ShouldCreateVpcFlowLogs:
    !Equals [true, !Ref EnableVpcFlowLogs]
  ShouldCreateLambda:
    Fn::Or: [Condition: ShouldCreateCloudTrail, Condition: ShouldCreateVpcFlowLogs]
Resources:
  PrismaRole:
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/SecurityAudit
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: arn:aws:iam::188619942792:root
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                sts:ExternalId: !Ref 'ExternalID'
      Policies:
        - PolicyName: Prisma-IAM-ReadOnly-Policy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                  - mq:DescribeBroker
                  - apigateway:GET
                  - cognito-identity:ListTagsForResource
                  - cognito-idp:ListTagsForResource
                  - ecr:DescribeImages
                  - ecr:GetLifecyclePolicy
                  - directconnect:DescribeDirectConnectGateways
                  - elasticbeanstalk:ListTagsForResource
                  - elasticfilesystem:DescribeTags
                  - glacier:GetVaultLock
                  - glacier:ListTagsForVault
                  - glue:GetSecurityConfigurations
                  - logs:GetLogEvents
                  - mq:listBrokers
                  - mq:describeBroker
                  - ram:GetResourceShares
                  - secretsmanager:DescribeSecret
                  - ssm:GetParameters
                  - ssm:ListTagsForResource
                  - sqs:SendMessage
                  - elasticmapreduce:ListSecurityConfigurations
                  - sns:listSubscriptions
                  - wafv2:ListResourcesForWebACL
                  - wafv2:ListWebACLs
                  - waf-regional:ListResourcesForWebACL
                  - waf-regional:ListWebACLs-  
                Effect: Allow
                Resource: '*'
      RoleName: !Ref 'PrismaRoleName'
  LambdaOnboardRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: Prisma-IAM-ReadOnly-Policy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                  - cloudtrail:CreateTrail
                  - cloudtrail:GetTrailStatus
                  - cloudtrail:GetEventSelectors
                  - cloudtrail:DescribeTrails
                  - s3:CreateBucket
                  - s3:ListBucketVersions
                  - s3:ListBucket
                  - s3:GetBucketPolicy
                  - s3:HeadBucket
                  - s3:ListAllMyBuckets
                  - s3:GetBucketPolicyStatus
                  - s3:GetBucketVersioning
                  - s3:GetBucketAcl
                  - sts:GetCallerIdentity
                  - ec2:DescribeRegions
                  - ec2:CreateFlowLogs
                  - ec2:DescribeVpcs
                  - ec2:DescribeFlowLogs
                  - logs:DescribeLogGroups
                  - logs:CreateLogGroup
                  - iam:CreatePolicy
                  - iam:PassRole
                  - iam:CreateRole
                  - cloudtrail:StartLogging
                  - iam:AttachRolePolicy
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Effect: Allow
                Resource: '*'
              - Action:
                - s3:PutBucketPolicy
                Effect: Allow
                Resource: !Join 
                  - ''
                  - - 'arn:aws:s3:::prismatrail-'
                    - !Ref 'AWS::AccountId'
  LambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: "LambdaOnboardPrisma"
      Description: Onboarding Script for Prisma
      Runtime: python3.7
      Code:
        S3Bucket: "onboardprisma"
        S3Key: onboard.zip
      Handler: onboard_rl.main
      MemorySize: 128
      Timeout: 900
      Role:
        Fn::GetAtt:
          - LambdaOnboardRole
          - Arn
      Environment:
        Variables:
          PRISMA_USER_NAME:
            !Ref PrismaUsername
          PRISMA_PASSWORD:
            !Ref PrismaPassword
          PRISMA_CUSTOMER_NAME:
            !Ref PrismaCustomerName
          PRISMA_ACCOUNT_NAME:
            !Ref PrismaAccountName
          PRISMA_TENANT:
            !Ref PrismaTenant
          PRISMA_ACCOUNT_GROUP:
            !Ref PrismaAccountGroup
          PRISMA_ACCOUNT:
            !Ref CreatePrismaAccount
          PRISMA_CLOUDTRAIL:
            !If [ShouldCreateCloudTrail, true, false]
          PRISMA_VPC:
            !If [ShouldCreateVpcFlowLogs, true, false]
          EXTERNAL_ID:
            !Ref ExternalID
          ROLE_NAME:
            !Ref PrismaRoleName
          CF_REGION:
            !Ref AWS::Region
  OnboardScript:
    Type: Custom::OnboardPrismaScript
    Properties:
      ServiceToken: !GetAtt LambdaFunction.Arn
    DependsOn: LambdaFunction

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      -
        Label:
          default: "Prisma Account Information"
        Parameters:
          - PrismaUsername
          - PrismaPassword
          - PrismaCustomerName
          - PrismaAccountName
          - PrismaTenant
          - PrismaAccountGroup
          - CreatePrismaAccount
      -
        Label:
          default: "AWS Configuration"
        Parameters:
          - PrismaRoleName
          - ExternalID
          - EnableCloudTrailLogs
          - EnableVpcFlowLogs

Outputs:
  PrismaRoleName:
    Value: !Ref 'PrismaRoleName'
    Description: Prisma IAM role name