Skip to content
Permalink
Branch: master
Find file Copy path
Find file Copy path
1 contributor

Users who have contributed to this file

100 lines (99 sloc) 4.01 KB
---
# Copyright 2018 widdix GmbH
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
AWSTemplateFormatVersion: '2010-09-09'
Description: 'cfn-modules: EC2 SSM example'
Resources:
Alerting:
Type: 'AWS::CloudFormation::Stack'
Properties:
Parameters:
Email: 'email@domain.com' # replace with your email address to receive alerts
# HttpsEndpoint: 'https://api.marbot.io/v1/endpoint/xyz' # or uncommnet and receive alerts in Slack using marbot.io
TemplateURL: './node_modules/@cfn-modules/alerting/module.yml'
Vpc:
Type: 'AWS::CloudFormation::Stack'
Properties:
Parameters:
AlertingModule: !GetAtt 'Alerting.Outputs.StackName'
S3Endpoint: 'false' # speed up the example
DynamoDBEndpoint: 'false' # speed up the example
FlowLog: 'false' # speed up the example
NatGateways: 'false' # speed up the example
TemplateURL: './node_modules/@cfn-modules/vpc/module.yml'
InstancePolicy:
Type: 'AWS::IAM::ManagedPolicy'
Properties:
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- 'ssm:ListInstanceAssociations' # State Manager by https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html
- 'ssm:GetDeployablePatchSnapshotForInstance' # Patch Manager by trial and error
Resource: '*'
- Effect: Allow # Patch Manager by trial and error
Action: 'ssm:PutInventory'
Resource: '*'
- Effect: Allow # Patch Manager by https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent-minimum-s3-permissions.html
Action: 's3:GetObject'
Resource:
- !Sub 'arn:aws:s3:::aws-ssm-${AWS::Region}/*'
- !Sub 'arn:aws:s3:::amazon-ssm-${AWS::Region}/*'
- !Sub 'arn:aws:s3:::amazon-ssm-packages-${AWS::Region}/*'
- !Sub 'arn:aws:s3:::${AWS::Region}-birdwatcher-prod/*'
- !Sub 'arn:aws:s3:::patch-baseline-snapshot-${AWS::Region}/*'
- Effect: Allow # AWS-GatherSoftwareInventory
Action: 'ssm:GetDocument'
Resource: !Sub 'arn:${AWS::Partition}:ssm:${AWS::Region}::document/AWS-GatherSoftwareInventory'
- Effect: Allow # AWS-GatherSoftwareInventory
Action: 'ssm:UpdateInstanceAssociationStatus'
Resource: '*'
Instance:
Type: 'AWS::CloudFormation::Stack'
Properties:
Parameters:
VpcModule: !GetAtt 'Vpc.Outputs.StackName'
AlertingModule: !GetAtt 'Alerting.Outputs.StackName'
AmazonLinux2Version: '2.0.20181114'
ManagedPolicyArns: !Ref InstancePolicy
TemplateURL: './node_modules/@cfn-modules/ec2-instance-amazon-linux2/module.yml'
AssociationGatherSoftwareInventory:
Type: 'AWS::SSM::Association'
Properties:
Name: 'AWS-GatherSoftwareInventory'
ScheduleExpression: 'rate(1 hour)'
Targets:
- Key: InstanceIds
Values: [!GetAtt 'Instance.Outputs.Id']
AssociationRunPatchBaselineScan:
Type: 'AWS::SSM::Association'
Properties:
Name: 'AWS-RunPatchBaseline'
Parameters:
Operation: [Scan]
ScheduleExpression: 'rate(1 hour)'
Targets:
- Key: InstanceIds
Values: [!GetAtt 'Instance.Outputs.Id']
AssociationRunPatchBaselineInstall:
Type: 'AWS::SSM::Association'
Properties:
Name: 'AWS-RunPatchBaseline'
Parameters:
Operation: [Install]
ScheduleExpression: 'rate(1 hour)'
Targets:
- Key: InstanceIds
Values: [!GetAtt 'Instance.Outputs.Id']
You can’t perform that action at this time.