panther-cloudsec-iam.yml

AWSTemplateFormatVersion: 2010-09-09
Description: IAM roles for an account being scanned by Panther.

Mappings:
  # DO NOT EDIT PantherParameters section. Panther application relies on the exact format (including comments)
  # in order to replace the default values with an appropriate ones.
  PantherParameters:
    MasterAccountId:
      Value: '' # MasterAccountId
    MasterAccountRegion:
      Value: '' # MasterAccountRegion
    DeployCloudWatchEventSetup:
      Value: '' # DeployCloudWatchEventSetup

Parameters:
  # Required parameters
  MasterAccountId:
    Type: String
    Description: DO NOT EDIT MANUALLY! Parameter is already populated with the appropriate value.
    Default: ''
  MasterAccountRegion:
    Type: String
    Description: DO NOT EDIT MANUALLY! Parameter is already populated with the appropriate value.
    Default: ''

  # Deployment toggles
  DeployCloudWatchEventSetup:
    Type: String
    Description: DO NOT EDIT MANUALLY! Parameter is already populated with the appropriate value.
    Default: ''

Conditions:
  # Condition to define if the template is generated by panther backend
  GeneratedTemplate: !Not [!Equals ['', !FindInMap [PantherParameters, MasterAccountId, Value]]]

  # Condition whether the generated template has CW events setup
  GeneratedCloudWatchEventSetup:
    !Equals [true, !FindInMap [PantherParameters, DeployCloudWatchEventSetup, Value]]

  # Condition whether the default template values configure CW events setup
  DefaultCloudWatchEventSetup: !Equals [true, !Ref DeployCloudWatchEventSetup]

  # Condition whether we should enable CWE
  EnableCloudWatchEvent: !Or
    - !And [Condition: GeneratedTemplate, Condition: GeneratedCloudWatchEventSetup]
    - !And [!Not [Condition: GeneratedTemplate], Condition: DefaultCloudWatchEventSetup]

Resources:
  AuditRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !If # DO NOT CHANGE! backend.yml CF depends on this name
        - GeneratedTemplate
        - !Sub
          - PantherAuditRole-${Mapping}
          - Mapping: !FindInMap [PantherParameters, MasterAccountRegion, Value]
        - !Sub PantherAuditRole-${MasterAccountRegion}
      Description: The Panther master account assumes this role for read-only security scanning
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: !If
                - GeneratedTemplate
                - !Sub
                  - 'arn:${Partition}:iam::${Mapping}:root'
                  - Partition: !Ref AWS::Partition
                    Mapping: !FindInMap [PantherParameters, MasterAccountId, Value]
                - !Sub arn:${AWS::Partition}:iam::${MasterAccountId}:root
            Action: sts:AssumeRole
            Condition:
              Bool:
                aws:SecureTransport: true
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/SecurityAudit
      Policies:
        # CloudFormationStackDriftDetection and CloudFormationStackDriftDetectionSupplements Policies
        # are not directly required for scanning, but are required by AWS in
        # order to perform CloudFormation Stack drift detection on the corresponding resource types
        # If you delete those policies,
        # make sure to exclude CloudFormation stacks from your cloud security source setup,
        # otherwise you will be notified every 24 hours that those scans are failing.
        - PolicyName: CloudFormationStackDriftDetection
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - cloudformation:DetectStackDrift
                  - cloudformation:DetectStackResourceDrift
                Resource: '*'
        - PolicyName: CloudFormationStackDriftDetectionSupplements
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - sns:GetDataProtectionPolicy
                  - sns:ListTagsForResource
                  - lambda:GetFunction
                  - apigateway:GET
                Resource: '*'
        - PolicyName: GetWAFACLs
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - waf:GetRateBasedRule
                  - waf:GetRule
                  - waf:GetRuleGroup
                  - waf:GetWebACL
                  - waf-regional:GetRateBasedRule
                  - waf-regional:GetRule
                  - waf-regional:GetRuleGroup
                  - waf-regional:GetWebACL
                  - waf-regional:GetWebACLForResource
                Resource: '*'
        - PolicyName: GetTags
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - dynamodb:ListTagsOfResource
                  - kms:ListResourceTags
                  - waf:ListTagsForResource
                  - waf-regional:ListTagsForResource
                Resource: '*'
        - PolicyName: ListDescribeEKS
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - eks:ListClusters
                  - eks:ListFargateProfiles
                  - eks:ListNodegroups
                  - eks:DescribeCluster
                  - eks:DescribeFargateProfile
                  - eks:DescribeNodegroup
                Resource: '*'
        - PolicyName: DescribeDynamodb
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - dynamodb:Describe*
                Resource: '*'
      Tags:
        - Key: panther:app
          Value: panther

  CloudFormationStackSetExecutionRole:
    Condition: EnableCloudWatchEvent
    Type: AWS::IAM::Role
    Properties:
      RoleName: !If # DO NOT CHANGE! backend.yml CF depends on this name
        - GeneratedTemplate
        - !Sub
          - PantherCloudFormationStackSetExecutionRole-${Mapping}
          - Mapping: !FindInMap [PantherParameters, MasterAccountRegion, Value]
        - !Sub PantherCloudFormationStackSetExecutionRole-${MasterAccountRegion}
      Description: CloudFormation assumes this role to execute a stack set
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: !If
                - GeneratedTemplate
                - !Sub
                  - 'arn:${Partition}:iam::${Mapping}:root'
                  - Partition: !Ref AWS::Partition
                    Mapping: !FindInMap [PantherParameters, MasterAccountId, Value]
                - !Sub arn:${AWS::Partition}:iam::${MasterAccountId}:root
            Action: sts:AssumeRole
      Policies:
        - PolicyName: ManageCloudFormationStack
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: cloudformation:*
                Resource: '*'
        - PolicyName: PantherSetupRealTimeEvents
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - events:*
                  - sns:*
                Resource: '*'
      Tags:
        - Key: panther:app
          Value: panther

Outputs:
  AuditRoleARN:
    Description: The ARN of the Panther Audit IAM Role
    Value: !GetAtt AuditRole.Arn
  CloudFormationStackSetExecutionRoleArn:
    Condition: EnableCloudWatchEvent
    Description: The Arn of the CloudFormation StackSet Execution Role for configuring Panther infra.
    Value: !GetAtt CloudFormationStackSetExecutionRole.Arn
  CloudFormationStackSetExecutionRoleName:
    Condition: EnableCloudWatchEvent
    Description: The name of the CloudFormation StackSet Execution Role for configuring Panther infra.
    Value: !Ref CloudFormationStackSetExecutionRole