[SSPROD-40004] Adding permissions for aws-templates for the getFuncti…

…on call (#119) * Adding permissions for templates * grouping * small fix
sysdiglabs · May 11, 2024 · bf4346d · bf4346d
1 parent cee7459
commit bf4346d
Show file tree

Hide file tree

Showing 6 changed files with 27 additions and 9 deletions.
diff --git a/templates_cspm/CloudAgentlessRole.yaml b/templates_cspm/CloudAgentlessRole.yaml
@@ -66,7 +66,9 @@ Resources:
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
               - Effect: "Allow"
-                Action: "lambda:GetRuntimeManagementConfig"
+                Action:
+                  - "lambda:GetRuntimeManagementConfig"
+                  - "lambda:GetFunction"
                 Resource: "*"
 
 Outputs:

diff --git a/templates_cspm/OrgCloudAgentlessRole.yaml b/templates_cspm/OrgCloudAgentlessRole.yaml
@@ -68,7 +68,9 @@ Resources:
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
               - Effect: "Allow"
-                Action: "lambda:GetRuntimeManagementConfig"
+                Action:
+                  - "lambda:GetRuntimeManagementConfig"
+                  - "lambda:GetFunction"
                 Resource: "*"
   RoleStackSet:
     Type: AWS::CloudFormation::StackSet
@@ -142,5 +144,7 @@ Resources:
                         Action: "macie2:ListClassificationJobs"
                         Resource: "*"
                       - Effect: "Allow"
-                        Action: "lambda:GetRuntimeManagementConfig"
+                        Action:
+                          - "lambda:GetRuntimeManagementConfig"
+                          - "lambda:GetFunction"
                         Resource: "*"
diff --git a/templates_cspm_cloudlogs/FullInstall.yaml b/templates_cspm_cloudlogs/FullInstall.yaml
@@ -79,7 +79,9 @@ Resources:
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
               - Effect: "Allow"
-                Action: "lambda:GetRuntimeManagementConfig"
+                Action:
+                  - "lambda:GetRuntimeManagementConfig"
+                  - "lambda:GetFunction"
                 Resource: "*"
   CloudLogsRole:
     Type: "AWS::IAM::Role"

diff --git a/templates_cspm_cloudlogs/OrgFullInstall.yaml b/templates_cspm_cloudlogs/OrgFullInstall.yaml
@@ -84,7 +84,9 @@ Resources:
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
               - Effect: "Allow"
-                Action: "lambda:GetRuntimeManagementConfig"
+                Action:
+                  - "lambda:GetRuntimeManagementConfig"
+                  - "lambda:GetFunction"
                 Resource: "*"
   CloudLogsRole:
     Type: "AWS::IAM::Role"
@@ -196,5 +198,7 @@ Resources:
                         Action: "macie2:ListClassificationJobs"
                         Resource: "*"
                       - Effect: "Allow"
-                        Action: "lambda:GetRuntimeManagementConfig"
+                        Action:
+                          - "lambda:GetRuntimeManagementConfig"
+                          - "lambda:GetFunction"
                         Resource: "*"
diff --git a/templates_cspm_eventbridge/FullInstall.yaml b/templates_cspm_eventbridge/FullInstall.yaml
@@ -91,7 +91,9 @@ Resources:
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
               - Effect: "Allow"
-                Action: "lambda:GetRuntimeManagementConfig"
+                Action:
+                  - "lambda:GetRuntimeManagementConfig"
+                  - "lambda:GetFunction"
                 Resource: "*"
   EventBridgeRole:
     Type: AWS::IAM::Role

diff --git a/templates_cspm_eventbridge/OrgFullInstall.yaml b/templates_cspm_eventbridge/OrgFullInstall.yaml
@@ -135,7 +135,9 @@ Resources:
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
               - Effect: "Allow"
-                Action: "lambda:GetRuntimeManagementConfig"
+                Action:
+                  - "lambda:GetRuntimeManagementConfig"
+                  - "lambda:GetFunction"
                 Resource: "*"
   EventBridgeRole:
     Type: AWS::IAM::Role
@@ -251,7 +253,9 @@ Resources:
                         Action: "macie2:ListClassificationJobs"
                         Resource: "*"
                       - Effect: "Allow"
-                        Action: "lambda:GetRuntimeManagementConfig"
+                        Action:
+                          - "lambda:GetRuntimeManagementConfig"
+                          - "lambda:GetFunction"
                         Resource: "*"
           EventBridgeRole:
             Type: AWS::IAM::Role