upd: update policy 118 to be supported by open source Cloud Custodian

epam · Jan 28, 2025 · 0157f50 · 0157f50
1 parent 0fa2912
commit 0157f50
Show file tree

Hide file tree

Showing 25 changed files with 291 additions and 448 deletions.
diff --git a/...r_have_empty_roles_for_service_task_definitions/placebo-green/ecs.DescribeServices_1.json b/...r_have_empty_roles_for_service_task_definitions/placebo-green/ecs.DescribeServices_1.json
diff --git a/..._empty_roles_for_service_task_definitions/placebo-green/ecs.DescribeTaskDefinition_1.json b/..._empty_roles_for_service_task_definitions/placebo-green/ecs.DescribeTaskDefinition_1.json
diff --git a/...uster_have_empty_roles_for_service_task_definitions/placebo-green/ecs.ListClusters_1.json b/...uster_have_empty_roles_for_service_task_definitions/placebo-green/ecs.ListClusters_1.json
diff --git a/...uster_have_empty_roles_for_service_task_definitions/placebo-green/ecs.ListServices_1.json b/...uster_have_empty_roles_for_service_task_definitions/placebo-green/ecs.ListServices_1.json
diff --git a/...ter_have_empty_roles_for_service_task_definitions/placebo-red/ecs.DescribeServices_1.json b/...ter_have_empty_roles_for_service_task_definitions/placebo-red/ecs.DescribeServices_1.json
diff --git a/...ve_empty_roles_for_service_task_definitions/placebo-red/ecs.DescribeTaskDefinition_1.json b/...ve_empty_roles_for_service_task_definitions/placebo-red/ecs.DescribeTaskDefinition_1.json
diff --git a/...cluster_have_empty_roles_for_service_task_definitions/placebo-red/ecs.ListClusters_1.json b/...cluster_have_empty_roles_for_service_task_definitions/placebo-red/ecs.ListClusters_1.json
diff --git a/...cluster_have_empty_roles_for_service_task_definitions/placebo-red/ecs.ListServices_1.json b/...cluster_have_empty_roles_for_service_task_definitions/placebo-red/ecs.ListServices_1.json
diff --git a/.../ecc-aws-118-ecs_cluster_have_empty_roles_for_service_task_definitions/red_policy_test.py b/.../ecc-aws-118-ecs_cluster_have_empty_roles_for_service_task_definitions/red_policy_test.py
diff --git a/...ty_roles_for_service_task_definitions.yml → ...ty_roles_for_service_task_definitions.yml b/...ty_roles_for_service_task_definitions.yml → ...ty_roles_for_service_task_definitions.yml
@@ -8,7 +8,9 @@ policies:
   - name: ecc-aws-118-ecs_cluster_have_empty_roles_for_service_task_definitions
     comment: '010033082000'
     description: |
-      Container is using IAM roles for an instance
-    resource: ecs-service
+      ECS task definition without attached task IAM role for AWS resource access
+    resource: aws.ecs-task-definition
     filters:
-      - type: ecs-task-definition-filter
+      - type: value
+        key: taskRoleArn
+        value: empty
diff --git a/terraform/ecc-aws-110-ecs_cluster_at_rest_encryption/green1/iam.tf b/terraform/ecc-aws-110-ecs_cluster_at_rest_encryption/green1/iam.tf
@@ -31,7 +31,7 @@ resource "aws_iam_policy" "this" {
         "logs:PutLogEvents",
         "logs:DescribeLogStreams"
       ],
-      "Resource": "${aws_cloudwatch_log_group.this.arn}/*"
+      "Resource": "${aws_cloudwatch_log_group.this.arn}:*"
     }
   ]
 }

diff --git a/terraform/ecc-aws-110-ecs_cluster_at_rest_encryption/green2/iam.tf b/terraform/ecc-aws-110-ecs_cluster_at_rest_encryption/green2/iam.tf
@@ -31,7 +31,7 @@ resource "aws_iam_policy" "this" {
         "logs:PutLogEvents",
         "logs:DescribeLogStreams"
       ],
-      "Resource": "${aws_cloudwatch_log_group.this.arn}/*"
+      "Resource": "${aws_cloudwatch_log_group.this.arn}:*"
     }
   ]
 }