WIP: Adding IAM rules

aws/aws_blueprints_template/main.tf

@@ -86,4 +86,16 @@ module "port_load_balancer" {
   source = "../load_balancer"
   count = contains(var.resources, "load_balancer") ? 1 : 0
   depends_on = [port-labs_blueprint.region]
+}
+
+module "port_iam_role" {
+  source = "../iam_role"
+  count = contains(var.resources, "iam_role") ? 1 : 0
+  depends_on = [port-labs_blueprint.region]
+}
+
+module "port_iam_policy" {
+  source = "../iam_policy"
+  count = contains(var.resources, "iam_policy") ? 1 : 0
+  depends_on = [port-labs_blueprint.region]
 }

aws/iam_policy/blueprint.tf

@@ -0,0 +1,35 @@
+terraform {
+  required_providers {
+    port-labs = {
+      source  = "port-labs/port-labs"
+      version = "0.10.4"
+    }
+  }
+}
+
+resource "port-labs_blueprint" "iam_policy" {
+  title      = "IAM Policy"
+  icon       = "AWS"
+  identifier = "iam_policy"
+
+  properties {
+    identifier = "link"
+    type       = "string"
+    format     = "url"
+    title      = "Link"
+  }
+
+  properties {
+    identifier = "arn"
+    type       = "string"
+    title      = "ARN"
+  }
+
+  relations {
+       target     = "region"
+       title      = "Region"
+       identifier = "region"
+       many       = false
+       required   = false
+   }
+}

aws/iam_policy/config.json

@@ -0,0 +1,18 @@
+{
+  "kind": "AWS::IAM::Policy",
+  "port": {
+    "entity": {
+      "mappings": [
+        {
+          "identifier": ".PolicyName",
+          "title": ".PolicyName",
+          "blueprint": "iam_policy",
+          "properties": {
+            "link": "\"https://console.aws.amazon.com/go/view?arn=\" + .Arn",
+            "arn": ".Arn"
+          }
+        }
+      ]
+    }
+  }
+}

aws/iam_policy/event_rule.yaml

@@ -0,0 +1,49 @@
+SQSEventRule:
+  Type: AWS::Events::Rule
+  Properties:
+    EventBusName: default
+    EventPattern:
+      source:
+        - aws.iam
+      detail-type:
+        - AWS API Call via CloudTrail
+      detail:
+        eventSource:
+          - iam.amazonaws.com
+        eventName:
+          - prefix: AttachGroupPolicy
+          - prefix: AttachRolePolicy
+          - prefix: AttachUserPolicy
+          - prefix: CreatePolicy
+          - prefix: CreatePolicyVersion
+          - prefix: DeleteGroupPolicy
+          - prefix: DeletePolicy
+          - prefix: DeletePolicyVersion
+          - prefix: DeleteRolePolicy
+          - prefix: DeleteUserPolicy
+          - prefix: DetachGroupPolicy
+          - prefix: DetachRolePolicy
+          - prefix: DetachUserPolicy
+          - prefix: PutGroupPolicy
+          - prefix: PutRolePolicy
+          - prefix: PutUserPolicy
+          - prefix: SetDefaultPolicyVersion
+    Name: port-aws-exporter-sync-iam-trails
+    State: ENABLED
+    Targets:
+      - Id: PortAWSExporterEventsQueue
+        Arn:
+          Fn::ImportValue:
+            Fn::Sub: ${PortAWSExporterStackName}-EventsQueueARN
+        InputTransformer:
+          InputPathsMap:
+            awsRegion: $.detail.awsRegion
+            eventName: $.detail.eventName
+            requestPolicyName: $.detail.requestParameters.policyName
+          InputTemplate: |-
+            {
+              "resource_type": "AWS::IAM::Policy",
+              "region": "\"<awsRegion>\"",
+              "identifier": "\"<requestPolicyName>\"",
+              "action": "if \"<eventName>\" | test(\"DeletePolicy[^a-zA-Z]*$\") then \"delete\" else \"upsert\" end"
+            }

aws/iam_policy/policy.json

@@ -0,0 +1,16 @@
+[
+  "iam:ListPolicies",
+  "iam:GetPolicyVersion",
+  "iam:GetPolicy",
+  "iam:ListGroupPolicies",
+  "iam:ListPoliciesGrantingServiceAccess",
+  "iam:ListEntitiesForPolicy",
+  "iam:ListUserPolicies",
+  "iam:ListPolicyVersions",
+  "iam:GetUserPolicy",
+  "iam:ListAttachedRolePolicies",
+  "iam:ListAttachedUserPolicies",
+  "iam:ListAttachedGroupPolicies",
+  "iam:ListPolicyTags",
+  "iam:ListRolePolicies"
+]

aws/iam_role/blueprint.tf

@@ -0,0 +1,41 @@
+terraform {
+  required_providers {
+    port-labs = {
+      source  = "port-labs/port-labs"
+      version = "0.10.4"
+    }
+  }
+}
+
+resource "port-labs_blueprint" "iam_role" {
+  title      = "IAM Role"
+  icon       = "AWS"
+  identifier = "iam_role"
+
+  properties {
+    identifier = "link"
+    type       = "string"
+    format     = "url"
+    title      = "Link"
+  }
+
+  properties {
+    identifier = "description"
+    type       = "string"
+    title      = "Description"
+  }
+
+  properties {
+    identifier = "arn"
+    type       = "string"
+    title      = "ARN"
+  }
+
+  relations {
+       target     = "region"
+       title      = "Region"
+       identifier = "region"
+       many       = false
+       required   = false
+   }
+}

aws/iam_role/config.json

@@ -0,0 +1,19 @@
+{
+  "kind": "AWS::IAM::Role",
+  "port": {
+    "entity": {
+      "mappings": [
+        {
+          "identifier": ".RoleName",
+          "title": ".RoleName",
+          "blueprint": "iam_role",
+          "properties": {
+            "link": "\"https://console.aws.amazon.com/go/view?arn=\" + .Arn",
+            "arn": ".Arn",
+            "description": ".Description"
+          }
+        }
+      ]
+    }
+  }
+}

aws/iam_role/event_rule.yaml

@@ -0,0 +1,41 @@
+SQSEventRule:
+  Type: AWS::Events::Rule
+  Properties:
+    EventBusName: default
+    EventPattern:
+      source:
+        - aws.iam
+      detail-type:
+        - AWS API Call via CloudTrail
+      detail:
+        eventSource:
+          - iam.amazonaws.com
+        eventName:
+          - prefix: AddRoleToInstanceProfile
+          - prefix: AttachRolePolicy
+          - prefix: CreateRole
+          - prefix: DeleteRole
+          - prefix: DeleteRolePolicy
+          - prefix: DetachRolePolicy
+          - prefix: PutRolePolicy
+          - prefix: RemoveRoleFromInstanceProfile
+          - prefix: UpdateAssumeRolePolicy
+    Name: port-aws-exporter-sync-iam-trails
+    State: ENABLED
+    Targets:
+      - Id: PortAWSExporterEventsQueue
+        Arn:
+          Fn::ImportValue:
+            Fn::Sub: ${PortAWSExporterStackName}-EventsQueueARN
+        InputTransformer:
+          InputPathsMap:
+            awsRegion: $.detail.awsRegion
+            eventName: $.detail.eventName
+            requestRoleName: $.detail.requestParameters.roleName
+          InputTemplate: |-
+            {
+              "resource_type": "AWS::IAM::Role",
+              "region": "\"<awsRegion>\"",
+              "identifier": "\"<requestRoleName>\"",
+              "action": "if \"<eventName>\" | test(\"DeleteRole[^a-zA-Z]*$\") then \"delete\" else \"upsert\" end"
+            }

aws/iam_role/policy.json

@@ -0,0 +1,9 @@
+[
+  "iam:ListInstanceProfilesForRole",
+  "iam:ListRoleTags",
+  "iam:ListAttachedRolePolicies",
+  "iam:ListRoles",
+  "iam:ListRolePolicies",
+  "iam:GetRole",
+  "iam:GetRolePolicy"
+]

aws/iam_user/blueprint.tf

@@ -0,0 +1,49 @@
+terraform {
+  required_providers {
+    port-labs = {
+      source  = "port-labs/port-labs"
+      version = "0.10.4"
+    }
+  }
+}
+
+resource "port-labs_blueprint" "iam_user" {
+  title      = "IAM User"
+  icon       = "AWS"
+  identifier = "iam_user"
+
+  properties {
+    identifier = "link"
+    type       = "string"
+    format     = "url"
+    title      = "Link"
+  }
+
+  properties {
+    identifier = "description"
+    type       = "string"
+    title      = "Description"
+  }
+
+  properties {
+    identifier = "arn"
+    type       = "string"
+    title      = "ARN"
+  }
+
+  relations {
+       target     = "region"
+       title      = "Region"
+       identifier = "region"
+       many       = false
+       required   = false
+   }
+
+  relations {
+       target     = "role"
+       title      = "Role"
+       identifier = "role"
+       many       = true
+       required   = false
+   }
+}

aws/iam_user/config.json

@@ -0,0 +1,19 @@
+{
+  "kind": "AWS::IAM::User",
+  "port": {
+    "entity": {
+      "mappings": [
+        {
+          "identifier": ".UserName",
+          "title": ".RoleName",
+          "blueprint": "iam_role",
+          "properties": {
+            "link": "\"https://console.aws.amazon.com/go/view?arn=\" + .Arn",
+            "arn": ".Arn",
+            "description": ".Description"
+          }
+        }
+      ]
+    }
+  }
+}

aws/iam_user/event_rule.yaml

@@ -0,0 +1,41 @@
+SQSEventRule:
+  Type: AWS::Events::Rule
+  Properties:
+    EventBusName: default
+    EventPattern:
+      source:
+        - aws.iam
+      detail-type:
+        - AWS API Call via CloudTrail
+      detail:
+        eventSource:
+          - iam.amazonaws.com
+        eventName:
+          - prefix: CreateUser
+          - prefix: AddUserToGroup
+          - prefix: AttachUserPolicy
+          - prefix: DeleteUser
+          - prefix: DeleteUserPolicy
+          - prefix: DetachUserPolicy
+          - prefix: PutUserPolicy
+          - prefix: RemoveUserFromGroup
+          - prefix: UpdateUser
+    Name: port-aws-exporter-sync-iam-user-trails
+    State: ENABLED
+    Targets:
+      - Id: PortAWSExporterEventsQueue
+        Arn:
+          Fn::ImportValue:
+            Fn::Sub: ${PortAWSExporterStackName}-EventsQueueARN
+        InputTransformer:
+          InputPathsMap:
+            awsRegion: $.detail.awsRegion
+            eventName: $.detail.eventName
+            requestUserName: $.detail.requestParameters.userName
+          InputTemplate: |-
+            {
+              "resource_type": "AWS::IAM::User",
+              "region": "\"<awsRegion>\"",
+              "identifier": "\"<userName>\"",
+              "action": "if \"<eventName>\" | test(\"DeleteUser[^a-zA-Z]*$\") then \"delete\" else \"upsert\" end"
+            }

aws/iam_user/policy.json

@@ -0,0 +1,8 @@
+[
+  "iam:ListInstanceProfilesForRole",
+  "iam:ListRoleTags",
+  "iam:ListAttachedRolePolicies",
+  "iam:ListRoles",
+  "iam:ListRolePolicies",
+  "iam:GetRole"
+]