Merge branch 'main' into 'main'

IAM permissions required for the Prowler v4 scans
awslabs · Jul 29, 2024 · 9ccc991 · 9ccc991
2 parents a8c4966 + a5cd972
commit 9ccc991
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/1-sat2-member-roles.yaml b/1-sat2-member-roles.yaml
@@ -54,18 +54,23 @@ Resources:
                 - cloudtrail:GetInsightSelectors
                 - codeartifact:List*
                 - codebuild:BatchGet*
+                - cognito-idp:GetUserPoolMfaConfig
+                - dlm:Get*
                 - drs:Describe*
                 - ds:Get*
                 - ds:Describe*
                 - ds:List*
+                - dynamodb:GetResourcePolicy
                 - ec2:GetEbsEncryptionByDefault
+                - ec2:GetInstanceMetadataDefaults
                 - ecr:Describe*
                 - ecr:GetRegistryScanningConfiguration
                 - elasticfilesystem:DescribeBackupPolicy
                 - glue:GetConnections
                 - glue:GetSecurityConfiguration*
                 - glue:SearchTables
                 - lambda:GetFunction*
+                - lightsail:GetRelationalDatabases
                 - logs:FilterLogEvents
                 - macie2:GetMacieSession
                 - s3:GetAccountPublicAccessBlock

diff --git a/2-sat2-codebuild-prowler.yaml b/2-sat2-codebuild-prowler.yaml
@@ -122,18 +122,23 @@ Resources:
                 - cloudtrail:GetInsightSelectors
                 - codeartifact:List*
                 - codebuild:BatchGet*
+                - cognito-idp:GetUserPoolMfaConfig
+                - dlm:Get*
                 - drs:Describe*
                 - ds:Get*
                 - ds:Describe*
                 - ds:List*
+                - dynamodb:GetResourcePolicy
                 - ec2:GetEbsEncryptionByDefault
+                - ec2:GetInstanceMetadataDefaults
                 - ecr:Describe*
                 - ecr:GetRegistryScanningConfiguration
                 - elasticfilesystem:DescribeBackupPolicy
                 - glue:GetConnections
                 - glue:GetSecurityConfiguration*
                 - glue:SearchTables
                 - lambda:GetFunction*
+                - lightsail:GetRelationalDatabases
                 - logs:FilterLogEvents
                 - macie2:GetMacieSession
                 - s3:GetAccountPublicAccessBlock