aws

package
v2.14.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 11, 2026 License: Apache-2.0 Imports: 27 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var RequiredPermissions = map[IntegrationType][]string{
	Agentless: {
		"ec2:AssociateRouteTable",
		"ec2:AttachInternetGateway",
		"ec2:AuthorizeSecurityGroupEgress",
		"ec2:CreateInternetGateway",
		"ec2:CreateNetworkAclEntry",
		"ec2:CreateRoute",
		"ec2:CreateRouteTable",
		"ec2:CreateSecurityGroup",
		"ec2:CreateSubnet",
		"ec2:CreateTags",
		"ec2:CreateVpc",
		"ec2:DeleteInternetGateway",
		"ec2:DeleteRoute",
		"ec2:DeleteRouteTable",
		"ec2:DeleteSecurityGroup",
		"ec2:DeleteSubnet",
		"ec2:DeleteVpc",
		"ec2:DescribeInternetGateways",
		"ec2:DescribeNetworkAcls",
		"ec2:DescribeNetworkInterfaces",
		"ec2:DescribeRegions",
		"ec2:DescribeRouteTables",
		"ec2:DescribeSecurityGroupRules",
		"ec2:DescribeSecurityGroups",
		"ec2:DescribeSubnets",
		"ec2:DescribeVpcAttribute",
		"ec2:DescribeVpcClassicLink",
		"ec2:DescribeVpcClassicLinkDnsSupport",
		"ec2:DescribeVpcs",
		"ec2:DetachInternetGateway",
		"ec2:DeleteNetworkAclEntry",
		"ec2:DisassociateRouteTable",
		"ec2:ModifyVpcAttribute",
		"ec2:ReplaceNetworkAclAssociation",
		"ec2:RevokeSecurityGroupEgress",
		"ec2:RevokeSecurityGroupIngress",
		"ecs:CreateCluster",
		"ecs:DeleteCluster",
		"ecs:DeregisterTaskDefinition",
		"ecs:DescribeClusters",
		"ecs:DescribeTaskDefinition",
		"ecs:ListTasks",
		"ecs:PutClusterCapacityProviders",
		"ecs:RegisterTaskDefinition",
		"ecs:StopTask",
		"ecs:TagResource",
		"events:DeleteRule",
		"events:DescribeRule",
		"events:ListTagsForResource",
		"events:ListTargetsByRule",
		"events:PutRule",
		"events:PutTargets",
		"events:TagResource",
		"events:RemoveTargets",
		"iam:AttachRolePolicy",
		"iam:CreatePolicy",
		"iam:CreateRole",
		"iam:DeletePolicy",
		"iam:DeleteRole",
		"iam:DeleteRolePolicy",
		"iam:DetachRolePolicy",
		"iam:GetPolicy",
		"iam:GetPolicyVersion",
		"iam:GetRole",
		"iam:GetRolePolicy",
		"iam:GetUserPolicy",
		"iam:ListAttachedRolePolicies",
		"iam:ListAttachedUserPolicies",
		"iam:ListGroupsForUser",
		"iam:ListInstanceProfilesForRole",
		"iam:ListPolicyVersions",
		"iam:ListRolePolicies",
		"iam:ListUserPolicies",
		"iam:PassRole",
		"iam:PutRolePolicy",
		"iam:TagPolicy",
		"iam:TagRole",
		"logs:CreateLogGroup",
		"logs:DeleteLogGroup",
		"logs:DescribeLogGroups",
		"logs:ListTagsForResource",
		"logs:ListTagsLogGroup",
		"logs:PutRetentionPolicy",
		"logs:TagResource",
		"s3:CreateBucket",
		"s3:DeleteBucket",
		"s3:DeleteBucketPolicy",
		"s3:DeleteObject",
		"s3:DeleteObjectVersion",
		"s3:GetAccelerateConfiguration",
		"s3:GetBucketAcl",
		"s3:GetBucketCORS",
		"s3:GetBucketLogging",
		"s3:GetBucketObjectLockConfiguration",
		"s3:GetBucketOwnershipControls",
		"s3:GetBucketPolicy",
		"s3:GetBucketPublicAccessBlock",
		"s3:GetBucketRequestPayment",
		"s3:GetBucketTagging",
		"s3:GetBucketVersioning",
		"s3:GetBucketWebsite",
		"s3:GetEncryptionConfiguration",
		"s3:GetLifecycleConfiguration",
		"s3:GetReplicationConfiguration",
		"s3:ListBucket",
		"s3:ListBucketVersions",
		"s3:PutBucketOwnershipControls",
		"s3:PutBucketPolicy",
		"s3:PutBucketPublicAccessBlock",
		"s3:PutBucketTagging",
		"s3:PutBucketVersioning",
		"s3:PutEncryptionConfiguration",
		"s3:PutLifecycleConfiguration",
		"secretsmanager:CreateSecret",
		"secretsmanager:DeleteSecret",
		"secretsmanager:DescribeSecret",
		"secretsmanager:GetResourcePolicy",
		"secretsmanager:GetSecretValue",
		"secretsmanager:PutSecretValue",
		"secretsmanager:TagResource",
		"servicequotas:GetServiceQuota",
	},
	Config: {
		"iam:AttachRolePolicy",
		"iam:CreatePolicy",
		"iam:CreateRole",
		"iam:DeletePolicy",
		"iam:DeleteRole",
		"iam:DeleteRolePolicy",
		"iam:DetachRolePolicy",
		"iam:GetPolicy",
		"iam:GetPolicyVersion",
		"iam:GetRole",
		"iam:GetRolePolicy",
		"iam:GetUserPolicy",
		"iam:ListAttachedRolePolicies",
		"iam:ListAttachedUserPolicies",
		"iam:ListGroupsForUser",
		"iam:ListInstanceProfilesForRole",
		"iam:ListPolicyVersions",
		"iam:ListRolePolicies",
		"iam:ListUserPolicies",
		"iam:PutRolePolicy",
		"iam:TagPolicy",
		"iam:TagRole",
	},
	CloudTrail: {
		"cloudtrail:AddTags",
		"cloudtrail:CreateTrail",
		"cloudtrail:DeleteTrail",
		"cloudtrail:DescribeTrails",
		"cloudtrail:GetTrail",
		"cloudtrail:GetTrailStatus",
		"cloudtrail:ListTags",
		"cloudtrail:ListTrails",
		"cloudtrail:StartLogging",
		"iam:AttachRolePolicy",
		"iam:CreatePolicy",
		"iam:CreateRole",
		"iam:DeletePolicy",
		"iam:DeleteRole",
		"iam:DeleteRolePolicy",
		"iam:DetachRolePolicy",
		"iam:GetPolicy",
		"iam:GetPolicyVersion",
		"iam:GetRole",
		"iam:GetRolePolicy",
		"iam:GetUserPolicy",
		"iam:ListAttachedRolePolicies",
		"iam:ListAttachedUserPolicies",
		"iam:ListGroupsForUser",
		"iam:ListInstanceProfilesForRole",
		"iam:ListPolicyVersions",
		"iam:ListRolePolicies",
		"iam:ListUserPolicies",
		"iam:TagPolicy",
		"iam:TagRole",
		"kms:CreateKey",
		"kms:DescribeKey",
		"kms:EnableKeyRotation",
		"kms:GetKeyPolicy",
		"kms:GetKeyRotationStatus",
		"kms:ListResourceTags",
		"kms:PutKeyPolicy",
		"kms:ScheduleKeyDeletion",
		"kms:TagResource",
		"s3:CreateBucket",
		"s3:DeleteBucket",
		"s3:DeleteBucketPolicy",
		"s3:DeleteObject",
		"s3:DeleteObjectVersion",
		"s3:GetAccelerateConfiguration",
		"s3:GetBucketAcl",
		"s3:GetBucketCORS",
		"s3:GetBucketLogging",
		"s3:GetBucketObjectLockConfiguration",
		"s3:GetBucketOwnershipControls",
		"s3:GetBucketPolicy",
		"s3:GetBucketPublicAccessBlock",
		"s3:GetBucketRequestPayment",
		"s3:GetBucketTagging",
		"s3:GetBucketVersioning",
		"s3:GetBucketWebsite",
		"s3:GetEncryptionConfiguration",
		"s3:GetLifecycleConfiguration",
		"s3:GetReplicationConfiguration",
		"s3:ListBucket",
		"s3:ListBucketVersions",
		"s3:PutBucketAcl",
		"s3:PutBucketLogging",
		"s3:PutBucketNotification",
		"s3:PutBucketOwnershipControls",
		"s3:PutBucketPolicy",
		"s3:PutBucketPublicAccessBlock",
		"s3:PutBucketTagging",
		"s3:PutBucketVersioning",
		"s3:PutEncryptionConfiguration",
		"s3:PutObject",
		"sns:CreateTopic",
		"sns:DeleteTopic",
		"sns:GetSubscriptionAttributes",
		"sns:GetTopicAttributes",
		"sns:ListTagsForResource",
		"sns:SetTopicAttributes",
		"sns:Subscribe",
		"sns:TagResource",
		"sns:Unsubscribe",
		"sqs:CreateQueue",
		"sqs:DeleteQueue",
		"sqs:GetQueueAttributes",
		"sqs:ListQueueTags",
		"sqs:SetQueueAttributes",
		"sqs:TagQueue",
	},
	EksAuditLog: {
		"ec2:DescribeRegions",
		"s3:CreateBucket",
		"s3:DeleteBucket",
		"s3:ListBucket",
		"s3:ListBucketVersions",
		"s3:GetBucketPolicy",
		"s3:GetBucketAcl",
		"s3:GetBucketCORS",
		"s3:GetBucketWebsite",
		"s3:GetBucketVersioning",
		"s3:GetAccelerateConfiguration",
		"s3:GetBucketRequestPayment",
		"s3:GetBucketLogging",
		"s3:GetLifecycleConfiguration",
		"s3:GetReplicationConfiguration",
		"s3:GetEncryptionConfiguration",
		"s3:GetBucketObjectLockConfiguration",
		"s3:GetBucketTagging",
		"s3:GetBucketOwnershipControls",
		"s3:GetBucketPublicAccessBlock",
		"s3:GetBucketNotification",
		"s3:PutBucketOwnershipControls",
		"s3:PutBucketPublicAccessBlock",
		"s3:PutBucketVersioning",
		"s3:PutBucketLogging",
		"s3:PutLifecycleConfiguration",
		"s3:PutEncryptionConfiguration",
		"s3:PutBucketNotification",
		"s3:PutBucketTagging",
		"s3:DeleteObjectVersion",
		"iam:CreateRole",
		"iam:DeleteRole",
		"iam:GetRole",
		"iam:ListRolePolicies",
		"iam:ListAttachedRolePolicies",
		"iam:ListPolicyVersions",
		"iam:ListInstanceProfilesForRole",
		"iam:GetPolicy",
		"iam:GetPolicyVersion",
		"iam:CreatePolicy",
		"iam:DeletePolicy",
		"iam:AttachRolePolicy",
		"iam:DetachRolePolicy",
		"iam:ListAttachedUserPolicies",
		"iam:ListUserPolicies",
		"iam:ListGroupsForUser",
		"iam:PassRole",
		"iam:TagRole",
		"iam:TagPolicy",
		"kms:CreateKey",
		"kms:PutKeyPolicy",
		"kms:EnableKeyRotation",
		"kms:DescribeKey",
		"kms:GetKeyPolicy",
		"kms:GetKeyRotationStatus",
		"kms:ListResourceTags",
		"kms:ScheduleKeyDeletion",
		"kms:CreateAlias",
		"kms:ListAliases",
		"kms:DeleteAlias",
		"kms:Encrypt",
		"kms:Decrypt",
		"kms:GenerateDataKey",
		"kms:CreateGrant",
		"kms:ListGrants",
		"kms:RevokeGrant",
		"kms:TagResource",
		"SNS:CreateTopic",
		"SNS:DeleteTopic",
		"SNS:SetTopicAttributes",
		"SNS:GetTopicAttributes",
		"SNS:ListTagsForResource",
		"SNS:TagResource",
		"firehose:CreateDeliveryStream",
		"firehose:DescribeDeliveryStream",
		"firehose:StartDeliveryStreamEncryption",
		"firehose:ListTagsForDeliveryStream",
		"firehose:DeleteDeliveryStream",
		"firehose:TagDeliveryStream",
		"logs:PutSubscriptionFilter",
		"logs:DescribeSubscriptionFilters",
		"logs:DeleteSubscriptionFilter",
	},
}
View Source 
var RequiredPermissionsForOrg = map[IntegrationType][]string{
	Agentless: {
		"cloudformation:CreateStackInstances",
		"cloudformation:CreateStackSet",
		"cloudformation:DeleteStackInstances",
		"cloudformation:DeleteStackSet",
		"cloudformation:DescribeStackSet",
		"cloudformation:DescribeStackSetOperation",
		"cloudformation:ListStackInstances",
		"cloudformation:TagResource",
		"ec2:AssociateRouteTable",
		"ec2:AttachInternetGateway",
		"ec2:AuthorizeSecurityGroupEgress",
		"ec2:CreateFlowLogs",
		"ec2:CreateInternetGateway",
		"ec2:CreateNetworkAclEntry",
		"ec2:CreateRoute",
		"ec2:CreateRouteTable",
		"ec2:CreateSecurityGroup",
		"ec2:CreateSubnet",
		"ec2:CreateTags",
		"ec2:CreateVpc",
		"ec2:DeleteFlowLogs",
		"ec2:DeleteInternetGateway",
		"ec2:DeleteNetworkAclEntry",
		"ec2:DeleteRoute",
		"ec2:DeleteRouteTable",
		"ec2:DeleteSecurityGroup",
		"ec2:DeleteSubnet",
		"ec2:DeleteVpc",
		"ec2:DescribeFlowLogs",
		"ec2:DescribeInternetGateways",
		"ec2:DescribeNetworkAcls",
		"ec2:DescribeNetworkInterfaces",
		"ec2:DescribeRegions",
		"ec2:DescribeRouteTables",
		"ec2:DescribeSecurityGroupRules",
		"ec2:DescribeSecurityGroups",
		"ec2:DescribeSubnets",
		"ec2:DescribeVpcAttribute",
		"ec2:DescribeVpcClassicLink",
		"ec2:DescribeVpcClassicLinkDnsSupport",
		"ec2:DescribeVpcs",
		"ec2:DetachInternetGateway",
		"ec2:DisassociateRouteTable",
		"ec2:ModifyVpcAttribute",
		"ec2:ReplaceNetworkAclAssociation",
		"ec2:RevokeSecurityGroupEgress",
		"ec2:RevokeSecurityGroupIngress",
		"ecs:CreateCluster",
		"ecs:DeleteCluster",
		"ecs:DeregisterTaskDefinition",
		"ecs:DescribeClusters",
		"ecs:DescribeTaskDefinition",
		"ecs:ListTasks",
		"ecs:PutClusterCapacityProviders",
		"ecs:RegisterTaskDefinition",
		"ecs:StopTask",
		"ecs:TagResource",
		"events:DeleteRule",
		"events:DescribeRule",
		"events:ListTagsForResource",
		"events:ListTargetsByRule",
		"events:PutRule",
		"events:PutTargets",
		"events:RemoveTargets",
		"events:TagResource",
		"iam:AttachRolePolicy",
		"iam:CreatePolicy",
		"iam:CreateRole",
		"iam:DeletePolicy",
		"iam:DeleteRole",
		"iam:DeleteRolePolicy",
		"iam:DetachRolePolicy",
		"iam:GetPolicy",
		"iam:GetPolicyVersion",
		"iam:GetRole",
		"iam:GetRolePolicy",
		"iam:GetUserPolicy",
		"iam:ListAttachedRolePolicies",
		"iam:ListAttachedUserPolicies",
		"iam:ListGroupsForUser",
		"iam:ListInstanceProfilesForRole",
		"iam:ListPolicyVersions",
		"iam:ListRolePolicies",
		"iam:ListUserPolicies",
		"iam:PassRole",
		"iam:PutRolePolicy",
		"iam:TagPolicy",
		"iam:TagRole",
		"logs:CreateDelivery",
		"logs:CreateLogDelivery",
		"logs:CreateLogGroup",
		"logs:CreateLogStream",
		"logs:DeleteLogGroup",
		"logs:DescribeLogGroups",
		"logs:DescribeLogStreams",
		"logs:ListTagsForResource",
		"logs:ListTagsLogGroup",
		"logs:PutLogEvents",
		"logs:PutRetentionPolicy",
		"logs:TagResource",
		"organizations:DescribeAccount",
		"organizations:DescribeOrganization",
		"organizations:ListAccounts",
		"organizations:ListAWSServiceAccessForOrganization",
		"organizations:ListOrganizationalUnitsForParent",
		"organizations:ListRoots",
		"s3:CreateBucket",
		"s3:DeleteBucket",
		"s3:DeleteBucketPolicy",
		"s3:DeleteObject",
		"s3:DeleteObjectVersion",
		"s3:GetAccelerateConfiguration",
		"s3:GetBucketAcl",
		"s3:GetBucketCORS",
		"s3:GetBucketLogging",
		"s3:GetBucketObjectLockConfiguration",
		"s3:GetBucketOwnershipControls",
		"s3:GetBucketPolicy",
		"s3:GetBucketPublicAccessBlock",
		"s3:GetBucketRequestPayment",
		"s3:GetBucketTagging",
		"s3:GetBucketVersioning",
		"s3:GetBucketWebsite",
		"s3:GetEncryptionConfiguration",
		"s3:GetLifecycleConfiguration",
		"s3:GetObject",
		"s3:GetReplicationConfiguration",
		"s3:ListBucket",
		"s3:ListBucketVersions",
		"s3:PutBucketOwnershipControls",
		"s3:PutBucketPolicy",
		"s3:PutBucketPublicAccessBlock",
		"s3:PutBucketTagging",
		"s3:PutBucketVersioning",
		"s3:PutEncryptionConfiguration",
		"s3:PutLifecycleConfiguration",
		"secretsmanager:CreateSecret",
		"secretsmanager:DeleteSecret",
		"secretsmanager:DescribeSecret",
		"secretsmanager:GetResourcePolicy",
		"secretsmanager:GetSecretValue",
		"secretsmanager:PutSecretValue",
		"secretsmanager:TagResource",
		"servicequotas:GetServiceQuota",
	},
	Config: {
		"cloudformation:CreateStack",
		"cloudformation:CreateStackInstances",
		"cloudformation:CreateStackSet",
		"cloudformation:DeleteStack",
		"cloudformation:DeleteStackInstances",
		"cloudformation:DeleteStackSet",
		"cloudformation:DescribeStacks",
		"cloudformation:DescribeStackSet",
		"cloudformation:DescribeStackSetOperation",
		"cloudformation:GetTemplate",
		"cloudformation:ListStackInstances",
		"cloudformation:TagResource",
		"iam:AttachRolePolicy",
		"iam:CreatePolicy",
		"iam:CreateRole",
		"iam:DeletePolicy",
		"iam:DeleteRole",
		"iam:DeleteRolePolicy",
		"iam:DetachRolePolicy",
		"iam:GetPolicy",
		"iam:GetPolicyVersion",
		"iam:GetRole",
		"iam:GetRolePolicy",
		"iam:GetUserPolicy",
		"iam:ListAttachedRolePolicies",
		"iam:ListAttachedUserPolicies",
		"iam:ListGroupsForUser",
		"iam:ListInstanceProfilesForRole",
		"iam:ListPolicyVersions",
		"iam:ListRolePolicies",
		"iam:ListUserPolicies",
		"iam:PassRole",
		"iam:PutRolePolicy",
		"iam:TagPolicy",
		"iam:TagRole",
		"kms:CreateKey",
		"kms:DescribeKey",
		"kms:GetKeyPolicy",
		"kms:GetKeyRotationStatus",
		"kms:ListResourceTags",
		"kms:PutKeyPolicy",
		"kms:ScheduleKeyDeletion",
		"kms:TagResource",
		"lambda:AddPermission",
		"lambda:CreateFunction",
		"lambda:DeleteFunction",
		"lambda:GetFunction",
		"lambda:GetFunctionCodeSigningConfig",
		"lambda:GetPolicy",
		"lambda:InvokeFunction",
		"lambda:ListVersionsByFunction",
		"lambda:RemovePermission",
		"lambda:TagResource",
		"organizations:DescribeAccount",
		"organizations:DescribeOrganization",
		"organizations:ListAccounts",
		"organizations:ListAWSServiceAccessForOrganization",
		"organizations:ListOrganizationalUnitsForParent",
		"organizations:ListRoots",
		"s3:CreateBucket",
		"s3:DeleteBucket",
		"s3:DeleteObject",
		"s3:DeleteObjectVersion",
		"s3:GetAccelerateConfiguration",
		"s3:GetBucketAcl",
		"s3:GetBucketCORS",
		"s3:GetBucketLogging",
		"s3:GetBucketObjectLockConfiguration",
		"s3:GetBucketOwnershipControls",
		"s3:GetBucketPolicy",
		"s3:GetBucketPublicAccessBlock",
		"s3:GetBucketRequestPayment",
		"s3:GetBucketTagging",
		"s3:GetBucketVersioning",
		"s3:GetBucketWebsite",
		"s3:GetEncryptionConfiguration",
		"s3:GetLifecycleConfiguration",
		"s3:GetObject",
		"s3:GetReplicationConfiguration",
		"s3:ListBucket",
		"s3:ListBucketVersions",
		"s3:PutBucketOwnershipControls",
		"s3:PutBucketPublicAccessBlock",
		"s3:PutBucketVersioning",
		"secretsmanager:CreateSecret",
		"secretsmanager:DeleteSecret",
		"secretsmanager:DescribeSecret",
		"secretsmanager:GetResourcePolicy",
		"secretsmanager:GetSecretValue",
		"secretsmanager:PutSecretValue",
		"secretsmanager:TagResource",
		"sns:CreateTopic",
		"sns:DeleteTopic",
		"sns:GetSubscriptionAttributes",
		"sns:GetTopicAttributes",
		"sns:ListTagsForResource",
		"sns:SetTopicAttributes",
		"sns:Subscribe",
		"sns:TagResource",
		"sns:Unsubscribe",
	},
	CloudTrail: {
		"cloudtrail:AddTags",
		"cloudtrail:CreateTrail",
		"cloudtrail:DeleteTrail",
		"cloudtrail:DescribeTrails",
		"cloudtrail:GetTrail",
		"cloudtrail:GetTrailStatus",
		"cloudtrail:ListTags",
		"cloudtrail:ListTrails",
		"cloudtrail:StartLogging",
		"iam:AttachRolePolicy",
		"iam:CreatePolicy",
		"iam:CreateRole",
		"iam:DeletePolicy",
		"iam:DeleteRole",
		"iam:DeleteRolePolicy",
		"iam:DetachRolePolicy",
		"iam:GetPolicy",
		"iam:GetPolicyVersion",
		"iam:GetRole",
		"iam:GetRolePolicy",
		"iam:GetUserPolicy",
		"iam:ListAttachedRolePolicies",
		"iam:ListAttachedUserPolicies",
		"iam:ListGroupsForUser",
		"iam:ListInstanceProfilesForRole",
		"iam:ListPolicyVersions",
		"iam:ListRolePolicies",
		"iam:ListUserPolicies",
		"iam:TagPolicy",
		"iam:TagRole",
		"kms:CreateKey",
		"kms:DescribeKey",
		"kms:EnableKeyRotation",
		"kms:GetKeyPolicy",
		"kms:GetKeyRotationStatus",
		"kms:ListResourceTags",
		"kms:PutKeyPolicy",
		"kms:ScheduleKeyDeletion",
		"kms:TagResource",
		"organizations:DescribeAccount",
		"organizations:DescribeOrganization",
		"organizations:ListAccounts",
		"organizations:ListAWSServiceAccessForOrganization",
		"organizations:ListOrganizationalUnitsForParent",
		"organizations:ListRoots",
		"s3:CreateBucket",
		"s3:DeleteBucket",
		"s3:DeleteBucketPolicy",
		"s3:DeleteObject",
		"s3:DeleteObjectVersion",
		"s3:GetAccelerateConfiguration",
		"s3:GetBucketAcl",
		"s3:GetBucketCORS",
		"s3:GetBucketLogging",
		"s3:PutBucketNotification",
		"s3:GetBucketObjectLockConfiguration",
		"s3:GetBucketOwnershipControls",
		"s3:GetBucketPolicy",
		"s3:GetBucketPublicAccessBlock",
		"s3:GetBucketRequestPayment",
		"s3:GetBucketTagging",
		"s3:GetBucketVersioning",
		"s3:GetBucketWebsite",
		"s3:GetEncryptionConfiguration",
		"s3:GetLifecycleConfiguration",
		"s3:GetReplicationConfiguration",
		"s3:ListBucket",
		"s3:ListBucketVersions",
		"s3:PutBucketAcl",
		"s3:PutBucketLogging",
		"s3:PutBucketOwnershipControls",
		"s3:PutBucketPolicy",
		"s3:PutBucketPublicAccessBlock",
		"s3:PutBucketTagging",
		"s3:PutBucketVersioning",
		"s3:PutEncryptionConfiguration",
		"s3:PutObject",
		"sns:CreateTopic",
		"sns:DeleteTopic",
		"sns:GetSubscriptionAttributes",
		"sns:GetTopicAttributes",
		"sns:ListTagsForResource",
		"sns:SetTopicAttributes",
		"sns:Subscribe",
		"sns:TagResource",
		"sns:Unsubscribe",
		"sqs:CreateQueue",
		"sqs:DeleteQueue",
		"sqs:GetQueueAttributes",
		"sqs:ListQueueTags",
		"sqs:SetQueueAttributes",
		"sqs:TagQueue",
	},
	EksAuditLog: {
		"ec2:DescribeRegions",
		"organizations:DescribeAccount",
		"organizations:DescribeOrganization",
		"organizations:ListAccounts",
		"organizations:ListAWSServiceAccessForOrganization",
		"organizations:ListOrganizationalUnitsForParent",
		"organizations:ListRoots",
		"s3:CreateBucket",
		"s3:DeleteBucket",
		"s3:ListBucket",
		"s3:ListBucketVersions",
		"s3:GetBucketPolicy",
		"s3:GetBucketAcl",
		"s3:GetBucketCORS",
		"s3:GetBucketWebsite",
		"s3:GetBucketVersioning",
		"s3:GetAccelerateConfiguration",
		"s3:GetBucketRequestPayment",
		"s3:GetBucketLogging",
		"s3:GetLifecycleConfiguration",
		"s3:GetReplicationConfiguration",
		"s3:GetEncryptionConfiguration",
		"s3:GetBucketObjectLockConfiguration",
		"s3:GetBucketTagging",
		"s3:GetBucketOwnershipControls",
		"s3:GetBucketPublicAccessBlock",
		"s3:GetBucketNotification",
		"s3:PutBucketOwnershipControls",
		"s3:PutBucketPublicAccessBlock",
		"s3:PutBucketVersioning",
		"s3:PutBucketLogging",
		"s3:PutLifecycleConfiguration",
		"s3:PutEncryptionConfiguration",
		"s3:PutBucketNotification",
		"s3:PutBucketTagging",
		"s3:DeleteObjectVersion",
		"iam:CreateRole",
		"iam:DeleteRole",
		"iam:GetRole",
		"iam:ListRolePolicies",
		"iam:ListAttachedRolePolicies",
		"iam:ListPolicyVersions",
		"iam:ListInstanceProfilesForRole",
		"iam:GetPolicy",
		"iam:GetPolicyVersion",
		"iam:CreatePolicy",
		"iam:DeletePolicy",
		"iam:AttachRolePolicy",
		"iam:DetachRolePolicy",
		"iam:ListAttachedUserPolicies",
		"iam:ListUserPolicies",
		"iam:ListGroupsForUser",
		"iam:PassRole",
		"iam:TagRole",
		"iam:TagPolicy",
		"kms:CreateKey",
		"kms:PutKeyPolicy",
		"kms:EnableKeyRotation",
		"kms:DescribeKey",
		"kms:GetKeyPolicy",
		"kms:GetKeyRotationStatus",
		"kms:ListResourceTags",
		"kms:ScheduleKeyDeletion",
		"kms:CreateAlias",
		"kms:ListAliases",
		"kms:DeleteAlias",
		"kms:Encrypt",
		"kms:Decrypt",
		"kms:GenerateDataKey",
		"kms:CreateGrant",
		"kms:ListGrants",
		"kms:RevokeGrant",
		"kms:TagResource",
		"SNS:CreateTopic",
		"SNS:DeleteTopic",
		"SNS:SetTopicAttributes",
		"SNS:GetTopicAttributes",
		"SNS:ListTagsForResource",
		"SNS:TagResource",
		"firehose:CreateDeliveryStream",
		"firehose:DescribeDeliveryStream",
		"firehose:StartDeliveryStreamEncryption",
		"firehose:ListTagsForDeliveryStream",
		"firehose:DeleteDeliveryStream",
		"firehose:TagDeliveryStream",
		"logs:PutSubscriptionFilter",
		"logs:DescribeSubscriptionFilters",
		"logs:DeleteSubscriptionFilter",
	},
}

Functions

func CheckCloudTrailOrgServiceEnabled added in v2.13.0 

func CheckCloudTrailOrgServiceEnabled(p *Preflight) error

func CheckPermissions 

func CheckPermissions(p *Preflight) error

func CheckPermissionsViaSimulation added in v2.13.0 

func CheckPermissionsViaSimulation(p *Preflight) error

CheckPermissionsViaSimulation evaluates the required permissions against the caller's effective policies using IAM SimulatePrincipalPolicy. Unlike the static policy walk in CheckPermissions, this includes SCPs and permission boundaries because AWS performs the same evaluation it would for a real API call.

func CheckVPCQuota added in v2.3.0 

func CheckVPCQuota(p *Preflight) error

For AWS Agentless only

func FetchCaller 

func FetchCaller(p *Preflight) error

func FetchEKSClusters added in v2.14.0 

func FetchEKSClusters(p *Preflight) error

func FetchExistingTrail added in v2.14.0 

func FetchExistingTrail(p *Preflight) error

func FetchOrgAccounts added in v2.14.0 

func FetchOrgAccounts(p *Preflight) error

func FetchOrgInfo added in v2.14.0 

func FetchOrgInfo(p *Preflight) error

func FetchOrgUnits added in v2.14.0 

func FetchOrgUnits(p *Preflight) error

func FetchPolicies 

func FetchPolicies(p *Preflight) error

func FetchRegions added in v2.14.0 

func FetchRegions(p *Preflight) error

func ParseResourceName 

func ParseResourceName(arnStr string) (string, error)

ParseResourceName extracts the resource name from the caller identity Arn Examples:

  • arn:aws:iam::123456789012:root -> root
  • arn:aws:iam::123456789012:user/MyUser -> MyUser
  • arn:aws:iam::123456789012:role/application_abc/component_xyz/RDSAccess -> RDSAccess
  • arn:aws:iam::123456789012:assumed-role/preflight_ro/aws-go-sdk-00000000000 -> preflight_ro

Types

type Caller 

type Caller struct {
	AccountID string
	ARN       string
	UserID    string
	Name      string // user name or role name
	IsRoot    bool
	IsAdmin   bool // true if the caller is root user or policies contain the action '*'
}

func (*Caller) IsAssumedRole 

func (c *Caller) IsAssumedRole() bool

type Details 

type Details struct {
	Regions       []string // Regions that are enabled for the caller account
	ExistingTrail Trail    // Existing eligible trail for CloudTrail integration
	EKSClusters   []EKSCluster

	// Fields for org-level
	OrgAccess                   bool
	OrgID                       string
	IsManagementAccount         bool
	ManagementAccountID         string
	OrgAccountIDs               []string
	OrgUnitIDs                  []string
	RootOrgUnitID               string
	ControlTowerAccess          bool
	CloudTrailOrgServiceEnabled bool
}

type EKSCluster 

type EKSCluster struct {
	Name   string
	Region string
}

type IntegrationType 

type IntegrationType string
const (
	Agentless   IntegrationType = "aws_agentless"
	Config      IntegrationType = "aws_config"
	CloudTrail  IntegrationType = "aws_cloudtrail"
	EksAuditLog IntegrationType = "aws_eks_audit_log"
)

type Params 

type Params struct {
	Agentless       bool
	Config          bool
	CloudTrail      bool
	EksAuditLog     bool
	IsOrg           bool // If it's org-level integration
	Simulate        bool // Use IAM SimulatePrincipalPolicy (covers SCPs and permission boundaries)
	Region          string
	Profile         string
	AccessKeyID     string
	SecretAccessKey string
	SessionToken    string // Optional for temporary credentials
}

type Policy 

type Policy struct {
	Version   string
	Statement []StatementEntry
}

type Preflight 

type Preflight struct {
	// contains filtered or unexported fields
}

func New 

func New(params Params) (*Preflight, error)

func (*Preflight) Run 

func (p *Preflight) Run() (*Result, error)

func (*Preflight) SetVerboseWriter added in v2.3.0 

func (p *Preflight) SetVerboseWriter(vw verbosewriter.WriteCloser)

Overwrite the default verbose writer

type Result 

type Result struct {
	Caller  Caller
	Details Details
	Errors  map[IntegrationType][]string
}

type StatementEntry 

type StatementEntry struct {
	Effect   string
	Action   []string
	Resource []string
}

type Trail 

type Trail struct {
	Name        string
	S3BucketARN string
	SNSTopicARN string
	KMSKeyARN   string
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.