Skip to content

Commit 516189f

Browse files
jinrohjinroh
committed
wip
1 parent 3d83f8b commit 516189f

2 files changed

Lines changed: 211 additions & 0 deletions

File tree

‎aws_quickstart/datadog_agentless_stackset.yaml‎

Lines changed: 206 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,206 @@
1+
AWSTemplateFormatVersion: '2010-09-09'
2+
Description: Creates a StackSet to deploy Datadog Agentless Scanning delegate roles across multiple AWS accounts
3+
Parameters:
4+
DatadogAPIKey:
5+
Type: String
6+
AllowedPattern: "[0-9a-f]{32}"
7+
Description: API key for the Datadog account
8+
NoEcho: true
9+
10+
DatadogAPPKey:
11+
Type: String
12+
AllowedPattern: "[0-9a-f]{40}"
13+
Description: Application key for the Datadog account
14+
NoEcho: true
15+
16+
DatadogSite:
17+
Type: String
18+
Description: The Datadog site to use for the Datadog Agentless Scanner
19+
Default: datadoghq.com
20+
AllowedValues:
21+
- datadoghq.com
22+
- datadoghq.eu
23+
- us3.datadoghq.com
24+
- us5.datadoghq.com
25+
- ap1.datadoghq.com
26+
- ap2.datadoghq.com
27+
28+
AgentlessHostScanning:
29+
Type: String
30+
AllowedValues:
31+
- true
32+
- false
33+
Description: Enable Agentless Scanning of host vulnerabilities.
34+
Default: false
35+
36+
AgentlessContainerScanning:
37+
Type: String
38+
AllowedValues:
39+
- true
40+
- false
41+
Description: Enable Agentless Scanning of container vulnerabilities.
42+
Default: false
43+
44+
AgentlessLambdaScanning:
45+
Type: String
46+
AllowedValues:
47+
- true
48+
- false
49+
Description: Enable Agentless Scanning of Lambda vulnerabilities.
50+
Default: false
51+
52+
AgentlessSensitiveDataScanning:
53+
Type: String
54+
AllowedValues:
55+
- true
56+
- false
57+
Description: Enable Agentless Scanning of datastores (S3 buckets).
58+
Default: false
59+
60+
ScannerInstanceRoleARN:
61+
Type: CommaDelimitedList
62+
Description: The ARNs of the roles of the Datadog Agentless Scanner instances that will assume the delegate role.
63+
AllowedPattern: 'arn:aws:iam::[0-9]{12}:role/.*'
64+
65+
ScannerDelegateRoleName:
66+
Type: String
67+
Description: The name of the role assumed by the Datadog Agentless Scanner
68+
Default: DatadogAgentlessScannerDelegateRole
69+
70+
TargetAccountIds:
71+
Type: CommaDelimitedList
72+
Description: Comma-separated list of AWS account IDs where the delegate role should be deployed (e.g., 123456789012,234567890123)
73+
74+
StackSetAdministrationRoleARN:
75+
Type: String
76+
Description: (Optional) ARN of the administration role to use for StackSet operations. If not provided, the service-managed permissions model will be used.
77+
Default: ""
78+
79+
StackSetExecutionRoleName:
80+
Type: String
81+
Description: Name of the execution role in target accounts for StackSet operations
82+
Default: AWSCloudFormationStackSetExecutionRole
83+
84+
Conditions:
85+
UseServiceManagedPermissions: !Equals [!Ref StackSetAdministrationRoleARN, ""]
86+
UseSelfManagedPermissions: !Not [!Equals [!Ref StackSetAdministrationRoleARN, ""]]
87+
88+
Resources:
89+
DatadogAgentlessDelegateRoleStackSet:
90+
Type: AWS::CloudFormation::StackSet
91+
Properties:
92+
StackSetName: DatadogAgentlessScannerDelegateRoleStackSet
93+
Description: Deploys Datadog Agentless Scanning delegate roles across multiple AWS accounts
94+
PermissionModel: !If [UseServiceManagedPermissions, SERVICE_MANAGED, SELF_MANAGED]
95+
AdministrationRoleARN: !If [UseSelfManagedPermissions, !Ref StackSetAdministrationRoleARN, !Ref AWS::NoValue]
96+
ExecutionRoleName: !If [UseSelfManagedPermissions, !Ref StackSetExecutionRoleName, !Ref AWS::NoValue]
97+
CallAs: DELEGATED_ADMIN
98+
Capabilities:
99+
- CAPABILITY_NAMED_IAM
100+
# TemplateURL: "https://<BUCKET_PLACEHOLDER>.s3.amazonaws.com/aws/<VERSION_PLACEHOLDER>/datadog_agentless_delegate_role.yaml"
101+
TemplateURL: "https://datadog-cloudformation-template-quickstart.s3.amazonaws.com/aws/<VERSION_PLACEHOLDER>/datadog_agentless_delegate_role.yaml"
102+
Parameters:
103+
- ParameterKey: AccountId
104+
ParameterValue: $ACCOUNT_ID
105+
- ParameterKey: DatadogAPIKey
106+
ParameterValue: !Ref DatadogAPIKey
107+
- ParameterKey: DatadogAPPKey
108+
ParameterValue: !Ref DatadogAPPKey
109+
- ParameterKey: DatadogSite
110+
ParameterValue: !Ref DatadogSite
111+
- ParameterKey: AgentlessHostScanning
112+
ParameterValue: !Ref AgentlessHostScanning
113+
- ParameterKey: AgentlessContainerScanning
114+
ParameterValue: !Ref AgentlessContainerScanning
115+
- ParameterKey: AgentlessLambdaScanning
116+
ParameterValue: !Ref AgentlessLambdaScanning
117+
- ParameterKey: AgentlessSensitiveDataScanning
118+
ParameterValue: !Ref AgentlessSensitiveDataScanning
119+
- ParameterKey: ScannerInstanceRoleARN
120+
ParameterValue: !Join [',', !Ref ScannerInstanceRoleARN]
121+
- ParameterKey: ScannerDelegateRoleName
122+
ParameterValue: !Ref ScannerDelegateRoleName
123+
OperationPreferences:
124+
MaxConcurrentCount: 1
125+
FailureToleranceCount: 0
126+
RegionConcurrencyType: PARALLEL
127+
StackInstancesGroup:
128+
- DeploymentTargets:
129+
Accounts: !Ref TargetAccountIds
130+
Regions:
131+
- us-east-1
132+
Tags:
133+
- Key: DatadogAgentlessScanner
134+
Value: 'true'
135+
- Key: Datadog
136+
Value: 'true'
137+
138+
Outputs:
139+
StackSetId:
140+
Description: The ID of the created StackSet
141+
Value: !Ref DatadogAgentlessDelegateRoleStackSet
142+
Export:
143+
Name: !Sub '${AWS::StackName}-StackSetId'
144+
145+
StackSetName:
146+
Description: The name of the created StackSet
147+
Value: DatadogAgentlessScannerDelegateRoleStackSet
148+
Export:
149+
Name: !Sub '${AWS::StackName}-StackSetName'
150+
151+
TargetAccounts:
152+
Description: List of target AWS accounts where delegate roles are deployed
153+
Value: !Join [',', !Ref TargetAccountIds]
154+
155+
Metadata:
156+
AWS::CloudFormation::Interface:
157+
ParameterGroups:
158+
- Label:
159+
default: "StackSet Configuration"
160+
Parameters:
161+
- TargetAccountIds
162+
- StackSetAdministrationRoleARN
163+
- StackSetExecutionRoleName
164+
- Label:
165+
default: "Datadog Configuration"
166+
Parameters:
167+
- DatadogAPIKey
168+
- DatadogAPPKey
169+
- DatadogSite
170+
- Label:
171+
default: "Scanner Configuration"
172+
Parameters:
173+
- ScannerInstanceRoleARN
174+
- ScannerDelegateRoleName
175+
- Label:
176+
default: "Scanning Options"
177+
Parameters:
178+
- AgentlessHostScanning
179+
- AgentlessContainerScanning
180+
- AgentlessLambdaScanning
181+
- AgentlessSensitiveDataScanning
182+
ParameterLabels:
183+
TargetAccountIds:
184+
default: Target Account IDs
185+
StackSetAdministrationRoleARN:
186+
default: StackSet Administration Role ARN
187+
StackSetExecutionRoleName:
188+
default: StackSet Execution Role Name
189+
DatadogAPIKey:
190+
default: Datadog API Key
191+
DatadogAPPKey:
192+
default: Datadog Application Key
193+
DatadogSite:
194+
default: Datadog Site
195+
ScannerInstanceRoleARN:
196+
default: Scanner Instance Role ARN
197+
ScannerDelegateRoleName:
198+
default: Scanner Delegate Role Name
199+
AgentlessHostScanning:
200+
default: Enable Host Scanning
201+
AgentlessContainerScanning:
202+
default: Enable Container Scanning
203+
AgentlessLambdaScanning:
204+
default: Enable Lambda Scanning
205+
AgentlessSensitiveDataScanning:
206+
default: Enable Sensitive Data Scanning

‎aws_quickstart/release.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,10 @@ cp main_extended.yaml main_extended.yaml.bak
5555
perl -pi -e "s/<BUCKET_PLACEHOLDER>/${BUCKET}/g" main_extended.yaml
5656
perl -pi -e "s/<VERSION_PLACEHOLDER>/${VERSION}/g" main_extended.yaml
5757

58+
cp datadog_agentless_stackset.yaml datadog_agentless_stackset.yaml.bak
59+
perl -pi -e "s/<BUCKET_PLACEHOLDER>/${BUCKET}/g" "datadog_agentless_stackset.yaml"
60+
perl -pi -e "s/<VERSION_PLACEHOLDER>/${VERSION}/g" "datadog_agentless_stackset.yaml"
61+
5862
# Process Agentless Scanning templates
5963
for template in datadog_agentless_delegate_role.yaml datadog_agentless_scanning.yaml datadog_agentless_delegate_role_snapshot.yaml datadog_integration_autoscaling_policy.yaml; do
6064
# Note: unlike above, here we remove the 'v' prefix from the version
@@ -78,6 +82,7 @@ trap 'mv main_v2.yaml.bak main_v2.yaml;
7882
mv datadog_agentless_delegate_role.yaml.bak datadog_agentless_delegate_role.yaml;
7983
mv datadog_agentless_delegate_role_snapshot.yaml.bak datadog_agentless_delegate_role_snapshot.yaml;
8084
mv datadog_integration_autoscaling_policy.yaml.bak datadog_integration_autoscaling_policy.yaml;
85+
mv datadog_agentless_stackset.yaml.bak datadog_agentless_stackset.yaml;
8186
' EXIT
8287

8388
# Upload

0 commit comments

Comments
 (0)