FEATURE: EKS Protection #61

ryanjpayne · 2024-08-13T18:26:02Z

Add resources and documentation to support CrowdStrike EKS Protection

kkvinjam

Please add a test in the .taskcat.yaml to deploy this new use case in addition to the review comments.

guide/content/images/~$eks-protect-diagram.pptx

kkvinjam · 2024-09-03T18:46:18Z

templates/eks-protection-stack.yml

+        - Arn
+
+  # CodeBuild Project to deploy Falcon Operator and Sensor
+  EKSCodeBuild:


Recommendation: CodeBuild project should specify an EncryptionKey value
Add exemption with valid reason if the project cannot be encrypted.

which linter does this flag apply? I do not see it in cfnlint or checkov

but the default cmk will suffice

This is coming from cfn_nag. Could you please add an exception to avoid flagging this in future. No value for EncryptionKey defaults to the managed CMK for Amazon Simple Storage Service (Amazon S3)

templates/eks-protection-stack.yml

lambda_functions/source/eks-existing-clusters/lambda.py

lambda_functions/source/eks-new-clusters/lambda.py

ryanjpayne · 2024-09-04T16:10:16Z

Please add a test in the .taskcat.yaml to deploy this new use case in addition to the review comments.

Need to add taskcat ssm params:

FalconCID
EKS Protection Account (the aws accountid to launch eks protection resources)
Falcon Docker API Token

Retrieve Docker API Token from falcon console>cloud accounts registration>kubernetes

Register new kubernetes cluster
Self-managed Kubernetes service
enter any cluster name
click generate
dockerapitoken will be in the generated config_value.yaml

kkvinjam · 2024-09-10T18:20:56Z

/do-e2e-tests

aws-ia-automator-prod · 2024-09-10T18:21:02Z

End to end test has been scheduled

aws-ia-automator-prod · 2024-09-10T18:21:20Z

E2E tests in progress

aws-ia-automator-prod

E2E test has completed with errors. If you are an external contributor, please contact the project maintainers for more information.

kkvinjam · 2024-09-11T03:57:54Z

E2E test has completed with errors. If you are an external contributor, please contact the project maintainers for more information.

@ryanjpayne since there are no default values, required parameters from failure reason below need to be added to all tests in the .taskcat.yml file.

Failure reason:

[ERROR  ] : The following parameters have no value whatsoever. The CloudFormation stack will fail to launch. Please address. str(['FalconCID', 'DockerAPIToken', 'EventBusAccount'])

kkvinjam · 2024-09-11T04:10:08Z

/do-e2e-tests

aws-ia-automator-prod · 2024-09-11T04:10:17Z

End to end test has been scheduled

aws-ia-automator-prod · 2024-09-11T04:10:35Z

E2E tests in progress

aws-ia-automator-prod

E2E test has completed with errors. If you are an external contributor, please contact the project maintainers for more information.

kkvinjam · 2024-09-06T18:07:29Z

templates/eks-target-roles-stackset.yml

+          - id: CKV_AWS_109
+            comment: IAM PassRole action is constrained by resource ARN.
+          - id: CKV_AWS_111
+            comment: IAM PassRole action is constrained by resource ARN.


do not see iam:PassRole in this policy. What is the need for this exception?

kkvinjam · 2024-09-12T00:20:09Z

templates/eks-protection-stack.yml

+      Name: !Ref CodeBuildProjectName
+      ServiceRole: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${CodeBuildRoleName}
+      Source: 
+        Location: !Sub '${StagingS3Bucket}/${SourceS3BucketNamePrefix}/codebuild/codebuild.zip'


@ryanjpayne This needs to be fixed to match with the new file location?

kkvinjam · 2024-09-12T02:31:15Z

/do-e2e-tests

aws-ia-automator-prod · 2024-09-12T02:31:26Z

End to end test has been scheduled

aws-ia-automator-prod · 2024-09-12T02:31:48Z

E2E tests in progress

aws-ia-automator-prod

E2E test has completed with errors. If you are an external contributor, please contact the project maintainers for more information.

kkvinjam · 2024-09-12T04:29:51Z

/do-e2e-tests

aws-ia-automator-prod · 2024-09-12T04:30:00Z

End to end test has been scheduled

aws-ia-automator-prod · 2024-09-12T04:30:20Z

E2E tests in progress

aws-ia-automator-prod

E2E test has completed with errors. If you are an external contributor, please contact the project maintainers for more information.

kkvinjam · 2024-09-12T13:41:47Z

/do-e2e-tests

aws-ia-automator-prod · 2024-09-12T13:42:03Z

End to end test has been scheduled

aws-ia-automator-prod · 2024-09-12T13:42:27Z

E2E tests in progress

aws-ia-automator-prod

E2E test has completed with errors. If you are an external contributor, please contact the project maintainers for more information.

lambda_functions/source/cw-helper/organizations.py

kkvinjam · 2024-09-13T00:53:14Z

/do-e2e-tests

aws-ia-automator-prod · 2024-09-13T00:53:27Z

End to end test has been scheduled

aws-ia-automator-prod · 2024-09-13T00:53:51Z

E2E tests in progress

aws-ia-automator-prod

E2E test has completed with errors. If you are an external contributor, please contact the project maintainers for more information.

kkvinjam · 2024-09-13T05:02:14Z

/do-e2e-tests

aws-ia-automator-prod · 2024-10-09T17:31:44Z

Static analysis has failed. Please review and take action as appropriate.

aws-ia-automator-prod · 2024-10-09T17:55:02Z

Static analysis has failed. Please review and take action as appropriate.

kkvinjam · 2024-10-11T03:04:09Z

/do-e2e-tests

aws-ia-automator-prod · 2024-10-11T03:04:23Z

End to end test has been scheduled

aws-ia-automator-prod · 2024-10-11T03:04:47Z

E2E tests in progress

aws-ia-automator-prod

E2E test has completed with errors. If you are an external contributor, please contact the project maintainers for more information.

kkvinjam · 2024-10-11T16:11:53Z

/do-e2e-tests

aws-ia-automator-prod · 2024-10-11T16:11:59Z

End to end test has been scheduled

aws-ia-automator-prod · 2024-10-11T16:12:18Z

E2E tests in progress

aws-ia-automator-prod

E2E test has completed with errors. If you are an external contributor, please contact the project maintainers for more information.

kkvinjam · 2024-10-22T16:39:26Z

/do-e2e-tests

aws-ia-automator-prod · 2024-10-22T16:39:36Z

End to end test has been scheduled

aws-ia-automator-prod · 2024-10-22T16:39:59Z

E2E tests in progress

aws-ia-automator-prod

E2E tests completed successfully

kkvinjam reviewed Sep 3, 2024

View reviewed changes

aws-ia-automator-prod bot requested changes Sep 10, 2024

View reviewed changes

aws-ia-automator-prod bot requested changes Sep 11, 2024

View reviewed changes

kkvinjam reviewed Sep 12, 2024

View reviewed changes

aws-ia-automator-prod bot requested changes Sep 12, 2024

View reviewed changes

kkvinjam requested changes Sep 12, 2024

View reviewed changes

lambda_functions/source/cw-helper/organizations.py Outdated Show resolved Hide resolved

lambda_functions/source/cw-helper/organizations.py Show resolved Hide resolved

aws-ia-automator-prod bot requested changes Sep 13, 2024

View reviewed changes

ryanjpayne added 6 commits September 23, 2024 07:13

fix subs

1141d0b

orgid function

79d4272

eb account conditional

1a40b43

data var

b96cb33

missing comma

8f23435

Update entrypoint.sh

ed64e7a

ryanjpayne force-pushed the FEAT-0824-eksprotection branch from d951cce to ed64e7a Compare September 23, 2024 14:13

kkvinjam and others added 2 commits October 7, 2024 10:21

Merge branch 'main' into FEAT-0824-eksprotection

263542b

checkov skip

b49f92e

bugfix ssm action

7dc7210

lambda descriptions

9d67ad9

aws-ia-automator-prod bot requested changes Oct 11, 2024

View reviewed changes

kkvinjam and others added 2 commits October 22, 2024 09:35

Merge branch 'main' into FEAT-0824-eksprotection

8c19b0b

minor version

4964da7

aws-ia-automator-prod bot approved these changes Oct 22, 2024

View reviewed changes

gcasilva approved these changes Oct 23, 2024

View reviewed changes

kkvinjam approved these changes Oct 23, 2024

View reviewed changes

kkvinjam merged commit 1573fce into aws-ia:main Oct 23, 2024
4 checks passed

FEATURE: EKS Protection #61

FEATURE: EKS Protection #61

Conversation

ryanjpayne commented Aug 13, 2024

kkvinjam left a comment

Choose a reason for hiding this comment

kkvinjam Sep 3, 2024

Choose a reason for hiding this comment

ryanjpayne Sep 4, 2024

Choose a reason for hiding this comment

ryanjpayne Sep 4, 2024

Choose a reason for hiding this comment

kkvinjam Sep 6, 2024

Choose a reason for hiding this comment

ryanjpayne commented Sep 4, 2024

kkvinjam commented Sep 10, 2024

aws-ia-automator-prod bot commented Sep 10, 2024

aws-ia-automator-prod bot commented Sep 10, 2024

aws-ia-automator-prod bot left a comment

Choose a reason for hiding this comment

kkvinjam commented Sep 11, 2024

kkvinjam commented Sep 11, 2024

aws-ia-automator-prod bot commented Sep 11, 2024

aws-ia-automator-prod bot commented Sep 11, 2024

aws-ia-automator-prod bot left a comment

Choose a reason for hiding this comment

kkvinjam Sep 6, 2024

Choose a reason for hiding this comment

kkvinjam Sep 12, 2024

Choose a reason for hiding this comment

kkvinjam commented Sep 12, 2024

aws-ia-automator-prod bot commented Sep 12, 2024

aws-ia-automator-prod bot commented Sep 12, 2024

aws-ia-automator-prod bot left a comment

Choose a reason for hiding this comment

kkvinjam commented Sep 12, 2024

aws-ia-automator-prod bot commented Sep 12, 2024

aws-ia-automator-prod bot commented Sep 12, 2024

aws-ia-automator-prod bot left a comment

Choose a reason for hiding this comment

kkvinjam commented Sep 12, 2024

aws-ia-automator-prod bot commented Sep 12, 2024

aws-ia-automator-prod bot commented Sep 12, 2024

aws-ia-automator-prod bot left a comment

Choose a reason for hiding this comment

kkvinjam commented Sep 13, 2024

aws-ia-automator-prod bot commented Sep 13, 2024

aws-ia-automator-prod bot commented Sep 13, 2024

aws-ia-automator-prod bot left a comment

Choose a reason for hiding this comment

kkvinjam commented Sep 13, 2024

aws-ia-automator-prod bot commented Oct 9, 2024

aws-ia-automator-prod bot commented Oct 9, 2024

kkvinjam commented Oct 11, 2024

aws-ia-automator-prod bot commented Oct 11, 2024

aws-ia-automator-prod bot commented Oct 11, 2024

aws-ia-automator-prod bot left a comment

Choose a reason for hiding this comment

kkvinjam commented Oct 11, 2024

aws-ia-automator-prod bot commented Oct 11, 2024

aws-ia-automator-prod bot commented Oct 11, 2024

aws-ia-automator-prod bot left a comment

Choose a reason for hiding this comment

kkvinjam commented Oct 22, 2024

aws-ia-automator-prod bot commented Oct 22, 2024

aws-ia-automator-prod bot commented Oct 22, 2024

aws-ia-automator-prod bot left a comment

Choose a reason for hiding this comment