FEATURE: EKS Protection #61

ryanjpayne · 2024-08-13T18:26:02Z

Add resources and documentation to support CrowdStrike EKS Protection

kkvinjam

Please add a test in the .taskcat.yaml to deploy this new use case in addition to the review comments.

guide/content/images/~$eks-protect-diagram.pptx

kkvinjam · 2024-09-03T18:46:18Z

templates/eks-protection-stack.yml

+        - Arn
+
+  # CodeBuild Project to deploy Falcon Operator and Sensor
+  EKSCodeBuild:


Recommendation: CodeBuild project should specify an EncryptionKey value
Add exemption with valid reason if the project cannot be encrypted.

which linter does this flag apply? I do not see it in cfnlint or checkov

but the default cmk will suffice

This is coming from cfn_nag. Could you please add an exception to avoid flagging this in future. No value for EncryptionKey defaults to the managed CMK for Amazon Simple Storage Service (Amazon S3)

templates/eks-protection-stack.yml

lambda_functions/source/eks-existing-clusters/lambda.py

lambda_functions/source/eks-new-clusters/lambda.py

ryanjpayne · 2024-09-04T16:10:16Z

Please add a test in the .taskcat.yaml to deploy this new use case in addition to the review comments.

Need to add taskcat ssm params:

FalconCID
EKS Protection Account (the aws accountid to launch eks protection resources)
Falcon Docker API Token

Retrieve Docker API Token from falcon console>cloud accounts registration>kubernetes

Register new kubernetes cluster
Self-managed Kubernetes service
enter any cluster name
click generate
dockerapitoken will be in the generated config_value.yaml

kkvinjam · 2024-09-10T18:20:56Z

/do-e2e-tests

aws-ia-automator-prod · 2024-09-10T18:21:02Z

End to end test has been scheduled

aws-ia-automator-prod · 2024-09-10T18:21:20Z

E2E tests in progress

aws-ia-automator-prod

E2E test has completed with errors. If you are an external contributor, please contact the project maintainers for more information.

kkvinjam · 2024-09-11T03:57:54Z

E2E test has completed with errors. If you are an external contributor, please contact the project maintainers for more information.

@ryanjpayne since there are no default values, required parameters from failure reason below need to be added to all tests in the .taskcat.yml file.

Failure reason:

[ERROR  ] : The following parameters have no value whatsoever. The CloudFormation stack will fail to launch. Please address. str(['FalconCID', 'DockerAPIToken', 'EventBusAccount'])

kkvinjam · 2024-09-11T04:10:08Z

/do-e2e-tests

aws-ia-automator-prod · 2024-09-11T04:10:17Z

End to end test has been scheduled

aws-ia-automator-prod · 2024-09-11T04:10:35Z

E2E tests in progress

aws-ia-automator-prod

E2E test has completed with errors. If you are an external contributor, please contact the project maintainers for more information.

kkvinjam · 2024-09-06T18:07:29Z

templates/eks-target-roles-stackset.yml

+          - id: CKV_AWS_109
+            comment: IAM PassRole action is constrained by resource ARN.
+          - id: CKV_AWS_111
+            comment: IAM PassRole action is constrained by resource ARN.


do not see iam:PassRole in this policy. What is the need for this exception?

kkvinjam · 2024-09-12T00:20:09Z

templates/eks-protection-stack.yml

+      Name: !Ref CodeBuildProjectName
+      ServiceRole: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${CodeBuildRoleName}
+      Source: 
+        Location: !Sub '${StagingS3Bucket}/${SourceS3BucketNamePrefix}/codebuild/codebuild.zip'


@ryanjpayne This needs to be fixed to match with the new file location?

kkvinjam · 2024-09-12T02:31:15Z

/do-e2e-tests

aws-ia-automator-prod · 2024-09-12T02:31:26Z

End to end test has been scheduled

aws-ia-automator-prod · 2024-09-12T02:31:48Z

E2E tests in progress

aws-ia-automator-prod

E2E test has completed with errors. If you are an external contributor, please contact the project maintainers for more information.

kkvinjam · 2024-09-12T04:29:51Z

/do-e2e-tests

aws-ia-automator-prod · 2024-09-12T04:30:00Z

End to end test has been scheduled

aws-ia-automator-prod · 2024-09-12T04:30:20Z

E2E tests in progress

aws-ia-automator-prod

E2E test has completed with errors. If you are an external contributor, please contact the project maintainers for more information.

kkvinjam · 2024-09-12T13:41:47Z

/do-e2e-tests

aws-ia-automator-prod · 2024-09-12T13:42:03Z

End to end test has been scheduled

aws-ia-automator-prod · 2024-09-12T13:42:27Z

E2E tests in progress

aws-ia-automator-prod

E2E test has completed with errors. If you are an external contributor, please contact the project maintainers for more information.

lambda_functions/source/cw-helper/organizations.py

kkvinjam · 2024-09-13T00:53:14Z

/do-e2e-tests

aws-ia-automator-prod · 2024-09-13T00:53:27Z

End to end test has been scheduled

aws-ia-automator-prod · 2024-09-13T00:53:51Z

E2E tests in progress

aws-ia-automator-prod

E2E test has completed with errors. If you are an external contributor, please contact the project maintainers for more information.

kkvinjam · 2024-09-13T05:02:14Z

/do-e2e-tests

aws-ia-automator-prod

E2E test has completed with errors. If you are an external contributor, please contact the project maintainers for more information.

kkvinjam · 2024-09-16T02:27:11Z

/do-e2e-tests

aws-ia-automator-prod · 2024-09-16T02:27:26Z

End to end test has been scheduled

aws-ia-automator-prod · 2024-09-16T02:27:48Z

E2E tests in progress

aws-ia-automator-prod

E2E tests completed successfully

kkvinjam reviewed Sep 3, 2024

View reviewed changes

aws-ia-automator-prod bot requested changes Sep 10, 2024

View reviewed changes

aws-ia-automator-prod bot requested changes Sep 11, 2024

View reviewed changes

kkvinjam reviewed Sep 12, 2024

View reviewed changes

aws-ia-automator-prod bot requested changes Sep 12, 2024

View reviewed changes

kkvinjam requested changes Sep 12, 2024

View reviewed changes

lambda_functions/source/cw-helper/organizations.py Outdated Show resolved Hide resolved

lambda_functions/source/cw-helper/organizations.py Show resolved Hide resolved

aws-ia-automator-prod bot requested changes Sep 13, 2024

View reviewed changes

aws-ia-automator-prod bot previously approved these changes Sep 16, 2024

View reviewed changes

ryanjpayne dismissed aws-ia-automator-prod’s stale review via d951cce September 16, 2024 21:17

ryanjpayne added 23 commits September 23, 2024 07:13

codebuild source

79def0d

lambda source

ec83a7a

templates

891950c

documentation

5d30b3c

vpcid

d7328f1

architecture diagram

a698e04

extend orgid function

62d7d87

handle delete

68de87f

remove pptx

f3105a6

lint python

cf9449c

resolve comments

8d4e687

pylint

07d8ab4

add eks test

4eca36b

default values

30f2442

move codebuild package

341c821

fix checkov comment

3ca4464

codebuild package path

dea7430

fix subs

1141d0b

orgid function

79d4272

eb account conditional

1a40b43

data var

b96cb33

missing comma

8f23435

Update entrypoint.sh

ed64e7a

ryanjpayne force-pushed the FEAT-0824-eksprotection branch from d951cce to ed64e7a Compare September 23, 2024 14:13

FEATURE: EKS Protection #61

Are you sure you want to change the base?

FEATURE: EKS Protection #61

Conversation

ryanjpayne commented Aug 13, 2024

kkvinjam left a comment

Choose a reason for hiding this comment

kkvinjam Sep 3, 2024

Choose a reason for hiding this comment

ryanjpayne Sep 4, 2024

Choose a reason for hiding this comment

ryanjpayne Sep 4, 2024

Choose a reason for hiding this comment

kkvinjam Sep 6, 2024

Choose a reason for hiding this comment

ryanjpayne commented Sep 4, 2024

kkvinjam commented Sep 10, 2024

aws-ia-automator-prod bot commented Sep 10, 2024

aws-ia-automator-prod bot commented Sep 10, 2024

aws-ia-automator-prod bot left a comment

Choose a reason for hiding this comment

kkvinjam commented Sep 11, 2024

kkvinjam commented Sep 11, 2024

aws-ia-automator-prod bot commented Sep 11, 2024

aws-ia-automator-prod bot commented Sep 11, 2024

aws-ia-automator-prod bot left a comment

Choose a reason for hiding this comment

kkvinjam Sep 6, 2024

Choose a reason for hiding this comment

kkvinjam Sep 12, 2024

Choose a reason for hiding this comment

kkvinjam commented Sep 12, 2024

aws-ia-automator-prod bot commented Sep 12, 2024

aws-ia-automator-prod bot commented Sep 12, 2024

aws-ia-automator-prod bot left a comment

Choose a reason for hiding this comment

kkvinjam commented Sep 12, 2024

aws-ia-automator-prod bot commented Sep 12, 2024

aws-ia-automator-prod bot commented Sep 12, 2024

aws-ia-automator-prod bot left a comment

Choose a reason for hiding this comment

kkvinjam commented Sep 12, 2024

aws-ia-automator-prod bot commented Sep 12, 2024

aws-ia-automator-prod bot commented Sep 12, 2024

aws-ia-automator-prod bot left a comment

Choose a reason for hiding this comment

kkvinjam commented Sep 13, 2024

aws-ia-automator-prod bot commented Sep 13, 2024

aws-ia-automator-prod bot commented Sep 13, 2024

aws-ia-automator-prod bot left a comment

Choose a reason for hiding this comment

kkvinjam commented Sep 13, 2024

aws-ia-automator-prod bot left a comment

Choose a reason for hiding this comment

kkvinjam commented Sep 16, 2024

aws-ia-automator-prod bot commented Sep 16, 2024

aws-ia-automator-prod bot commented Sep 16, 2024

aws-ia-automator-prod bot left a comment

Choose a reason for hiding this comment