Skip to content

Commit 438b5d7

Browse files
edersonbrilhanteedersonbrilhante
authored
fix: remove wide permission to send logs from lambdas (#159)
1 parent e847cac commit 438b5d7

10 files changed

Lines changed: 3 additions & 117 deletions

File tree

‎modules/integrations/splunk_aws_billing/README.md‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,6 @@
3333
| [aws_cloudwatch_log_group.cur_per_resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
3434
| [aws_cloudwatch_log_group.cur_per_resource_process](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
3535
| [aws_cloudwatch_log_group.cur_per_service](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
36-
| [aws_iam_policy.lambda_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
37-
| [aws_iam_role.lambda_exec_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
38-
| [aws_iam_role_policy_attachment.attach_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
3936
| [aws_lambda_permission.cur_per_resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
4037
| [aws_lambda_permission.cur_per_resource_process](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
4138
| [aws_lambda_permission.cur_per_service](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
@@ -49,9 +46,6 @@
4946
| [aws_s3_bucket_versioning.aws_billing_report](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource |
5047
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
5148
| [aws_iam_policy_document.cur_bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
52-
| [aws_iam_policy_document.cur_per_resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
53-
| [aws_iam_policy_document.cur_per_resource_process](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
54-
| [aws_iam_policy_document.cur_per_service](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
5549
| [aws_iam_policy_document.lambda_policy_document](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
5650
| [aws_secretsmanager_secret.secrets](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/secretsmanager_secret) | data source |
5751
| [aws_secretsmanager_secret_version.secrets](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/secretsmanager_secret_version) | data source |

‎modules/integrations/splunk_aws_billing/billing_per_resource.tf‎

Lines changed: 1 addition & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -36,10 +36,9 @@ module "cur_per_resource" {
3636

3737
attach_policy_jsons = true
3838
policy_jsons = [
39-
data.aws_iam_policy_document.cur_per_resource.json,
4039
data.aws_iam_policy_document.lambda_policy_document.json,
4140
]
42-
number_of_policy_jsons = 2
41+
number_of_policy_jsons = 1
4342

4443
tags = local.all_security_tags
4544

@@ -65,20 +64,6 @@ resource "aws_cloudwatch_log_group" "cur_per_resource" {
6564
tags_all = local.all_security_tags
6665
}
6766

68-
data "aws_iam_policy_document" "cur_per_resource" {
69-
statement {
70-
actions = [
71-
"logs:CreateLogStream",
72-
"logs:PutLogEvents"
73-
]
74-
effect = "Allow"
75-
76-
resources = [
77-
"arn:aws:logs:*:${data.aws_caller_identity.current.account_id}:log-group:${aws_cloudwatch_log_group.cur_per_resource.name}*:*"
78-
]
79-
}
80-
}
81-
8267
resource "aws_bcmdataexports_export" "cur_per_resource" {
8368
export {
8469
name = "aws-billing-report-per-resource"

‎modules/integrations/splunk_aws_billing/billing_per_resource_process.tf‎

Lines changed: 1 addition & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -36,10 +36,9 @@ module "cur_per_resource_process" {
3636

3737
attach_policy_jsons = true
3838
policy_jsons = [
39-
data.aws_iam_policy_document.cur_per_resource_process.json,
4039
data.aws_iam_policy_document.lambda_policy_document.json,
4140
]
42-
number_of_policy_jsons = 2
41+
number_of_policy_jsons = 1
4342

4443
tags = local.all_security_tags
4544

@@ -64,17 +63,3 @@ resource "aws_cloudwatch_log_group" "cur_per_resource_process" {
6463
tags = local.all_security_tags
6564
tags_all = local.all_security_tags
6665
}
67-
68-
data "aws_iam_policy_document" "cur_per_resource_process" {
69-
statement {
70-
actions = [
71-
"logs:CreateLogStream",
72-
"logs:PutLogEvents"
73-
]
74-
effect = "Allow"
75-
76-
resources = [
77-
"arn:aws:logs:*:${data.aws_caller_identity.current.account_id}:log-group:${aws_cloudwatch_log_group.cur_per_resource_process.name}*:*"
78-
]
79-
}
80-
}

‎modules/integrations/splunk_aws_billing/billing_per_service.tf‎

Lines changed: 1 addition & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -36,10 +36,9 @@ module "cur_per_service" {
3636

3737
attach_policy_jsons = true
3838
policy_jsons = [
39-
data.aws_iam_policy_document.cur_per_service.json,
4039
data.aws_iam_policy_document.lambda_policy_document.json,
4140
]
42-
number_of_policy_jsons = 2
41+
number_of_policy_jsons = 1
4342

4443
tags = local.all_security_tags
4544

@@ -65,20 +64,6 @@ resource "aws_cloudwatch_log_group" "cur_per_service" {
6564
tags_all = local.all_security_tags
6665
}
6766

68-
data "aws_iam_policy_document" "cur_per_service" {
69-
statement {
70-
actions = [
71-
"logs:CreateLogStream",
72-
"logs:PutLogEvents"
73-
]
74-
effect = "Allow"
75-
76-
resources = [
77-
"arn:aws:logs:*:${data.aws_caller_identity.current.account_id}:log-group:${aws_cloudwatch_log_group.cur_per_service.name}*:*"
78-
]
79-
}
80-
}
81-
8267
resource "aws_bcmdataexports_export" "cur_per_service" {
8368
export {
8469
name = "aws-billing-report-per-service"

‎modules/integrations/splunk_aws_billing/role.tf‎

Lines changed: 0 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,4 @@
11
data "aws_iam_policy_document" "lambda_policy_document" {
2-
statement {
3-
actions = [
4-
"logs:CreateLogStream",
5-
"logs:PutLogEvents"
6-
]
7-
effect = "Allow"
8-
resources = ["arn:aws:logs:*:*:*"]
9-
}
102

113
statement {
124
actions = [
@@ -50,29 +42,3 @@ data "aws_iam_policy_document" "lambda_policy_document" {
5042
]
5143
}
5244
}
53-
54-
resource "aws_iam_policy" "lambda_policy" {
55-
name = "cur-to-splunk-lambda-policy"
56-
description = "Policy for Lambda to access S3 and CloudWatch logs"
57-
policy = data.aws_iam_policy_document.lambda_policy_document.json
58-
}
59-
60-
resource "aws_iam_role_policy_attachment" "attach_policy" {
61-
role = aws_iam_role.lambda_exec_role.name
62-
policy_arn = aws_iam_policy.lambda_policy.arn
63-
}
64-
65-
resource "aws_iam_role" "lambda_exec_role" {
66-
name = "cur-to-splunk-lambda-role"
67-
68-
assume_role_policy = jsonencode({
69-
Version = "2012-10-17"
70-
Statement = [{
71-
Action = "sts:AssumeRole"
72-
Effect = "Allow"
73-
Principal = {
74-
Service = "lambda.amazonaws.com"
75-
}
76-
}]
77-
})
78-
}

‎modules/integrations/splunk_cloud_data_manager/sec_meta_ec2_tags/data.tf‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎modules/integrations/splunk_cloud_data_manager/sec_meta_ec2_tags/main.tf‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -33,17 +33,6 @@ module "splunk_dm_metadata_ec2inst_pattern_tags_lambda" {
3333
}
3434

3535
data "aws_iam_policy_document" "splunk_dm_metadata_ec2inst_pattern_tags_lambda" {
36-
statement {
37-
actions = [
38-
"logs:CreateLogStream",
39-
"logs:PutLogEvents"
40-
]
41-
effect = "Allow"
42-
43-
resources = [
44-
"arn:aws:logs:*:${data.aws_caller_identity.current.account_id}:log-group:${aws_cloudwatch_log_group.splunk_dm_metadata_ec2inst_pattern_tags_lambda.name}*:*"
45-
]
46-
}
4736

4837
statement {
4938
actions = [

‎modules/platform/ec2_deployment/update_ssm_ami_id.tf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,6 @@ module "update_runner_ami_lambda" {
4646
}
4747

4848
data "aws_iam_policy_document" "update_runner_ami_lambda" {
49-
5049
statement {
5150
effect = "Allow"
5251
actions = [

‎modules/platform/forge_runners/global_lock.tf‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -111,14 +111,6 @@ module "clean_global_lock_lambda" {
111111
}
112112

113113
data "aws_iam_policy_document" "clean_global_lock_lambda" {
114-
statement {
115-
actions = [
116-
"logs:CreateLogStream",
117-
"logs:PutLogEvents"
118-
]
119-
effect = "Allow"
120-
resources = ["*"]
121-
}
122114
statement {
123115
actions = [
124116
"secretsmanager:GetSecretValue",

‎modules/platform/forge_runners/register_repo_runner_group.tf‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -44,14 +44,6 @@ module "register_github_app_runner_group_lambda" {
4444
}
4545

4646
data "aws_iam_policy_document" "register_github_app_runner_group_lambda" {
47-
statement {
48-
actions = [
49-
"logs:CreateLogStream",
50-
"logs:PutLogEvents"
51-
]
52-
effect = "Allow"
53-
resources = ["*"]
54-
}
5547
statement {
5648
actions = [
5749
"secretsmanager:GetSecretValue",

0 commit comments

Comments
 (0)