container-image-scanner
Version:
Enterprise Container Image Scanner with AWS Security Best Practices. Scan EKS clusters for Bitnami container image dependencies and generate migration guidance for AWS ECR alternatives.
185 lines (184 loc) • 4.18 kB
JSON
{
"scanner_minimal_policy": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "EKSReadOnlyAccess",
"Effect": "Allow",
"Action": [
"eks:ListClusters",
"eks:DescribeCluster"
],
"Resource": "*"
},
{
"Sid": "OrganizationsReadOnlyAccess",
"Effect": "Allow",
"Action": [
"organizations:ListAccounts",
"organizations:DescribeOrganization"
],
"Resource": "*"
},
{
"Sid": "STSAccess",
"Effect": "Allow",
"Action": [
"sts:GetCallerIdentity",
"sts:AssumeRole"
],
"Resource": "*"
}
]
},
"cross_account_role_policy": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "EKSReadOnlyAccess",
"Effect": "Allow",
"Action": [
"eks:ListClusters",
"eks:DescribeCluster"
],
"Resource": "*"
},
{
"Sid": "STSAccess",
"Effect": "Allow",
"Action": [
"sts:GetCallerIdentity"
],
"Resource": "*"
}
]
},
"cross_account_trust_policy": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::SCANNER-ACCOUNT-ID:root"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"sts:ExternalId": "container-image-scanner-v2"
},
"IpAddress": {
"aws:SourceIp": [
"10.0.0.0/8",
"172.16.0.0/12",
"192.168.0.0/16"
]
}
}
}
]
},
"lambda_execution_policy": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "arn:aws:logs:*:*:*"
},
{
"Effect": "Allow",
"Action": [
"eks:ListClusters",
"eks:DescribeCluster",
"sts:GetCallerIdentity"
],
"Resource": "*"
}
]
},
"ec2_instance_profile_policy": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "EKSReadOnlyAccess",
"Effect": "Allow",
"Action": [
"eks:ListClusters",
"eks:DescribeCluster"
],
"Resource": "*"
},
{
"Sid": "OrganizationsReadOnlyAccess",
"Effect": "Allow",
"Action": [
"organizations:ListAccounts",
"organizations:DescribeOrganization"
],
"Resource": "*"
},
{
"Sid": "STSAccess",
"Effect": "Allow",
"Action": [
"sts:GetCallerIdentity",
"sts:AssumeRole"
],
"Resource": [
"arn:aws:iam::*:role/ContainerImageScannerRole"
]
},
{
"Sid": "CloudWatchLogs",
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents",
"logs:DescribeLogStreams"
],
"Resource": "arn:aws:logs:*:*:log-group:/aws/container-image-scanner/*"
}
]
},
"security_boundary_policy": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowedServices",
"Effect": "Allow",
"Action": [
"eks:ListClusters",
"eks:DescribeCluster",
"organizations:ListAccounts",
"organizations:DescribeOrganization",
"sts:GetCallerIdentity",
"sts:AssumeRole",
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents",
"logs:DescribeLogStreams"
],
"Resource": "*"
},
{
"Sid": "DenyDangerousActions",
"Effect": "Deny",
"Action": [
"iam:*",
"ec2:*",
"s3:Delete*",
"s3:Put*",
"rds:*",
"lambda:*",
"cloudformation:*"
],
"Resource": "*"
}
]
}
}