elastio-stack/codegen/src/policies/ElastioAwsBackupEc2Scan.ts at 33655494bf90755efceaa5c7eca2fbdee3885993 · elastio/elastio-stack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
import * as iam from "../iam";

export default {
  description: "Allows Elastio to scan AWS Backup EC2 and EBS recovery points.",

  statements: [
    {
      Sid: "ReadBackupInventory",
      Action: [
        // Vaults
        "backup:ListBackupVaults",
        "backup:DescribeBackupVault",

        // Recovery points
        "backup:ListRecoveryPointsByResource",
        "backup:DescribeRecoveryPoint",
        "backup:ListRecoveryPointsByBackupVault",
        "backup:GetRecoveryPointRestoreMetadata",

        // Common for all resources
        "backup:ListTags",

        // Misc.
        "backup:ListProtectedResources",
        "backup:ListProtectedResourcesByBackupVault",
      ],
      Resource: "*",
    },

    {
      Sid: "ReadEbsInventory",
      Action: [
        // Volumes
        "ec2:DescribeVolumeStatus",
        "ec2:DescribeVolumes",

        // Snapshots
        "ec2:DescribeSnapshots",
        "ec2:DescribeSnapshotAttribute",

        // Common for all resources
        "ec2:DescribeTags",

        // Used for cost estimation and scanning itself
        "ebs:ListSnapshotBlocks",
        "ebs:ListChangedBlocks",
      ],
      Resource: "*",
    },

    {
      Sid: "ReadEbsSnapshotsData",
      Action: ["ebs:GetSnapshotBlock"],
      Resource: "*",
    },

    {
      Sid: "ReadEc2Inventory",
      Action: [
        "ec2:DescribeInstances",
        "ec2:DescribeImages",
        "ec2:DescribeHosts",
        "ssm:DescribeInstanceInformation",
      ],
      Resource: "*",
    },

    {
      Sid: "ShareEbsSnapshot",
      Action: ["ec2:ModifySnapshotAttribute"],
      Resource: "*",
      Condition: {
        // Needed to add createVolumePermission for sharing the snapshot
        // with the connector account.
        StringLike: {
          "ec2:Add/userId": "*",
        },
      },
    },

    // Required for encrypted backups
    {
      Sid: "KmsAccess",

      // Users need to put a special tag on their KMS keys to allow Elastio
      // use them for decrypting their data. It must be documented in public
      // Elastio documentation.
      Condition: iam.hasResourceTag("elastio:authorize"),

      Action: [
        // These actions are needed to reencrypt the volumes that were encrypted
        // by the KMS key.
        "kms:ReEncryptFrom",
        "kms:ReEncryptTo",
        "kms:CreateGrant",
        "kms:Encrypt",

        // Needed only for some cases. For example, when we want to snapshot an EBS
        // volume that was created from a snapshot of the root volume of an EC2 instance.
        // These calls are made by the ebs.amazonaws.com and not by our code.
        "kms:DescribeKey",

        // GenerateDataKeyWithoutPlaintext in particular is required in case when
        // we create a volume from an unencrypted snapshot but there is a default
        // KMS encryption key set in EBS for the volume.
        "kms:GenerateDataKey",
        "kms:GenerateDataKeyWithoutPlaintext",

        // This is required when reading S3 buckets encrypted with a KMS key
        "kms:Decrypt",
      ],
      Resource: "*",
    },
  ],
} satisfies iam.Policy;