feat(response actions) Full validation [SSPROD-64190] (#106)

* Preliminary work for management account.

* Attempt to use stackset to deploy lambdas to all specified regions.

* Roles extracted from cloudformation stack as they are not regional.

* Some fixes

* Adopting the strategy of fetching lambdas from Sysdig public S3 buckets.

* WORKING

* Added the possibility to disable some actions.

* Preliminary support for subaccounts

* Fixed organizational stuff

* Other fixes.

* Some comments

* Short names in tags

* Simple names as tags in resources

* Removing unnecessary stuff

* Initial change to support sysdig components

* Other fixes.

* Fixed version.

* Added components outputs

* Creating S3 storage and lambda to upload lambda code

* Fix indent

* Fixed.

* Set new terraform plugin

* Fixed readme

* Some cleanup

* Removed versioning and normalizing bucket names

* Aligning terraform plugin

* Added `wait_for_basic`

* Linting

* Provider data

* Using customer id hash as external id

* Fixed bug

* Preliminary support for validation: adding validation role. TODO test

* Locally testing

* Fix

* New version

* New sysdig provider

* Version embedded in tf, not using external input

* Attempting to be sure to update lambdas

Author: fcracker79

modules/response-actions/locals.tf

@@ -25,6 +25,8 @@ data "aws_organizations_organization" "org" {
 }
 
 locals {
+  response_actions_version = "1.0.2"
+
   # fetch the AWS Root OU under org
   # As per https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html#organization-structure, there can be only one root
   root_org_unit = var.is_organizational ? [for root in data.aws_organizations_organization.org[0].roots : root.id] : []

modules/response-actions/main.tf

@@ -327,6 +327,80 @@ resource "aws_iam_role_policy" "shared_lambda_invoke_policy" {
   })
 }
 
+#-----------------------------------------------------------------------------------------------------------------------------------------
+# This resource creates an IAM role for validating the Response Actions deployment.
+# This role is assumed by Sysdig's cloud identity to read and validate Lambda functions, IAM roles, and policies
+# created by this module.
+#
+# The role allows:
+# 1. Sysdig's trusted identity to assume the role using the tenant-specific external ID for security
+# 2. Reading Lambda functions matching the resource name pattern
+# 3. Reading IAM roles and their attached/inline policies matching the resource name pattern
+#-----------------------------------------------------------------------------------------------------------------------------------------
+resource "aws_iam_role" "validation_role" {
+  name = "${local.ra_resource_name}-validation-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = "sts:AssumeRole"
+        Effect = "Allow"
+        Principal = {
+          AWS = local.trusted_identity
+        }
+        Condition = {
+          StringEquals = {
+            "sts:ExternalId" = data.sysdig_secure_tenant_external_id.external_id.external_id
+          }
+        }
+      }
+    ]
+  })
+
+  tags = {
+    Name                                        = "${local.ra_resource_name}-validation-role"
+    "sysdig.com/response-actions/resource-name" = "validation-role"
+  }
+}
+
+#-----------------------------------------------------------------------------------------------------------------------------------------
+# This policy grants read-only permissions for the validation role to:
+# 1. Read Lambda functions, their configurations, and policies created by this module
+# 2. Read IAM roles and their attached/inline policies created by this module
+#
+# Permissions are scoped to only resources matching the resource name pattern (${local.ra_resource_name}-*)
+#-----------------------------------------------------------------------------------------------------------------------------------------
+resource "aws_iam_role_policy" "validation_policy" {
+  name = "${local.ra_resource_name}-validation-policy"
+  role = aws_iam_role.validation_role.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "lambda:GetFunction",
+          "lambda:GetPolicy",
+          "lambda:ListFunctions"
+        ]
+        Resource = "${local.arn_prefix}:lambda:*:${data.aws_caller_identity.current.account_id}:function:${local.ra_resource_name}-*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "iam:GetRole",
+          "iam:GetRolePolicy",
+          "iam:ListRolePolicies",
+          "iam:ListAttachedRolePolicies"
+        ]
+        Resource = "${local.arn_prefix}:iam::${data.aws_caller_identity.current.account_id}:role/${local.ra_resource_name}-*"
+      }
+    ]
+  })
+}
+
 #-----------------------------------------------------------------------------------------------------------------------------------------
 # IAM Roles for Lambda Functions (Created Once in Management Account)
 #
@@ -704,7 +778,7 @@ resource "aws_cloudformation_stack_set" "lambda_functions" {
     ConfigureResourceAccessRoleName = local.enable_make_private ? aws_iam_role.configure_resource_access_role[0].name : ""
     CreateVolumeSnapshotsRoleName   = local.enable_create_volume_snapshot ? aws_iam_role.create_volume_snapshots_role[0].name : ""
     DeleteVolumeSnapshotsRoleName   = local.enable_create_volume_snapshot ? aws_iam_role.delete_volume_snapshots_role[0].name : ""
-    ResponseActionsVersion          = var.response_actions_version
+    ResponseActionsVersion          = local.response_actions_version
     LambdaPackagesBaseUrl           = var.lambda_packages_base_url
     EnableQuarantineUser            = local.enable_quarantine_user ? "true" : "false"
     EnableFetchCloudLogs            = local.enable_fetch_cloud_logs ? "true" : "false"

modules/response-actions/organizational.tf

@@ -50,6 +50,10 @@ resource "aws_cloudformation_stack_set" "ra_delegate_roles" {
     CreateVolumeSnapshotsRoleName        = local.enable_create_volume_snapshot ? aws_iam_role.create_volume_snapshots_role[0].name : ""
     DeleteVolumeSnapshotsLambdaRoleArn   = local.enable_create_volume_snapshot ? aws_iam_role.delete_volume_snapshots_role[0].arn : ""
     DeleteVolumeSnapshotsRoleName        = local.enable_create_volume_snapshot ? aws_iam_role.delete_volume_snapshots_role[0].name : ""
+    ValidationRoleName                   = "${local.ra_resource_name}-validation-role"
+    TrustedIdentity                      = local.trusted_identity
+    ExternalId                           = data.sysdig_secure_tenant_external_id.external_id.external_id
+    ResourceNamePrefix                   = local.ra_resource_name
     EnableQuarantineUser                 = local.enable_quarantine_user ? "true" : "false"
     EnableFetchCloudLogs                 = local.enable_fetch_cloud_logs ? "true" : "false"
     EnableMakePrivate                    = local.enable_make_private ? "true" : "false"

modules/response-actions/outputs.tf

@@ -72,3 +72,8 @@ output "wait_after_basic" {
   value       = var.wait_after_basic_seconds > 0 ? time_sleep.wait_after_ciem_basic : null
   description = "Wait handle to delay downstream operations after basic by the configured seconds."
 }
+
+output "validation_role_arn" {
+  value       = aws_iam_role.validation_role.arn
+  description = "ARN of the validation role for reading Response Actions resources"
+}

modules/response-actions/sysdig_components.tf

@@ -8,29 +8,36 @@ resource "sysdig_secure_cloud_auth_account_component" "aws_responder" {
   account_id = var.sysdig_secure_account_id
   type       = local.responder_component_type
   instance   = "cloud-responder"
-  version    = "v${var.response_actions_version}"
+  version    = "v${local.response_actions_version}"
   cloud_responder_metadata = jsonencode({
     aws = {
       responder_lambdas = {
-        lambda_names       = local.enabled_lambda_names
-        regions            = local.region_set
-        delegate_role_name = aws_iam_role.shared_cross_account_lambda_invoker.name
+        lambda_names         = local.enabled_lambda_names
+        regions              = local.region_set
+        delegate_role_name   = aws_iam_role.shared_cross_account_lambda_invoker.name
+        validation_role_name = aws_iam_role.validation_role.name
       }
     }
   })
 
   depends_on = [
     aws_cloudformation_stack_set_instance.lambda_functions,
-    aws_iam_role.shared_cross_account_lambda_invoker
+    aws_iam_role.shared_cross_account_lambda_invoker,
+    aws_iam_role.validation_role
   ]
 }
 
 resource "sysdig_secure_cloud_auth_account_component" "aws_responder_roles" {
   account_id = var.sysdig_secure_account_id
   type       = local.roles_component_type
   instance   = "cloud-responder"
-  version    = "v${var.response_actions_version}"
+  version    = "v${local.response_actions_version}"
   cloud_responder_roles_metadata = jsonencode({
+    validation_role = {
+      aws = {
+        role_name = aws_iam_role.validation_role.name
+      }
+    }
     roles = concat(
       local.enable_quarantine_user ? [
         {
@@ -80,6 +87,7 @@ resource "sysdig_secure_cloud_auth_account_component" "aws_responder_roles" {
     aws_iam_role.fetch_cloud_logs_role,
     aws_iam_role.configure_resource_access_role,
     aws_iam_role.create_volume_snapshots_role,
-    aws_iam_role.delete_volume_snapshots_role
+    aws_iam_role.delete_volume_snapshots_role,
+    aws_iam_role.validation_role
   ]
 }

modules/response-actions/templates/delegate_roles_stackset.tpl

@@ -62,6 +62,18 @@ Parameters:
     Default: "true"
     AllowedValues: ["true", "false"]
     Description: Enable create and delete volume snapshot delegate roles
+  ValidationRoleName:
+    Type: String
+    Description: Name for the validation role
+  TrustedIdentity:
+    Type: String
+    Description: ARN of the Sysdig trusted identity
+  ExternalId:
+    Type: String
+    Description: External ID for assuming the validation role
+  ResourceNamePrefix:
+    Type: String
+    Description: Prefix for resource names to scope IAM permissions
 
 Conditions:
   CreateQuarantineUserResources: !Equals [!Ref EnableQuarantineUser, "true"]
@@ -320,6 +332,43 @@ Resources:
         - Key: 'sysdig.com/response-actions/resource-name'
           Value: 'remove-policy-delegate-role'
 
+  # Validation Role: Read-only access for validating Response Actions deployment
+  ValidationDelegateRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: !Ref ValidationRoleName
+      Description: Validation role for reading Response Actions resources
+      MaxSessionDuration: 3600
+      AssumeRolePolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Effect: Allow
+            Principal:
+              AWS: !Ref TrustedIdentity
+            Action: 'sts:AssumeRole'
+            Condition:
+              StringEquals:
+                'sts:ExternalId': !Ref ExternalId
+      Policies:
+        - PolicyName: response-actions-validation
+          PolicyDocument:
+            Version: '2012-10-17'
+            Statement:
+              - Effect: Allow
+                Action:
+                  - 'iam:GetRole'
+                  - 'iam:GetRolePolicy'
+                  - 'iam:ListRolePolicies'
+                  - 'iam:ListAttachedRolePolicies'
+                Resource: !Sub 'arn:aws:iam::${AWS::AccountId}:role/${ResourceNamePrefix}-*'
+      Tags:
+        - Key: ManagedBy
+          Value: Terraform
+        - Key: Purpose
+          Value: ResponseActions
+        - Key: 'sysdig.com/response-actions/resource-name'
+          Value: 'validation-delegate-role'
+
 Outputs:
   ConfigureAccessDelegateRoleName:
     Condition: CreateMakePrivateResources
@@ -345,3 +394,6 @@ Outputs:
     Condition: CreateQuarantineUserResources
     Value: !Ref RemovePolicyDelegateRole
     Description: Name of the remove policy delegate role
+  ValidationDelegateRoleName:
+    Value: !Ref ValidationDelegateRole
+    Description: Name of the validation delegate role

modules/response-actions/templates/lambda-stackset.tpl

@@ -324,15 +324,14 @@ Resources:
     Condition: CreateQuarantineUserResources
     DependsOn:
       - QuarantineUserLogGroup
-      - QuarantineUserPackage
     Properties:
       FunctionName: !Sub '${ResourceName}-quarantine-user'
       Runtime: python3.12
       Handler: app.index.handler
       Role: !Ref QuarantineUserRoleArn
       Code:
-        S3Bucket: !Ref LambdaPackagesBucket
-        S3Key: !Sub '${ResponseActionsVersion}/quarantine_user.zip'
+        S3Bucket: !GetAtt QuarantineUserPackage.Bucket
+        S3Key: !GetAtt QuarantineUserPackage.Key
       Timeout: 300
       MemorySize: 128
       Environment:
@@ -352,15 +351,14 @@ Resources:
     Condition: CreateFetchCloudLogsResources
     DependsOn:
       - FetchCloudLogsLogGroup
-      - FetchCloudLogsPackage
     Properties:
       FunctionName: !Sub '${ResourceName}-fetch-cloud-logs'
       Runtime: python3.12
       Handler: app.index.handler
       Role: !Ref FetchCloudLogsRoleArn
       Code:
-        S3Bucket: !Ref LambdaPackagesBucket
-        S3Key: !Sub '${ResponseActionsVersion}/fetch_cloud_logs.zip'
+        S3Bucket: !GetAtt FetchCloudLogsPackage.Bucket
+        S3Key: !GetAtt FetchCloudLogsPackage.Key
       Timeout: 300
       MemorySize: 128
       Environment:
@@ -380,15 +378,14 @@ Resources:
     Condition: CreateQuarantineUserResources
     DependsOn:
       - RemovePolicyLogGroup
-      - RemovePolicyPackage
     Properties:
       FunctionName: !Sub '${ResourceName}-remove-policy'
       Runtime: python3.12
       Handler: app.index.handler
       Role: !Ref RemovePolicyRoleArn
       Code:
-        S3Bucket: !Ref LambdaPackagesBucket
-        S3Key: !Sub '${ResponseActionsVersion}/remove_policy.zip'
+        S3Bucket: !GetAtt RemovePolicyPackage.Bucket
+        S3Key: !GetAtt RemovePolicyPackage.Key
       Timeout: 300
       MemorySize: 128
       Environment:
@@ -408,15 +405,14 @@ Resources:
     Condition: CreateMakePrivateResources
     DependsOn:
       - ConfigureResourceAccessLogGroup
-      - ConfigureResourceAccessPackage
     Properties:
       FunctionName: !Sub '${ResourceName}-configure-resource-access'
       Runtime: python3.12
       Handler: app.index.handler
       Role: !Ref ConfigureResourceAccessRoleArn
       Code:
-        S3Bucket: !Ref LambdaPackagesBucket
-        S3Key: !Sub '${ResponseActionsVersion}/configure_resource_access.zip'
+        S3Bucket: !GetAtt ConfigureResourceAccessPackage.Bucket
+        S3Key: !GetAtt ConfigureResourceAccessPackage.Key
       Timeout: 300
       MemorySize: 128
       Environment:
@@ -436,15 +432,14 @@ Resources:
     Condition: CreateVolumeSnapshotResources
     DependsOn:
       - CreateVolumeSnapshotsLogGroup
-      - CreateVolumeSnapshotsPackage
     Properties:
       FunctionName: !Sub '${ResourceName}-create-volume-snapshots'
       Runtime: python3.12
       Handler: app.index.handler
       Role: !Ref CreateVolumeSnapshotsRoleArn
       Code:
-        S3Bucket: !Ref LambdaPackagesBucket
-        S3Key: !Sub '${ResponseActionsVersion}/create_volume_snapshots.zip'
+        S3Bucket: !GetAtt CreateVolumeSnapshotsPackage.Bucket
+        S3Key: !GetAtt CreateVolumeSnapshotsPackage.Key
       Timeout: 300
       MemorySize: 128
       Environment:
@@ -464,15 +459,14 @@ Resources:
     Condition: CreateVolumeSnapshotResources
     DependsOn:
       - DeleteVolumeSnapshotsLogGroup
-      - DeleteVolumeSnapshotsPackage
     Properties:
       FunctionName: !Sub '${ResourceName}-delete-volume-snapshots'
       Runtime: python3.12
       Handler: app.index.handler
       Role: !Ref DeleteVolumeSnapshotsRoleArn
       Code:
-        S3Bucket: !Ref LambdaPackagesBucket
-        S3Key: !Sub '${ResponseActionsVersion}/delete_volume_snapshots.zip'
+        S3Bucket: !GetAtt DeleteVolumeSnapshotsPackage.Bucket
+        S3Key: !GetAtt DeleteVolumeSnapshotsPackage.Key
       Timeout: 300
       MemorySize: 128
       Environment:

modules/response-actions/variables.tf

@@ -95,9 +95,10 @@ variable "api_base_url" {
 }
 
 variable "response_actions_version" {
-  description = "Response Actions version"
+  description = "Deprecated: this variable is no longer used. The version is hardcoded to 1.0.2."
   type        = string
-  default     = "0.0.16"
+  default     = null
+  nullable    = true
 }
 
 variable "lambda_packages_base_url" {

modules/response-actions/versions.tf

@@ -11,7 +11,7 @@ terraform {
     }
     sysdig = {
       source  = "sysdiglabs/sysdig"
-      version = "~> 3.3"
+      version = "~> 3.5"
     }
     time = {
       source  = "hashicorp/time"