Merge branch 'main' into glacierPermission

lacework · Nov 17, 2023 · e7988b7 · e7988b7
2 parents 3b8dec2 + b868fe3
commit e7988b7
Show file tree

Hide file tree

Showing 2 changed files with 35 additions and 2 deletions.
diff --git a/README.md b/README.md
@@ -135,4 +135,14 @@ The audit policy is comprised of the following permissions:
 |                            | apigatewayv2:GetRouteResponses                          |           |
 |                            | apigatewayv2:GetStages                                  |           |
 |                            | apigatewayv2:GetVpcLinks                                |           |
-| GLACIER                    | glacier:ListTagsForVault                                | *         |
+| GLACIER                    | glacier:ListTagsForVault                                | *         |
+| WAFREGIONAL                | waf-regional:ListRules                                  | *         |
+|                            | waf-regional:GetRule                                    |           |
+|                            | waf-regional:ListRuleGroups                             |           |
+|                            | waf-regional:GetRuleGroup                               |           |
+|                            | waf-regional:ListActivatedRulesInRuleGroup              |           |
+| GLUE                       | glue:ListWorkflows                                      | *         |
+|                            | glue:BatchGetWorkflows                                  |           |
+|                            | glue:GetTags                                            |           |
+| CODEBUILD                  | codebuild:ListBuilds                                    | *         |
+|                            | codebuild:BatchGetBuilds                                |           |
diff --git a/main.tf b/main.tf
@@ -134,12 +134,35 @@ data "aws_iam_policy_document" "lacework_audit_policy" {
     "apigatewayv2:GetVpcLinks"]
     resources = ["*"]
   }
-
   statement {
     sid = "GLACIER"
     actions = ["glacier:ListTagsForVault"]
     resources = ["*"]
   }
+  statement {
+    sid = "WAFREGIONAL"
+    actions = ["waf-regional:ListRules",
+      "waf-regional:GetRule",
+      "waf-regional:ListRuleGroups",
+      "waf-regional:GetRuleGroup",
+      "waf-regional:ListActivatedRulesInRuleGroup"]
+     resources = ["*"]
+  }
+  statement {
+    sid = "GLUE"
+    actions = ["glue:ListWorkflows",
+      "glue:BatchGetWorkflows",
+      "glue:GetTags"]
+    resources = ["*"]
+  }
+
+  statement {
+    sid = "CODEBUILD"
+    actions = ["codebuild:ListBuilds",
+      "codebuild:BatchGetBuilds",
+    ]
+    resources = ["*"]
+  }
 }
 
 resource "aws_iam_policy" "lacework_audit_policy" {