Description: An AWS CloudFormation StackSet Template for deploying roles into Darktrace
  /FORENSICS. It includes a trust policy to an internal role, as well as the required
  permissions to acquire resources in the AWS Account the role is deployed into.
Parameters:
  ExternalID:
    Type: String
    Default: NoExternalIdRequired
    Description: An unique ID associated with your Darktrace /FORENSICS tenant.
  ProxyRoleARN:
    Type: String
    Description: The ARN of the role which your DarktraceForensicsRole will be assumed
      by.
Conditions:
  SaaS:
    Fn::Not:
    - Fn::Equals:
      - Ref: ExternalID
      - NoExternalIdRequired
Resources:
  DarktraceForensicsRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            AWS:
              Ref: ProxyRoleARN
          Action: sts:AssumeRole
          Condition:
            Fn::If:
            - SaaS
            - StringEquals:
                sts:ExternalId:
                  Ref: ExternalID
            - Ref: AWS::NoValue
      Path: /
      MaxSessionDuration: 43200
  DarktraceForensicsAcquisitionPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: DarktraceForensicsRolePolicy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Sid: RequiredToCheckPolicy
          Action:
          - iam:ListRolePolicies
          - iam:GetPolicy
          - iam:GetRolePolicy
          - iam:GetPolicyVersion
          - iam:SimulatePrincipalPolicy
          Resource: '*'
          Effect: Allow
        - Sid: RequiredForS3Import
          Effect: Allow
          Action:
          - s3:ListAllMyBuckets
          - s3:GetObject
          - s3:RestoreObject
          - s3:ListBucket
          - s3:GetBucketLocation
          Resource: '*'
        - Sid: RequiredForS3ImportKmsEncrypted
          Effect: Allow
          Action:
          - kms:Decrypt
          - kms:GenerateDataKey
          Resource: '*'
        - Sid: RequiredForLambdaImport
          Effect: Allow
          Action:
          - lambda:GetFunction
          - lambda:ListFunctions
          - logs:FilterLogEvents
          - ecr:GetAuthorizationToken
          - ecr:GetDownloadURLForLayer
          - ecr:BatchGetImage
          Resource: '*'
        - Sid: RequiredForEcsImport
          Effect: Allow
          Action:
          - ecs:ListClusters
          - ecs:DescribeClusters
          - ecs:ListServices
          - ecs:DescribeServices
          - ecs:ListTasks
          - ecs:DescribeTasks
          - ecs:ExecuteCommand
          Resource: '*'
        - Sid: RequiredForEKSImport
          Effect: Allow
          Action:
          - eks:ListClusters
          - eks:DescribeCluster
          Resource: '*'
        - Sid: RequiredForEbsImport
          Effect: Allow
          Action:
          - cloudtrail:LookupEvents
          - ec2:DescribeVolumesModifications
          - ec2:DescribeAccountAttributes
          - ec2:DescribeAddresses
          - ec2:DescribeAvailabilityZones
          - ec2:DescribeImages
          - ec2:DescribeInstanceAttribute
          - ec2:DescribeInstanceStatus
          - ec2:DescribeInstances
          - ec2:DescribeInstanceTypes
          - ec2:DescribeRegions
          - ec2:DescribeRouteTables
          - ec2:DescribeSecurityGroups
          - ec2:DescribeSnapshots
          - ec2:DescribeSubnets
          - ec2:DescribeTags
          - ec2:DescribeVolumes
          - ec2:DescribeFlowLogs
          - iam:GetInstanceProfile
          - ebs:ListSnapshotBlocks
          - ebs:ListChangedBlocks
          - ebs:GetSnapshotBlock
          - ec2:CreateSnapshot
          Resource: '*'
        - Sid: RequiredForEbsImport2
          Effect: Allow
          Action:
          - ec2:CreateTags
          Resource: '*'
          Condition:
            StringEquals:
              ec2:CreateAction: CreateSnapshot
        - Sid: RequiredForEbsImportKmsEncrypted
          Effect: Allow
          Action:
          - kms:DescribeKey
          - kms:Decrypt
          Resource: '*'
        - Sid: RequiredForEbsImportKmsEncrypted2
          Effect: Allow
          Action:
          - kms:CreateGrant
          Resource: '*'
          Condition:
            Bool:
              kms:GrantIsForAWSResource: true
        - Sid: RequiredForEc2TriageAndActions
          Effect: Allow
          Action:
          - ssm:DescribeInstanceInformation
          - ssm:StartSession
          - ssm:TerminateSession
          - ssm:GetCommandInvocation
          Resource: '*'
        - Sid: RequiredForEc2TriageAndActions2
          Effect: Allow
          Action:
          - ssm:SendCommand
          - ssm:DescribeInstanceInformation
          Resource:
          - arn:aws:ec2:*:*:instance/*
          - arn:aws:ssm:*::document/AWS-RunShellScript
          - arn:aws:ssm:*::document/AWS-RunPowerShellScript
        - Sid: RequiredForGuardDutyMonitoring
          Effect: Allow
          Action:
          - guardduty:ListDetectors
          - guardduty:ListFindings
          - guardduty:GetFindings
          Resource: '*'
      Roles:
      - Ref: DarktraceForensicsRole
Outputs:
  DarktraceForensicsRoleArn:
    Value:
      Fn::GetAtt:
      - DarktraceForensicsRole
      - Arn
    Description: The ARN of the Darktrace /FORENSICS Role created.
