Skip to content

Commit 5db0282

Browse files
VeetahaVeetaha
authored
Add ElastioAwsBackupEc2Scan permission boundary (#106)
1 parent 4bb122f commit 5db0282

4 files changed

Lines changed: 213 additions & 8 deletions

File tree

‎codegen/src/iam.ts‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -38,17 +38,16 @@ type Principal =
3838
};
3939

4040
type Action =
41-
| "cloudformation:*"
41+
| `${string}:*`
42+
| `${iam.AwsBackupActions}`
4243
| `${iam.AwsCloudformationActions}`
43-
| "logs:*"
44-
| `${iam.AwsLogsActions}`
45-
| "iam:*"
44+
| `${iam.AwsEbsActions}`
45+
| `${iam.AwsEc2Actions}`
4646
| `${iam.AwsIamActions}`
47-
| "lambda:*"
47+
| `${iam.AwsKmsActions}`
4848
| `${iam.AwsLambdaActions}`
49-
| "s3:*"
49+
| `${iam.AwsLogsActions}`
5050
| `${iam.AwsS3Actions}`
51-
| "ssm:*"
5251
| `${iam.AwsSsmActions}`;
5352

5453
type KnownTag =
@@ -65,7 +64,11 @@ type KnownTag =
6564
| "elastio:authorize"
6665

6766
// Set on every resource deployed by Elastio
68-
| "elastio:resource";
67+
| "elastio:resource"
68+
69+
// Set by AWS Backup on resources created as part of AWS Backup restore testing.
70+
// The value of this tag is the ID of the AWS Backup restore job.
71+
| "awsbackup-restore-test";
6972

7073
export function hasResourceTag(tag: KnownTag) {
7174
return hasTags("aws:ResourceTag", tag);

‎codegen/src/policies/ElastioAwsBackupEc2Scan.ts‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
import * as iam from "../iam";
2+
3+
export default {
4+
description: "Allows Elastio to scan AWS Backup recovery points.",
5+
6+
statements: [
7+
{
8+
Sid: "ReadBackupInventory",
9+
Action: [
10+
// Vaults
11+
"backup:ListBackupVaults",
12+
"backup:DescribeBackupVault",
13+
14+
// Recovery points
15+
"backup:ListRecoveryPointsByResource",
16+
"backup:DescribeRecoveryPoint",
17+
"backup:ListRecoveryPointsByBackupVault",
18+
"backup:GetRecoveryPointRestoreMetadata",
19+
20+
// Common for all resources
21+
"backup:ListTags",
22+
23+
// Misc.
24+
"backup:ListProtectedResources",
25+
"backup:ListProtectedResourcesByBackupVault",
26+
],
27+
Resource: "*",
28+
},
29+
30+
{
31+
Sid: "ReadEbsInventory",
32+
Action: [
33+
// Volumes
34+
"ec2:DescribeVolumeStatus",
35+
"ec2:DescribeVolumes",
36+
37+
// Snapshots
38+
"ec2:DescribeSnapshots",
39+
"ec2:DescribeSnapshotAttribute",
40+
41+
// Common for all resources
42+
"ec2:DescribeTags",
43+
44+
// Used for cost estimation
45+
"ebs:ListSnapshotBlocks",
46+
"ebs:ListChangedBlocks",
47+
],
48+
Resource: "*",
49+
},
50+
51+
{
52+
Sid: "ReadEbsSnapshotsData",
53+
Action: ["ebs:GetSnapshotBlock"],
54+
Resource: "*",
55+
},
56+
57+
{
58+
Sid: "ReadEc2Inventory",
59+
Action: [
60+
"ec2:DescribeInstances",
61+
"ec2:DescribeImages",
62+
"ec2:DescribeHosts",
63+
"ssm:DescribeInstanceInformation",
64+
],
65+
Resource: "*",
66+
},
67+
68+
{
69+
Sid: "ShareEbsSnapshot",
70+
Action: ["ec2:ModifySnapshotAttribute"],
71+
Resource: "*",
72+
Condition: {
73+
// Needed to add createVolumePermission for the sharing the snapshot
74+
// with the connector account.
75+
StringLike: {
76+
"ec2:Add/userId": "*",
77+
},
78+
},
79+
},
80+
81+
{
82+
Sid: "KmsAccess",
83+
84+
// Users need to put a special tag on their KMS keys to allow Elastio
85+
// use them for decrypting their data. It must be documented in public
86+
// Elastio documentation.
87+
Condition: iam.hasResourceTag("elastio:authorize"),
88+
89+
Action: [
90+
// These actions are needed to reencrypt the volumes that were encrypted
91+
// by the KMS key.
92+
"kms:ReEncryptFrom",
93+
"kms:ReEncryptTo",
94+
"kms:CreateGrant",
95+
"kms:Encrypt",
96+
97+
// Needed only for some cases. For example, when we want to snapshot an EBS
98+
// volume that was created from a snapshot of the root volume of an EC2 instance.
99+
// These calls are made by the ebs.amazonaws.com and not by our code.
100+
"kms:DescribeKey",
101+
102+
// GenerateDataKeyWithoutPlaintext in particular is required in case when
103+
// we create a volume from an unencrypted snapshot but there is a default
104+
// KMS encryption key set in EBS for the volume.
105+
"kms:GenerateDataKey",
106+
"kms:GenerateDataKeyWithoutPlaintext",
107+
108+
// This is required when reading S3 buckets encrypted with a KMS key
109+
"kms:Decrypt",
110+
],
111+
Resource: "*",
112+
},
113+
],
114+
} satisfies iam.Policy;

‎iam-policies/terraform/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,10 @@ See the basic [usage example](./examples/basic/main.tf).
3030
| Policy | Description |
3131
| ------------------------------------------------------------ | -------------------------------------------------------------- |
3232
| [`ElastioAssetAccountDeployer`][ElastioAssetAccountDeployer] | Permissions required to deploy the Elastio Asset Account stack |
33+
| [`ElastioAwsBackupEc2Scan`][ElastioAwsBackupEc2Scan] | Allows Elastio to scan AWS Backup recovery points. |
3334

3435
[ElastioAssetAccountDeployer]: ../../codegen/src/policies/ElastioAssetAccountDeployer.ts
36+
[ElastioAwsBackupEc2Scan]: ../../codegen/src/policies/ElastioAwsBackupEc2Scan.ts
3537

3638
<!-- ELASTIO_END_POLICY_NAMES -->
3739

‎iam-policies/terraform/policies/ElastioAwsBackupEc2Scan.json‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
{
2+
"Description": "Allows Elastio to scan AWS Backup recovery points.",
3+
"PolicyDocument": {
4+
"Version": "2012-10-17",
5+
"Statement": [
6+
{
7+
"Sid": "ReadBackupInventory",
8+
"Action": [
9+
"backup:ListBackupVaults",
10+
"backup:DescribeBackupVault",
11+
"backup:ListRecoveryPointsByResource",
12+
"backup:DescribeRecoveryPoint",
13+
"backup:ListRecoveryPointsByBackupVault",
14+
"backup:GetRecoveryPointRestoreMetadata",
15+
"backup:ListTags",
16+
"backup:ListProtectedResources",
17+
"backup:ListProtectedResourcesByBackupVault"
18+
],
19+
"Resource": "*",
20+
"Effect": "Allow"
21+
},
22+
{
23+
"Sid": "ReadEbsInventory",
24+
"Action": [
25+
"ec2:DescribeVolumeStatus",
26+
"ec2:DescribeVolumes",
27+
"ec2:DescribeSnapshots",
28+
"ec2:DescribeSnapshotAttribute",
29+
"ec2:DescribeTags",
30+
"ebs:ListSnapshotBlocks",
31+
"ebs:ListChangedBlocks"
32+
],
33+
"Resource": "*",
34+
"Effect": "Allow"
35+
},
36+
{
37+
"Sid": "ReadEbsSnapshotsData",
38+
"Action": ["ebs:GetSnapshotBlock"],
39+
"Resource": "*",
40+
"Effect": "Allow"
41+
},
42+
{
43+
"Sid": "ReadEc2Inventory",
44+
"Action": [
45+
"ec2:DescribeInstances",
46+
"ec2:DescribeImages",
47+
"ec2:DescribeHosts",
48+
"ssm:DescribeInstanceInformation"
49+
],
50+
"Resource": "*",
51+
"Effect": "Allow"
52+
},
53+
{
54+
"Sid": "ShareEbsSnapshot",
55+
"Action": ["ec2:ModifySnapshotAttribute"],
56+
"Resource": "*",
57+
"Condition": {
58+
"StringLike": {
59+
"ec2:Add/userId": "*"
60+
}
61+
},
62+
"Effect": "Allow"
63+
},
64+
{
65+
"Sid": "KmsAccess",
66+
"Condition": {
67+
"StringLike": {
68+
"aws:ResourceTag/elastio:authorize": "*"
69+
}
70+
},
71+
"Action": [
72+
"kms:ReEncryptFrom",
73+
"kms:ReEncryptTo",
74+
"kms:CreateGrant",
75+
"kms:Encrypt",
76+
"kms:DescribeKey",
77+
"kms:GenerateDataKey",
78+
"kms:GenerateDataKeyWithoutPlaintext",
79+
"kms:Decrypt"
80+
],
81+
"Resource": "*",
82+
"Effect": "Allow"
83+
}
84+
]
85+
}
86+
}

0 commit comments

Comments
 (0)