This page contains the permissions policy for the Amazon Web Services (AWS) role that is required by the following services:
Replace the following:
AWS_REGION: the region where you are installing AWS CloudFormationAWS_ACCOUNT_ID: the AWS account ID where you are installing AWS CloudFormation
Paste this policy into the AWS role to add permissions.
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "sqs:CreateQueue", "sqs:TagQueue" ], "Resource": [ "arn:aws:sqs:*:AWS_ACCOUNT_ID:PurpleboxQueue" ], "Effect": "Allow" }, { "Action": [ "logs:FilterLogEvents", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:AWS_REGION:AWS_ACCOUNT_ID:log-group:/aws/lambda/PurpleBox", "arn:aws:logs:AWS_REGION:AWS_ACCOUNT_ID:log-group:/aws/lambda/PurpleBox:log-stream", "arn:aws:logs:AWS_REGION:AWS_ACCOUNT_ID:log-group:/aws/lambda/PurpleBox:log-stream:" ], "Effect": "Allow" }, { "Action": [ "ssm:GetParameter" ], "Resource": "arn:aws:ssm:*::parameter/aws/service/ami-amazon-linux-latest*", "Effect": "Allow" }, { "Action": [ "lambda:DeleteFunction" ], "Resource": "arn:aws:lambda:*:AWS_ACCOUNT_ID:function:purplebox-sqs-processing", "Effect": "Allow" }, { "Action": [ "ec2:CreateTags", "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeSnapshots", "ec2:DescribeRegions", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeRouteTables", "ec2:DescribeVpcEndpoints", "ec2:DescribeInternetGateways", "ecr:DescribeRepositories", "ecr:DescribeImages", "ecr-public:DescribeRepositories", "ecr-public:DescribeImages", "ec2:CreateSnapshot", "events:ListRules", "servicequotas:ListServiceQuotas", "organizations:DescribeOrganization", "lambda:TagResource", "events:TagResource", "cloudwatch:GetMetricStatistics", "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation", "ssm:ListCommandInvocations", "ec2:DescribeSecurityGroupRules", "lambda:ListEventSourceMappings", "lambda:ListFunctions", "s3:ListAllMyBuckets", "events:DescribeRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::purplebox.cnspec.*", "arn:aws:s3:::purplebox.cnspec.*/*" ], "Effect": "Allow" }, { "Condition": { "StringEquals": { "aws:RequestTag/Created By": "Purplebox" } }, "Action": [ "ec2:CreateSubnet" ], "Resource": "arn:aws:ec2:*:AWS_ACCOUNT_ID:subnet/*", "Effect": "Allow" }, { "Action": [ "cloudformation:DeleteStack", "cloudformation:UpdateStack", "cloudformation:GetTemplate", "cloudformation:DescribeStacks" ], "Resource": [ "arn:aws:cloudformation:AWS_REGION:AWS_ACCOUNT_ID:stack/*" ], "Effect": "Allow" }, { "Condition": { "StringEquals": { "aws:ResourceTag/Created By": "Purplebox" } }, "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:AWS_ACCOUNT_ID:vpc/*", "Effect": "Allow" }, { "Condition": { "StringEquals": { "aws:ResourceTag/Created By": "Purplebox" } }, "Action": [ "ec2:CreateSubnet" ], "Resource": "arn:aws:ec2:*:AWS_ACCOUNT_ID:vpc/*", "Effect": "Allow" }, { "Condition": { "StringEquals": { "aws:ResourceTag/Created By": "Purplebox" } }, "Action": [ "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "arn:aws:ec2:*:AWS_ACCOUNT_ID:security-group*", "Effect": "Allow" }, { "Condition": { "StringEquals": { "aws:RequestTag/Created By": "Purplebox" } }, "Action": [ "ec2:AuthorizeSecurityGroupIngress" ], "Resource": [ "arn:aws:ec2:*:AWS_ACCOUNT_ID:security-group-rule", "arn:aws:ec2:*:AWS_ACCOUNT_ID:security-group-rule/*" ], "Effect": "Allow" }, { "Condition": { "StringEquals": { "aws:RequestTag/Created By": "Purplebox" } }, "Action": [ "ec2:CreateRouteTable" ], "Resource": "arn:aws:ec2:*:AWS_ACCOUNT_ID:route-table/*", "Effect": "Allow" }, { "Condition": { "StringEquals": { "aws:RequestTag/Created By": "Purplebox" } }, "Action": [ "ec2:CreateSecurityGroup" ], "Resource": "arn:aws:ec2:*:AWS_ACCOUNT_ID:security-group/*", "Effect": "Allow" }, { "Condition": { "StringEquals": { "aws:RequestTag/Created By": "Purplebox" } }, "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": "arn:aws:ec2:*:AWS_ACCOUNT_ID:vpc-endpoint*", "Effect": "Allow" }, { "Condition": { "StringEquals": { "aws:ResourceTag/Created By": "Purplebox" } }, "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": [ "arn:aws:ec2:*:AWS_ACCOUNT_ID:vpc/*", "arn:aws:ec2:*:AWS_ACCOUNT_ID:subnet/*", "arn:aws:ec2:*:AWS_ACCOUNT_ID:security-group*" ], "Effect": "Allow" }, { "Condition": { "StringEquals": { "aws:RequestTag/Created By": "Purplebox" } }, "Action": [ "ec2:CreateInternetGateway" ], "Resource": "arn:aws:ec2:*:AWS_ACCOUNT_ID:internet-gateway/*", "Effect": "Allow" }, { "Condition": { "StringEquals": { "aws:ResourceTag/Created By": "Purplebox" } }, "Action": [ "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:lambda:AWS_REGION:AWS_ACCOUNT_ID:function:PurpleBox", "arn:aws:lambda:*:AWS_ACCOUNT_ID:function:purplebox-sqs-processing", "arn:aws:events:*:AWS_ACCOUNT_ID:rule/purplebox*" ], "Effect": "Allow" }, { "Condition": { "StringEquals": { "aws:RequestTag/Created By": "Purplebox" } }, "Action": [ "ec2:CreateVpc" ], "Resource": "arn:aws:ec2:*:AWS_ACCOUNT_ID:vpc/*", "Effect": "Allow" }, { "Action": [ "ec2:CreateVpcEndpoint" ], "Resource": "arn:aws:ec2:*:AWS_ACCOUNT_ID:route-table/*", "Effect": "Allow" }, { "Condition": { "StringEquals": { "aws:ResourceTag/Created By": "Purplebox" } }, "Action": [ "ec2:ModifyVpcAttribute", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway" ], "Resource": [ "arn:aws:ec2:*:AWS_ACCOUNT_ID:internet-gateway/*", "arn:aws:ec2:*:AWS_ACCOUNT_ID:route-table/*", "arn:aws:ec2:*:AWS_ACCOUNT_ID:vpc/*" ], "Effect": "Allow" }, { "Condition": { "StringEquals": { "aws:ResourceTag/Created By": "Purplebox" } }, "Action": [ "ec2:TerminateInstances" ], "Resource": [ "arn:aws:ec2:*:AWS_ACCOUNT_ID:instance/*" ], "Effect": "Allow" }, { "Condition": { "StringEquals": { "ec2:Owner": "amazon" } }, "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*::image/*", "Effect": "Allow" }, { "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:AWS_ACCOUNT_ID:network-interface/*", "arn:aws:ec2:*:AWS_ACCOUNT_ID:subnet/*", "arn:aws:ec2:*:AWS_ACCOUNT_ID:volume/*" ], "Effect": "Allow" }, { "Condition": { "StringEquals": { "aws:ResourceTag/Created By": "Purplebox" } }, "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:AWS_ACCOUNT_ID:security-group/*", "arn:aws:ec2:*::snapshot/*" ], "Effect": "Allow" }, { "Action": [ "iam:GetRole", "iam:PassRole", "iam:TagRole", "iam:PutRolePolicy", "iam:GetRolePolicy", "iam:AttachRolePolicy", "iam:DeleteRole", "iam:DeleteRolePolicy", "lambda:DeleteCodeSigningConfig", "iam:CreateRole", "iam:GetInstanceProfile", "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:AddRoleToInstanceProfile", "lambda:GetFunction", "lambda:CreateFunction", "lambda:CreateEventSourceMapping", "lambda:GetEventSourceMapping", "lambda:DeleteEventSourceMapping", "ssm:SendCommand", "iam:DetachRolePolicy", "iam:RemoveRoleFromInstanceProfile" ], "Resource": [ "*" ], "Effect": "Allow" }, { "Condition": { "StringEquals": { "aws:ResourceTag/Created By": "Purplebox" } }, "Action": [ "ec2:AttachVolume", "ec2:DetachVolume", "ec2:DeleteVolume", "ec2:DeleteSnapshot", "ec2:DeleteVpc", "ec2:DeleteSubnet", "ec2:DeleteSecurityGroup", "ec2:DeleteVpcEndpoints", "ec2:DeleteRouteTable", "ec2:DeleteInternetGateway", "ec2:DetachInternetGateway", "lambda:DeleteFunction" ], "Resource": "*", "Effect": "Allow" }, { "Condition": { "StringEquals": { "aws:RequestTag/Created By": "Purplebox" } }, "Action": [ "ec2:CreateVolume" ], "Resource": "*", "Effect": "Allow" }, { "Condition": { "StringEquals": { "ec2:InstanceProfile": "arn:aws:iam::AWS_ACCOUNT_ID:instance-profile/scanner-instance-profile", "ec2:InstanceType": [ "t4g.micro", "t2.micro", "t4g.medium" ] } }, "Action": [ "ec2:RunInstances" ], "Resource": "arn:aws:ec2:*:AWS_ACCOUNT_ID:instance/*", "Effect": "Allow" }, { "Condition": { "StringEquals": { "aws:ResourceTag/Created By": "Purplebox", "kms:CallerAccount": "AWS_ACCOUNT_ID", "kms:ViaService": "lambda.AWS_REGION.amazonaws.com" }, "Bool": { "kms:GrantIsForAWSResource": "true" } }, "Action": "kms:CreateGrant", "Resource": "arn:aws:kms:*:AWS_ACCOUNT_ID:key/*", "Effect": "Allow" }, { "Action": [ "events:PutRule", "events:DeleteRule", "events:TagResource" ], "Resource": "arn:aws:events:*:AWS_ACCOUNT_ID:rule/purplebox*", "Effect": "Allow" }, { "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ssm:*::document/AWS-RunShellScript", "arn:aws:ssm:*::document/AWS-RunPowerShellScript" ], "Effect": "Allow" }, { "Action": [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:GetParameter", "ssm:GetParameters" ], "Resource": "arn:aws:ssm:AWS_REGION:AWS_ACCOUNT_ID:parameter/Purplebox*", "Effect": "Allow" }, { "Action": [ "sqs:SendMessage", "sqs:DeleteMessage", "sqs:SetQueueAttributes", "sqs:DeleteQueue", "sqs:ReceiveMessage", "sqs:GetQueueAttributes", "sqs:PurgeQueue" ], "Resource": "arn:aws:sqs:*:AWS_ACCOUNT_ID:PurpleboxQueue", "Effect": "Allow" }, { "Action": [ "lambda:UpdateFunctionConfiguration", "lambda:GetFunctionConfiguration", "lambda:*Permission", "lambda:UpdateFunctionCode", "lambda:*Function", "lambda:PutFunctionConcurrency", "lambda:UpdateEventSourceMapping", "lambda:PutFunctionCodeSigningConfig" ], "Resource": [ "arn:aws:lambda:AWS_REGION:AWS_ACCOUNT_ID:function:PurpleBox", "arn:aws:lambda:*:AWS_ACCOUNT_ID:function:purplebox-sqs-processing", "arn:aws:lambda:AWS_REGION:AWS_ACCOUNT_ID:function:PurpleBoxUpdater" ], "Effect": "Allow" }, { "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::scc-vulnscanner.AWS_REGION/*", "arn:aws:s3:::scc-vulnscanner.*/*" ], "Effect": "Allow" }, { "Action": [ "events:RemovePermission" ], "Resource": "arn:aws:events:*:AWS_ACCOUNT_ID:event-bus/default", "Effect": "Allow" }, { "Condition": { "StringEquals": { "sts:AWSServiceName": "ec2.amazonaws.com" } }, "Action": [ "sts:GetServiceBearerToken" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "lambda:UpdateCodeSigningConfig" ], "Resource": "arn:aws:lambda:AWS_REGION:AWS_ACCOUNT_ID:code-signing-config:csc-04006c10ff4690ad0", "Effect": "Allow" }, { "Action": [ "lambda:CreateCodeSigningConfig", "lambda:GetCodeSigningConfig" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "iam:ListAttachedRolePolicies", "iam:ListRolePolicies" ], "Resource": [ "arn:aws:iam::AWS_ACCOUNT_ID:role/scanner-role", "arn:aws:iam::AWS_ACCOUNT_ID:role/purplebox-sqs-lambda-role", "arn:aws:iam::AWS_ACCOUNT_ID:role/PurpleboxRole" ], "Effect": "Allow" }, { "Action": [ "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:SendMessage", "sqs:GetQueueAttributes", "lambda:InvokeFunction", "lambda:CreateEventSourceMapping", "lambda:UpdateFunctionConfiguration", "lambda:ListEventSourceMappings", "lambda:UpdateEventSourceMapping" ], "Resource": [ "arn:aws:lambda:*:AWS_ACCOUNT_ID:function:purplebox-sqs-processing", "arn:aws:sqs:*:AWS_ACCOUNT_ID:PurpleboxQueue" ], "Effect": "Allow" }, { "Action": [ "sqs:SendMessage" ], "Resource": "arn:aws:sqs:*:AWS_ACCOUNT_ID:PurpleboxQueue", "Effect": "Allow" }, { "Action": [ "ec2:DescribeInstances", "ecr:DescribeImages", "ecr-public:DescribeImages", "ecr:DescribeRepositories", "ecr-public:DescribeRepositories", "ecr:GetAuthorizationToken", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": "arn:aws:s3:::purplebox.cnspec.*", "Effect": "Allow" } ] }