Drata CDK 堆栈集

由 Drata 的官方模板生成的 CDK 构造 https://github.com/drata/aws-cloudform-drata-setup 页面存档备份,存于互联网档案馆

安装

npm i --save-dev @factbird/drata-cdk-stackset

使用量

这一设置假设了以下账户结构:

1. 一个被信任为授权管理员账户的孤立的 Drata 账户
2. 管理( 与 AWS CloudFormationStackSet ExecutionRole 连接, 以信任孤立的 Drata 账户)
3. 目标账户

由服务管理的StackSets不会部署到管理账户,因此为什么 自我管理的变体是必要的。 类似地,一个堆栈集 UNION 部署 对创建事件不支持目标过滤器.

1. 和2. 均作为自行管理的堆放装置部署,3. 被作为一个装置部署 服务管理堆栈, 将新账户添加到 OU 中 自动.

如果 2 还没有执行角色, 您可以单独部署, 否则跳过此步骤, 而是扩展您 Drata 账户的信任政策 :

import { App, Stack } from 'aws-cdk-lib';
import { AccountPrincipal, ManagedPolicy, Role } from 'aws-cdk-lib/aws-iam';

const yourAccounts = {
  drata: '987654321',
  management: '1234567890',
};

const app = new App();

const stack = new Stack(app, 'stackset-execution', {
  env: {
    account: yourAccounts.management,
  },
});

new Role(stack, 'StackSetExecutionRole', {
  roleName: 'AWSCloudFormationStackSetExecutionRole',
  managedPolicies: [ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess')],
  assumedBy: new AccountPrincipal(yourAccounts.drata),
});

对于 Drata 相关资源, StackSets 的两个变体都可以像这样创建:

import { App, Stack } from 'aws-cdk-lib';
import { DeploymentType, StackSet, StackSetTarget, StackSetTemplate } from 'cdk-stacksets';
import { DrataStackSet } from '@factbird/drata-cdk-stackset';

const organizationalUnits = {
  targetAccounts: 'ou-1234567',
};

const yourAccounts = {
  drata: '987654321',
  management: '1234567890',
};

const externalId = 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee';

const app = new App();

const stack = new Stack(app, 'drata', {
  env: {
    account: yourAccounts.drata,
  },
});

// The Drata account itself needs to execute the StackSets as a self-managed
// variant
new Role(stack, 'StackSetExecutionRole', {
  roleName: 'AWSCloudFormationStackSetExecutionRole',
  managedPolicies: [ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess')],
  assumedBy: new AccountPrincipal(yourAccounts.drata),
});


const drataStackSet = new DrataStackSet(stack, 'DrataStack');

const serviceManaged = new StackSet(stack, 'drata-service-managed', {
  target: StackSetTarget.fromOrganizationalUnits({
    regions: ['us-east-1'],
    organizationalUnits: Object.values(organizationalUnits),
    parameterOverrides: {
      externalId,
    },
  }),
  deploymentType: DeploymentType.serviceManaged(),
  template: StackSetTemplate.fromStackSetStack(drataStackSet),
  capabilities: [Capability.NAMED_IAM],
});

const selfManaged = new StackSet(stack, 'drata-self-managed', {
  target: StackSetTarget.fromAccounts({
    regions: ['us-east-1'],
    accounts: [yourAccounts.management, yourAccounts.drata],
    parameterOverrides: {
      externalId,
    },
  }),
  template: StackSetTemplate.fromStackSetStack(drataStackSet),
  capabilities: [Capability.NAMED_IAM],
});

// Consider if the following two workarounds are still necessary:

// See https://github.com/cdklabs/cdk-stacksets/pull/678
if (selfManaged.role) {
  selfManaged.node.addDependency(selfManaged.role);
}

// See https://github.com/cdklabs/cdk-stacksets/issues/115
for (const stackSet of [serviceManaged, selfManaged]) {
  const cfnStackSet = stackSet.node.defaultChild as CfnStackSet;
  cfnStackSet.addOverride('Properties.Parameters', [
    {
      ParameterKey: 'externalId',
      ParameterValue: '',
    },
  ]);
}

然后简单地将 StackSets 部署到 Drata AWS 专用账户中,账户为:

npx cdk deploy

捐款

安装 Nix并输入开发 shell,

nix develop --impure

或简单 direnv allow 如果你安装了格伦夫.

发布

外壳环境中有出版的脚本可供使用. 简单运行 :

publish