cloudtrail: Initial integration tests (#61919)

hacking/aws_config/testing_policies/security-policy.json

@@ -46,6 +46,7 @@
                 "iam:DeleteRolePolicy",
                 "iam:DeleteRolePermissionsBoundary",
                 "iam:DetachRolePolicy",
+                "iam:PutRolePolicy",
                 "iam:PassRole",
                 "iam:PutRolePolicy",
                 "iam:PutRolePermissionsBoundary",
@@ -98,6 +99,28 @@
                 "arn:aws:logs:{{aws_region}}:{{aws_account}}:log-group:*"
             ]
         },
+        {
+            "Sid": "AllowModifyingCloudtrail",
+            "Effect": "Allow",
+            "Action": [
+                "cloudtrail:*"
+            ],
+            "Resource": [
+                "arn:aws:cloudtrail:{{aws_region}}:{{aws_account}}:trail/ansible-test-*"
+            ]
+        },
+        {
+            "Sid": "AllowDescribingCloudtrails",
+            "Effect": "Allow",
+            "Action": [
+                "cloudtrail:DescribeTrails",
+                "cloudtrail:ListTags",
+                "cloudtrail:ListPublicKeys"
+            ],
+            "Resource": [
+                "*"
+            ]
+        },
         {
             "Sid": "AllowModifyingCloudwatchLogs",
             "Effect": "Allow",
@@ -107,7 +130,7 @@
                 "logs:DeleteLogGroup"
             ],
             "Resource": [
-                "arn:aws:logs:{{aws_region}}:{{aws_account}}:log-group:ansible-testing*"
+                "arn:aws:logs:{{aws_region}}:{{aws_account}}:log-group:ansible-test*"
             ]
         },
         {

hacking/aws_config/testing_policies/storage-policy.json

@@ -5,8 +5,7 @@
             "Sid": "AllowS3AnsibleTestBuckets",
             "Action": [
                 "s3:CreateBucket",
-                "s3:DeleteBucket",
+                "s3:Delete*",
-                "s3:DeleteObject",
                 "s3:GetBucketPolicy",
                 "s3:GetBucketRequestPayment",
                 "s3:GetBucketTagging",
@@ -15,7 +14,7 @@
                 "s3:GetObject",
                 "s3:GetBucketNotification",
                 "s3:HeadBucket",
-                "s3:ListBucket",
+                "s3:List*",
                 "s3:PutBucketAcl",
                 "s3:PutBucketPolicy",
                 "s3:PutBucketRequestPayment",

test/integration/targets/cloudtrail/aliases

@@ -0,0 +1,2 @@
+cloud/aws
+unsupported

test/integration/targets/cloudtrail/defaults/main.yml

@@ -0,0 +1,7 @@
+cloudtrail_name: '{{ resource_prefix }}-cloudtrail'
+s3_bucket_name: '{{ resource_prefix }}-cloudtrail-bucket'
+kms_alias: '{{ resource_prefix }}-cloudtrail'
+sns_topic: '{{ resource_prefix }}-cloudtrail-notifications'
+cloudtrail_prefix: 'test-prefix'
+cloudwatch_log_group: '{{ resource_prefix }}-cloudtrail'
+cloudwatch_role: '{{ resource_prefix }}-cloudtrail'

test/integration/targets/cloudtrail/templates/cloudwatch-assume-policy.j2

@@ -0,0 +1,13 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "AssumeFromCloudTrails",
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "cloudtrail.amazonaws.com"
+      },
+      "Action": "sts:AssumeRole"
+    }
+  ]
+}

test/integration/targets/cloudtrail/templates/cloudwatch-policy.j2

@@ -0,0 +1,17 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "CloudTrail2CloudWatch",
+      "Effect": "Allow",
+      "Action": [
+        "logs:CreateLogStream",
+        "logs:PutLogEvents"
+      ],
+      "Resource": [
+        "arn:aws:logs:{{ aws_region }}:{{ aws_caller_info.account }}:log-group:{{ cloudwatch_log_group }}:log-stream:*",
+        "arn:aws:logs:{{ aws_region }}:{{ aws_caller_info.account }}:log-group:{{ cloudwatch_log_group }}-2:log-stream:*"
+      ]
+    }
+  ]
+}

test/integration/targets/cloudtrail/templates/kms-policy.j2

@@ -0,0 +1,34 @@
+{
+  "Version": "2012-10-17",
+  "Id": "CloudTrailPolicy",
+  "Statement": [
+    {
+      "Sid": "EncryptLogs",
+      "Effect": "Allow",
+      "Principal": { "Service": "cloudtrail.amazonaws.com" },
+      "Action": "kms:GenerateDataKey*",
+      "Resource": "*",
+      "Condition": {
+        "StringLike": {
+          "kms:EncryptionContext:aws:cloudtrail:arn": [
+            "arn:aws:cloudtrail:*:{{ aws_caller_info.account }}:trail/{{ resource_prefix }}*"
+          ]
+        }
+      }
+    },
+    {
+      "Sid": "DescribeKey",
+      "Effect": "Allow",
+      "Principal": { "Service": "cloudtrail.amazonaws.com" },
+      "Action": "kms:DescribeKey",
+      "Resource": "*"
+    },
+    {
+      "Sid": "AnsibleTestManage",
+      "Effect": "Allow",
+      "Principal": { "AWS": "{{ aws_caller_info.arn }}" },
+      "Action": "*",
+      "Resource": "*"
+    }
+  ]
+}

test/integration/targets/cloudtrail/templates/s3-policy.j2

@@ -0,0 +1,34 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "CloudTrailCheckAcl",
+      "Effect": "Allow",
+      "Principal": { "Service": "cloudtrail.amazonaws.com" },
+      "Action": "s3:GetBucketAcl",
+      "Resource": "arn:aws:s3:::{{ bucket_name }}",
+    },
+    {
+      "Sid": "CloudTrailWriteLogs",
+      "Effect": "Allow",
+      "Principal": { "Service": "cloudtrail.amazonaws.com" },
+      "Action": "s3:PutObject",
+      "Resource": [
+        "arn:aws:s3:::{{ bucket_name }}/AWSLogs/{{ aws_caller_info.account }}/*",
+        "arn:aws:s3:::{{ bucket_name }}/{{ cloudtrail_prefix }}*/AWSLogs/{{ aws_caller_info.account }}/*"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "s3:x-amz-acl": "bucket-owner-full-control"
+        }
+      }
+    },
+    {
+      "Sid": "AnsibleTestManage",
+      "Effect": "Allow",
+      "Principal": { "AWS": "{{ aws_caller_info.arn }}" },
+      "Action": "*",
+      "Resource": "arn:aws:s3:::{{ bucket_name }}"
+    }
+  ]
+}

test/integration/targets/cloudtrail/templates/sns-policy.j2

@@ -0,0 +1,34 @@
+{
+  "Version": "2008-10-17",
+  "Id": "AnsibleSNSTesting",
+  "Statement": [
+    {
+      "Sid": "CloudTrailSNSPolicy",
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "cloudtrail.amazonaws.com"
+      },
+      "Action": "sns:Publish",
+      "Resource": "arn:aws:sns:{{ aws_region }}:{{ aws_caller_info.account }}:{{ sns_topic_name }}"
+    },
+    {
+      "Sid": "AnsibleTestManage",
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "{{ aws_caller_info.arn }}"
+      },
+      "Action": [
+        "sns:Subscribe",
+        "sns:ListSubscriptionsByTopic",
+        "sns:DeleteTopic",
+        "sns:GetTopicAttributes",
+        "sns:Publish",
+        "sns:RemovePermission",
+        "sns:AddPermission",
+        "sns:Receive",
+        "sns:SetTopicAttributes"
+      ],
+      "Resource": "arn:aws:sns:{{ aws_region }}:{{ aws_caller_info.account }}:{{ sns_topic_name }}"
+    }
+  ]
+}