Skip to content

Commit aa5766c

Browse files
hahirwar-cdhahirwar-cd
authored
feat(role-session-duration): make AWS role duration and session tagging configurable (#443)
1 parent 310fe7d commit aa5766c

18 files changed

Lines changed: 243 additions & 36 deletions

‎.github/workflows/aws-prowler.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,11 @@ on:
2323
type: number
2424
default: 900
2525
description: 'Duration of the session.'
26+
role_skip_session_tagging:
27+
description: "Whether to skip adding session tags when assuming the AWS IAM role."
28+
required: false
29+
type: boolean
30+
default: true
2631
retention_days:
2732
required: false
2833
type: number
@@ -111,7 +116,7 @@ jobs:
111116
role-to-assume: ${{ secrets.BUILD_ROLE }}
112117
aws-region: ${{ inputs.aws_region }}
113118
role-duration-seconds: ${{ inputs.role_duration_seconds }}
114-
role-skip-session-tagging: true
119+
role-skip-session-tagging: ${{ inputs.role_skip_session_tagging }}
115120

116121
- name: 🔎 Running Prowler for AWS
117122
env:

‎.github/workflows/cf-deploy-stackset.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,16 @@ on:
88
required: false
99
default: 'us-east-2'
1010
type: string
11+
role_duration_seconds:
12+
description: "The duration in seconds for the AWS IAM role session."
13+
required: false
14+
type: number
15+
default: 3600
16+
role_skip_session_tagging:
17+
description: "Whether to skip adding session tags when assuming the AWS IAM role."
18+
required: false
19+
type: boolean
20+
default: true
1121
stackset-instance-region:
1222
description: 'Stackset-instance regions where you need cloudformation stacks'
1323
required: false
@@ -85,6 +95,8 @@ jobs:
8595
aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
8696
aws-region: ${{ inputs.aws-region }}
8797
role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
98+
role-duration-seconds: ${{ inputs.role_duration_seconds }}
99+
role-skip-session-tagging: ${{ inputs.role_skip_session_tagging }}
88100

89101
- name: 🔄 Check if StackSet exists or not-exist then create/update stack-set
90102
id: check-stackset

‎.github/workflows/cf-deploy.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,16 @@ on:
2222
required: false
2323
default: ''
2424
type: string
25+
role_duration_seconds:
26+
description: "The duration in seconds for the AWS IAM role session."
27+
required: false
28+
type: number
29+
default: 3600
30+
role_skip_session_tagging:
31+
description: "Whether to skip adding session tags when assuming the AWS IAM role."
32+
required: false
33+
type: boolean
34+
default: true
2535
stack-name:
2636
description: 'Stack name defined'
2737
required: true
@@ -107,6 +117,8 @@ jobs:
107117
aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
108118
aws-region: ${{ inputs.aws-region }}
109119
role-to-assume: ${{ inputs.role-to-assume }}
120+
role-duration-seconds: ${{ inputs.role_duration_seconds }}
121+
role-skip-session-tagging: ${{ inputs.role_skip_session_tagging }}
110122

111123
- name: 📦 Src folder code convert into zip and upload to S3
112124
run: |

‎.github/workflows/docker-build-push.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,11 @@ on:
3434
required: false
3535
default: ''
3636
type: string
37+
role_skip_session_tagging:
38+
description: "Whether to skip adding session tags when assuming the AWS IAM role."
39+
required: false
40+
type: boolean
41+
default: true
3742
secrets:
3843
AWS_ACCESS_KEY_ID:
3944
required: false
@@ -94,7 +99,7 @@ jobs:
9499
role-to-assume: ${{ inputs.assume_role_arn || secrets.BUILD_ROLE }}
95100
aws-region: ${{ inputs.aws_region }}
96101
role-duration-seconds: ${{ inputs.role_duration_seconds }}
97-
role-skip-session-tagging: true
102+
role-skip-session-tagging: ${{ inputs.role_skip_session_tagging }}
98103

99104
- name: 🕵️ Verify awscli
100105
if: ${{ inputs.provider == 'aws' }}

‎.github/workflows/helm-deploy.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,11 @@ on:
7878
type: number
7979
default: 900
8080
description: 'The assumed role duration in seconds, if assuming a role. Defaults to 1 hour.'
81+
role_skip_session_tagging:
82+
description: "Whether to skip adding session tags when assuming the AWS IAM role."
83+
required: false
84+
type: boolean
85+
default: true
8186
diagram-file-name:
8287
required: false
8388
type: string
@@ -129,7 +134,7 @@ jobs:
129134
role-to-assume: ${{ secrets.BUILD_ROLE }}
130135
aws-region: ${{ inputs.aws_region }}
131136
role-duration-seconds: ${{ inputs.role-duration-seconds }}
132-
role-skip-session-tagging: true
137+
role-skip-session-tagging: ${{ inputs.role_skip_session_tagging }}
133138

134139
- name: ☁️ Install Azure CLI
135140
if: ${{ inputs.provider == 'azure' }}

‎.github/workflows/security-powerpipe.yml‎

Lines changed: 33 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ on:
88
description: 'Cloud Provider Name. i.g. AWS, Azure, GCP, OCI'
99
required: true
1010
type: string
11-
default: 'AWS'
1211
mod_url:
1312
description: 'Powerpipe Mod URL. Get URL from here: https://hub.powerpipe.io/'
1413
required: false
@@ -53,6 +52,23 @@ on:
5352
required: false
5453
type: string
5554
description: 'ID of the default project to use for future API calls and invocations.'
55+
56+
# AWS Authentication
57+
aws_region:
58+
required: false
59+
type: string
60+
default: us-east-2
61+
description: 'AWS region of terraform deployment.'
62+
role_duration_seconds:
63+
description: "The duration in seconds for the AWS IAM role session."
64+
required: false
65+
type: number
66+
default: 3600
67+
role_skip_session_tagging:
68+
description: "Whether to skip adding session tags when assuming the AWS IAM role."
69+
required: false
70+
type: boolean
71+
default: true
5672

5773
secrets:
5874
TOKEN:
@@ -63,6 +79,15 @@ on:
6379
aws_assume_role:
6480
description: 'AWS IAM role to assume. Necessary if cloud_provider is AWS.'
6581
required: false
82+
AWS_ACCESS_KEY_ID:
83+
required: false
84+
description: 'AWS Access Key ID to install AWS CLI.'
85+
AWS_SECRET_ACCESS_KEY:
86+
required: false
87+
description: 'AWS Secret access key to install AWS CLI'
88+
AWS_SESSION_TOKEN:
89+
required: false
90+
description: 'AWS Session Token to install AWS CLI'
6691

6792
# Azure Authentication
6893
AZURE_CLIENT_ID:
@@ -95,12 +120,17 @@ jobs:
95120
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
96121

97122
- name: 🔑 Setup AWS Credentials
123+
if: ${{ inputs.cloud_provider == 'AWS' }}
98124
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
99125
with:
126+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
127+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
128+
aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
100129
role-to-assume: ${{ secrets.aws_assume_role }}
101130
role-session-name: powerpipe
102-
aws-region: us-east-1
103-
if: ${{ inputs.cloud_provider == 'AWS' }}
131+
aws-region: ${{ inputs.aws_region }}
132+
role-duration-seconds: ${{ inputs.role_duration_seconds }}
133+
role-skip-session-tagging: ${{ inputs.role_skip_session_tagging }}
104134

105135
- name: ☁️ Authenticate to Google Cloud
106136
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0

‎.github/workflows/security-prowler.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,11 @@ on:
2626
type: number
2727
default: 900
2828
description: 'Duration of the session.'
29+
role_skip_session_tagging:
30+
description: "Whether to skip adding session tags when assuming the AWS IAM role."
31+
required: false
32+
type: boolean
33+
default: true
2934

3035
secrets:
3136
WIP:
@@ -92,7 +97,7 @@ jobs:
9297
role-to-assume: ${{ secrets.BUILD_ROLE }}
9398
aws-region: ${{ inputs.aws_region }}
9499
role-duration-seconds: ${{ inputs.role_duration_seconds }}
95-
role-skip-session-tagging: true
100+
role-skip-session-tagging: ${{ inputs.role_skip_session_tagging }}
96101

97102
- name: 🔎 Run Prowler for GCP
98103
if: ${{ inputs.cloud_provider == 'gcp' }}

‎.github/workflows/smurf-docker.yml‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,16 @@ on:
8181
type: string
8282
description: AWS assume role
8383
required: false
84+
role_duration_seconds:
85+
description: "The duration in seconds for the AWS IAM role session."
86+
required: false
87+
type: number
88+
default: 3600
89+
role_skip_session_tagging:
90+
description: "Whether to skip adding session tags when assuming the AWS IAM role."
91+
required: false
92+
type: boolean
93+
default: true
8494

8595
# ── GCP ──────────────────────────────────────────────────────────
8696
gcp_project_id:
@@ -233,8 +243,8 @@ jobs:
233243
aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
234244
role-to-assume: ${{ secrets.BUILD_ROLE }}
235245
aws-region: ${{ inputs.aws_region }}
236-
role-duration-seconds: 900
237-
role-skip-session-tagging: true
246+
role-duration-seconds: ${{ inputs.role_duration_seconds }}
247+
role-skip-session-tagging: ${{ inputs.role_skip_session_tagging }}
238248

239249
- name: 🔑 Assume another IAM role (Role Chaining)
240250
if: ${{ inputs.provider == 'aws' && inputs.aws_assume_role }}
@@ -244,6 +254,8 @@ jobs:
244254
role-to-assume: ${{ inputs.aws_assume_role_arn }}
245255
role-session-name: ${{ github.event.repository.name }}-${{ github.run_id }}
246256
role-chaining: true
257+
role-duration-seconds: ${{ inputs.role_duration_seconds }}
258+
role-skip-session-tagging: ${{ inputs.role_skip_session_tagging }}
247259

248260
- name: ☁️ Authenticate Google Cloud with WIP and Service Account
249261
if: inputs.gcp_auth_method == 'wip'

‎.github/workflows/smurf-helm-deploy.yml‎

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,16 @@ on:
5252
description: IAM role ARN to assume
5353
type: string
5454
required: false
55+
role_duration_seconds:
56+
description: "The duration in seconds for the AWS IAM role session."
57+
required: false
58+
type: number
59+
default: 3600
60+
role_skip_session_tagging:
61+
description: "Whether to skip adding session tags when assuming the AWS IAM role."
62+
required: false
63+
type: boolean
64+
default: true
5565

5666
# ── GCP ──────────────────────────────────────────────────────────
5767
gcp_project_id:
@@ -394,8 +404,8 @@ jobs:
394404
aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
395405
role-to-assume: ${{ secrets.BUILD_ROLE }}
396406
aws-region: ${{ inputs.aws_region }}
397-
role-duration-seconds: 900
398-
role-skip-session-tagging: true
407+
role-duration-seconds: ${{ inputs.role_duration_seconds }}
408+
role-skip-session-tagging: ${{ inputs.role_skip_session_tagging }}
399409

400410
- name: 🔑 Assume another IAM role (Role Chaining)
401411
if: ${{ inputs.provider == 'aws' && inputs.aws_assume_role }}
@@ -405,6 +415,8 @@ jobs:
405415
role-to-assume: ${{ inputs.aws_assume_role_arn }}
406416
role-session-name: ${{ github.event.repository.name }}-${{ github.run_id }}
407417
role-chaining: true
418+
role-duration-seconds: ${{ inputs.role_duration_seconds }}
419+
role-skip-session-tagging: ${{ inputs.role_skip_session_tagging }}
408420

409421
- name: ☁️ Authenticate to Google Cloud
410422
if: ${{ inputs.provider == 'gcp' }}
@@ -645,8 +657,8 @@ jobs:
645657
aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
646658
role-to-assume: ${{ secrets.BUILD_ROLE }}
647659
aws-region: ${{ inputs.aws_region }}
648-
role-duration-seconds: 900
649-
role-skip-session-tagging: true
660+
role-duration-seconds: ${{ inputs.role_duration_seconds }}
661+
role-skip-session-tagging: ${{ inputs.role_skip_session_tagging }}
650662

651663
- name: 🔑 Assume another IAM role (Role Chaining)
652664
if: ${{ inputs.provider == 'aws' && inputs.aws_assume_role }}
@@ -656,6 +668,8 @@ jobs:
656668
role-to-assume: ${{ inputs.aws_assume_role_arn }}
657669
role-session-name: ${{ github.event.repository.name }}-${{ github.run_id }}
658670
role-chaining: true
671+
role-duration-seconds: ${{ inputs.role_duration_seconds }}
672+
role-skip-session-tagging: ${{ inputs.role_skip_session_tagging }}
659673

660674
- name: ☁️ Authenticate to Google Cloud
661675
if: ${{ inputs.provider == 'gcp' }}

‎.github/workflows/smurf-tf-checks.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,11 @@ on:
2828
type: number
2929
default: 3600
3030
description: 'The assumed role duration in seconds, if assuming a role. Defaults to 1 hour (3600 seconds). Acceptable values range from 15 minutes (900 seconds) to 12 hours (43200 seconds).'
31+
role_skip_session_tagging:
32+
description: "Whether to skip adding session tags when assuming the AWS IAM role."
33+
required: false
34+
type: boolean
35+
default: true
3136
gcp_credentials:
3237
description: 'GCP credentials to use.'
3338
required: false
@@ -128,7 +133,7 @@ jobs:
128133
role-to-assume: ${{ secrets.BUILD_ROLE }}
129134
aws-region: ${{ inputs.aws_region }}
130135
role-duration-seconds: ${{ inputs.role_duration_seconds }}
131-
role-skip-session-tagging: true
136+
role-skip-session-tagging: ${{ inputs.role_skip_session_tagging }}
132137

133138
- name: ☁️ Install Azure CLI
134139
if: ${{ inputs.provider == 'azurerm' }}

0 commit comments

Comments
 (0)