Skip to content
This repository was archived by the owner on Sep 17, 2024. It is now read-only.

Commit 292dec9

Browse files
author
Ray Janoka
committed
Adding support for CloudWatch alarm, events rule, log group, EC2 customer gateway, DHCP options, VPN Gateway, and Lambda function
1 parent 7b2e9b0 commit 292dec9

17 files changed

Lines changed: 486 additions & 55 deletions

‎README.md‎

Lines changed: 42 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -148,41 +148,48 @@ WARNING: When tag-able resources are created using CloudFormation __StackSets__
148148

149149
__Tags Applied__: C=Creator, T=Create Time, I=Invoked By
150150

151-
|Technology|Event Name|Tags Applied|IAM Deny Tag Support
152-
|----------|----------|------------|----------------------
153-
|AutoScaling Group|CreateAutoScalingGroup|C, T, I|Yes
154-
|AutoScaling Group Instances w/ENI & Volume|RunInstances|C, T, I|Yes
155-
|Data Pipeline|CreatePipeline|C, T, I|No
156-
|DynamoDB Table|CreateTable|C, T, I|No
157-
|EBS Volume|CreateVolume|C, T, I|Yes
158-
|EC2 AMI w/Snapshot \*|CreateImage|C, T, I|Yes
159-
|EC2 AMI w/Snapshot \*|CopyImage|C, T, I|Yes
160-
|EC2 AMI \*|RegisterImage|C, T, I|Yes
161-
|EC2 Elastic IP|AllocateAddress|C, T, I|Yes
162-
|EC2 ENI|CreateNetworkInterface|C, T, I|Yes
163-
|EC2 Instance w/ENI & Volume|RunInstances|C, T, I|Yes
164-
|EC2/VPC Security Group|CreateSecurityGroup|C, T, I|Yes
165-
|EC2 Snapshot \*|CreateSnapshot|C, T, I|Yes
166-
|EC2 Snapshot \*|CopySnapshot|C, T, I|Yes
167-
|EC2 Snapshot \*|ImportSnapshot|C, T, I|Yes
168-
|Elastic Load Balancer (v1 & v2)|CreateLoadBalancer|C, T, I|No
169-
|EMR Cluster|RunJobFlow|C, T, I|No
170-
|IAM Role|CreateRole|C, T, I|?
171-
|IAM User|CreateUser|C, T, I|?
172-
|OpsWorks Stack|CreateStack|C (Propagated to Instances)|No
173-
|OpsWorks Clone Stack *|CloneStack|C (Propagated to instances)|No
174-
|OpsWorks Stack Instances w/ENI & Volume|RunInstances|C, T, I|Yes
175-
|RDS Instance|CreateDBInstance|C, T, I|No
176-
|S3 Bucket|CreateBucket|C, T, I|No
177-
|NAT Gateway|CreateNatGateway||Yes
178-
|VPC|CreateVpc|C, T, I|Yes
179-
|VPC Internet Gateway|CreateInternetGateway|C, T, I|Yes
180-
|VPC Network ACL|CreateNetworkAcl|C, T, I|Yes
181-
|VPC Peering Connection|CreateVpcPeeringConnection|C, T, I|Yes
182-
|VPC Route Table|CreateRouteTable|C, T, I|Yes
183-
|VPC Subnet|CreateSubnet|C, T, I|Yes
184-
|VPN Connection|CreateVpnConnection|C, T, I|Yes
185-
151+
|Technology |Event Name |Tags Applied|IAM Deny Tag Support
152+
|---------------------------|----------------------|------------|---
153+
|AutoScaling Group |CreateAutoScalingGroup|C, T, I |Yes
154+
|ASG Instances w/ENI & Vol |RunInstances |C, T, I |Yes
155+
|Data Pipeline |CreatePipeline |C, T, I |No
156+
|DynamoDB Table |CreateTable |C, T, I |No
157+
|CloudWatch Alarm ? |PutMetricAlarm |C, T, I |?
158+
|CloudWatch Events Rule ? |PutRule |C, T, I |?
159+
|CloudWatch Log Group ? |CreateLogGroup |C, T, I |?
160+
|EBS Volume |CreateVolume |C, T, I |Yes
161+
|EC2 AMI w/Snapshot \* |CreateImage |C, T, I |Yes
162+
|EC2 AMI w/Snapshot \* |CopyImage |C, T, I |Yes
163+
|EC2 AMI \* |RegisterImage |C, T, I |Yes
164+
|EC2 Customer Gateway ? |CreateCustomerGateway |C, T, I |?
165+
|EC2 DHCP Options ? |CreateDhcpOptions |C, T, I |?
166+
|EC2 Elastic IP |AllocateAddress |C, T, I |Yes
167+
|EC2 ENI |CreateNetworkInterface|C, T, I |Yes
168+
|EC2 Instance w/ENI & Volume|RunInstances |C, T, I |Yes
169+
|EC2/VPC Security Group |CreateSecurityGroup |C, T, I |Yes
170+
|EC2 Snapshot \* |CreateSnapshot |C, T, I |Yes
171+
|EC2 Snapshot \* |CopySnapshot |C, T, I |Yes
172+
|EC2 Snapshot \* |ImportSnapshot |C, T, I |Yes
173+
|Elastic LB (v1 & v2) |CreateLoadBalancer |C, T, I |No
174+
|EMR Cluster |RunJobFlow |C, T, I |No
175+
|IAM Role |CreateRole |C, T, I |?
176+
|IAM User |CreateUser |C, T, I |?
177+
|Lambda Function ? |CreateFunction20150331|C, T, I |?
178+
|Lambda Function ? |CreateFunction20141111|C, T, I |?
179+
|OpsWorks Stack |CreateStack |C |No
180+
|OpsWorks Clone Stack * |CloneStack |C |No
181+
|OpsWorks Instances w/ENI & Vol|RunInstances |C, T, I |Yes
182+
|RDS Instance |CreateDBInstance |C, T, I |No
183+
|S3 Bucket |CreateBucket |C, T, I |No
184+
|NAT Gateway |CreateNatGateway |C, T, I |Yes
185+
|VPC |CreateVpc |C, T, I |Yes
186+
|VPC Internet Gateway |CreateInternetGateway |C, T, I |Yes
187+
|VPC Network ACL |CreateNetworkAcl |C, T, I |Yes
188+
|VPC Peering Connection |CreateVpcPeeringConnection|C, T, I |Yes
189+
|VPC Route Table |CreateRouteTable |C, T, I |Yes
190+
|VPC Subnet |CreateSubnet |C, T, I |Yes
191+
|VPN Connection |CreateVpnConnection |C, T, I |Yes
192+
|VPN Gateway ? |CreateVpnGateway |C, T, I |?
186193
_*=not tested by the test suite_
187194

188195

‎cloud_formation/event_multi_region_template/autotag_event_collector-template.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,13 @@
2626
"datapipeline.amazonaws.com",
2727
"dynamodb.amazonaws.com",
2828
"ec2.amazonaws.com",
29+
"events.amazonaws.com",
2930
"elasticloadbalancing.amazonaws.com",
3031
"elasticmapreduce.amazonaws.com",
3132
"iam.amazonaws.com",
33+
"lambda.amazonaws.com",
34+
"logs.amazonaws.com",
35+
"monitoring.amazonaws.com",
3236
"opsworks.amazonaws.com",
3337
"rds.amazonaws.com",
3438
"s3.amazonaws.com"
@@ -40,10 +44,15 @@
4044
"CopySnapshot",
4145
"CreateAutoScalingGroup",
4246
"CreateBucket",
47+
"CreateCustomerGateway",
4348
"CreateDBInstance",
49+
"CreateDhcpOptions",
50+
"CreateFunction20150331",
51+
"CreateFunction20141111",
4452
"CreateImage",
4553
"CreateInternetGateway",
4654
"CreateLoadBalancer",
55+
"CreateLogGroup",
4756
"CreateNatGateway",
4857
"CreateNetworkAcl",
4958
"CreateNetworkInterface",
@@ -59,8 +68,11 @@
5968
"CreateVolume",
6069
"CreateVpc",
6170
"CreateVpnConnection",
71+
"CreateVpnGateway",
6272
"CreateVpcPeeringConnection",
6373
"ImportSnapshot",
74+
"PutMetricAlarm",
75+
"PutRule",
6476
"RegisterImage",
6577
"RunInstances",
6678
"RunJobFlow"

‎cloud_formation/event_multi_region_template/autotag_event_main-template.json‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -244,22 +244,27 @@
244244
"autoscaling:DescribeAutoScalingGroups",
245245
"autoscaling:DescribeAutoScalingInstances",
246246
"autoscaling:DescribeTags",
247+
"cloudwatch:TagResource",
247248
"datapipeline:AddTags",
248249
"dynamodb:ListTagsOfResource",
249250
"dynamodb:TagResource",
250251
"ec2:CreateTags",
251252
"ec2:DescribeInstances",
252253
"ec2:DescribeSnapshots",
254+
"events:TagResource",
253255
"elasticloadbalancing:AddTags",
254256
"elasticmapreduce:AddTags",
257+
"iam:TagRole",
258+
"iam:TagUser",
259+
"lambda:TagResource",
260+
"logs:TagLogGroup",
255261
"opsworks:DescribeInstances",
256262
"opsworks:DescribeStacks",
257263
"opsworks:ListTags",
258264
"opsworks:TagResource",
259265
"rds:AddTagsToResource",
260266
"s3:GetBucketTagging",
261-
"s3:PutBucketTagging",
262-
"iam:Tag*"
267+
"s3:PutBucketTagging"
263268
],
264269
"Resource": [
265270
"*"

‎cloud_formation/event_multi_region_template/autotag_event_main-template.rb‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -152,22 +152,26 @@
152152
autoscaling:DescribeAutoScalingGroups
153153
autoscaling:DescribeAutoScalingInstances
154154
autoscaling:DescribeTags
155+
cloudwatch:TagResource
155156
datapipeline:AddTags
156157
dynamodb:ListTagsOfResource
157158
dynamodb:TagResource
158159
ec2:CreateTags
159160
ec2:DescribeInstances
160161
ec2:DescribeSnapshots
162+
events:TagResource
161163
elasticloadbalancing:AddTags
162164
elasticmapreduce:AddTags
165+
iam:TagRole
166+
iam:TagUser
167+
lambda:TagResource
163168
opsworks:DescribeInstances
164169
opsworks:DescribeStacks
165170
opsworks:ListTags
166171
opsworks:TagResource
167172
rds:AddTagsToResource
168173
s3:GetBucketTagging
169174
s3:PutBucketTagging
170-
iam:Tag*
171175
],
172176
Resource: ['*']
173177
}

‎cloud_formation/event_single_region_template/autotag_event-template.json‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -173,22 +173,26 @@
173173
"autoscaling:DescribeAutoScalingGroups",
174174
"autoscaling:DescribeAutoScalingInstances",
175175
"autoscaling:DescribeTags",
176+
"cloudwatch:TagResource",
176177
"datapipeline:AddTags",
177178
"dynamodb:ListTagsOfResource",
178179
"dynamodb:TagResource",
179180
"ec2:CreateTags",
180181
"ec2:DescribeInstances",
181182
"ec2:DescribeSnapshots",
183+
"events:TagResource",
182184
"elasticloadbalancing:AddTags",
183185
"elasticmapreduce:AddTags",
186+
"iam:TagRole",
187+
"iam:TagUser",
188+
"lambda:TagResource",
184189
"rds:AddTagsToResource",
185190
"opsworks:DescribeInstances",
186191
"opsworks:DescribeStacks",
187192
"opsworks:ListTags",
188193
"opsworks:TagResource",
189194
"s3:GetBucketTagging",
190-
"s3:PutBucketTagging",
191-
"iam:Tag*"
195+
"s3:PutBucketTagging"
192196
],
193197
"Resource": [ "*" ]
194198
}
@@ -222,9 +226,13 @@
222226
"datapipeline.amazonaws.com",
223227
"dynamodb.amazonaws.com",
224228
"ec2.amazonaws.com",
229+
"events.amazonaws.com",
225230
"elasticloadbalancing.amazonaws.com",
226231
"elasticmapreduce.amazonaws.com",
227232
"iam.amazonaws.com",
233+
"lambda.amazonaws.com",
234+
"logs.amazonaws.com",
235+
"monitoring.amazonaws.com",
228236
"opsworks.amazonaws.com",
229237
"rds.amazonaws.com",
230238
"s3.amazonaws.com"
@@ -236,10 +244,15 @@
236244
"CopySnapshot",
237245
"CreateAutoScalingGroup",
238246
"CreateBucket",
247+
"CreateCustomerGateway",
239248
"CreateDBInstance",
249+
"CreateDhcpOptions",
250+
"CreateFunction20150331",
251+
"CreateFunction20141111",
240252
"CreateImage",
241253
"CreateInternetGateway",
242254
"CreateLoadBalancer",
255+
"CreateLogGroup",
243256
"CreateNatGateway",
244257
"CreateNetworkAcl",
245258
"CreateNetworkInterface",
@@ -255,8 +268,11 @@
255268
"CreateVolume",
256269
"CreateVpc",
257270
"CreateVpnConnection",
271+
"CreateVpnGateway",
258272
"CreateVpcPeeringConnection",
259273
"ImportSnapshot",
274+
"PutMetricAlarm",
275+
"PutRule",
260276
"RegisterImage",
261277
"RunInstances",
262278
"RunJobFlow"

‎src/autotag_event.js‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,11 +31,19 @@ export const handler = async (cloudtrailEvent, context) => {
3131
AwsCloudTrailEventListener.NETWORK_ACL.name,
3232
AwsCloudTrailEventListener.ROUTE_TABLE.name,
3333
AwsCloudTrailEventListener.VPC_PEERING.name,
34-
AwsCloudTrailEventListener.VPN.name,
34+
AwsCloudTrailEventListener.VPN_CONNECTION.name,
35+
AwsCloudTrailEventListener.VPN_GATEWAY.name,
3536
AwsCloudTrailEventListener.OPS_WORKS.name,
3637
AwsCloudTrailEventListener.OPS_WORKS_CLONE.name,
3738
AwsCloudTrailEventListener.IAM_USER.name,
38-
AwsCloudTrailEventListener.IAM_ROLE.name
39+
AwsCloudTrailEventListener.IAM_ROLE.name,
40+
AwsCloudTrailEventListener.CUSTOMER_GATEWAY.name,
41+
AwsCloudTrailEventListener.DHCP_OPTIONS.name,
42+
AwsCloudTrailEventListener.LAMBDA_FUNCTION_2015.name,
43+
AwsCloudTrailEventListener.LAMBDA_FUNCTION_2014.name,
44+
AwsCloudTrailEventListener.CLOUDWATCH_ALARM.name,
45+
AwsCloudTrailEventListener.CLOUDWATCH_EVENTS_RULE.name,
46+
AwsCloudTrailEventListener.CLOUDWATCH_LOG_GROUP.name
3947
];
4048

4149
const listener = new AwsCloudTrailEventListener(cloudtrailEvent, context, enabledListeners);

‎src/autotag_factory.js‎

Lines changed: 34 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,17 @@ import AutotagNATGatewayWorker from './workers/autotag_nat_gateway_worker';
2222
import AutotagNetworkACLWorker from './workers/autotag_network_acl_worker';
2323
import AutotagRouteTableWorker from './workers/autotag_route_table_worker';
2424
import AutotagVPCPeeringWorker from './workers/autotag_vpc_peering_worker';
25-
import AutotagVPNWorker from './workers/autotag_vpn_worker';
25+
import AutotagVPNConnectionWorker from './workers/autotag_vpn_connection_worker';
26+
import AutotagVPNGatewayWorker from './workers/autotag_vpn_gateway_worker';
2627
import AutotagOpsworksWorker from './workers/autotag_opsworks_worker';
2728
import AutotagIAMUserWorker from './workers/autotag_iam_user_worker';
2829
import AutotagIAMRoleWorker from './workers/autotag_iam_role_worker';
30+
import AutotagCustomerGatewayWorker from './workers/autotag_customer_gateway_worker';
31+
import AutotagDhcpOptionsWorker from './workers/autotag_dhcp_options_worker';
32+
import AutotagLambdaFunctionWorker from './workers/autotag_lambda_function_worker';
33+
import AutotagCloudwatchAlarmWorker from './workers/autotag_cw_alarm_worker';
34+
import AutotagCloudwatchEventsRuleWorker from './workers/autotag_cw_events_rule_worker';
35+
import AutotagCloudwatchLogGroupWorker from './workers/autotag_cw_loggroup_worker';
2936
import CONFIG from './cloud_trail_event_config';
3037

3138
const AutotagFactory = {
@@ -117,8 +124,11 @@ const AutotagFactory = {
117124
case CONFIG.VPC_PEERING.name:
118125
return new AutotagVPCPeeringWorker(event, s3Region);
119126

120-
case CONFIG.VPN.name:
121-
return new AutotagVPNWorker(event, s3Region);
127+
case CONFIG.VPN_CONNECTION.name:
128+
return new AutotagVPNConnectionWorker(event, s3Region);
129+
130+
case CONFIG.VPN_GATEWAY.name:
131+
return new AutotagVPNGatewayWorker(event, s3Region);
122132

123133
case CONFIG.OPS_WORKS.name:
124134
return new AutotagOpsworksWorker(event, s3Region);
@@ -132,6 +142,27 @@ const AutotagFactory = {
132142
case CONFIG.IAM_ROLE.name:
133143
return new AutotagIAMRoleWorker(event, s3Region);
134144

145+
case CONFIG.CUSTOMER_GATEWAY.name:
146+
return new AutotagCustomerGatewayWorker(event, s3Region);
147+
148+
case CONFIG.DHCP_OPTIONS.name:
149+
return new AutotagDhcpOptionsWorker(event, s3Region);
150+
151+
case CONFIG.LAMBDA_FUNCTION_2015.name:
152+
return new AutotagLambdaFunctionWorker(event, s3Region);
153+
154+
case CONFIG.LAMBDA_FUNCTION_2014.name:
155+
return new AutotagLambdaFunctionWorker(event, s3Region);
156+
157+
case CONFIG.CLOUDWATCH_ALARM.name:
158+
return new AutotagCloudwatchAlarmWorker(event, s3Region);
159+
160+
case CONFIG.CLOUDWATCH_EVENTS_RULE.name:
161+
return new AutotagCloudwatchEventsRuleWorker(event, s3Region);
162+
163+
case CONFIG.CLOUDWATCH_LOG_GROUP.name:
164+
return new AutotagCloudwatchLogGroupWorker(event, s3Region);
165+
135166
// Default: worker that does nothing
136167
default:
137168
return new AutotagDefaultWorker(event, s3Region);

‎src/autotag_log.js‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,11 +31,20 @@ export const handler = async (cloudtrailEvent, context) => {
3131
AwsCloudTrailLogListener.NETWORK_ACL.name,
3232
AwsCloudTrailLogListener.ROUTE_TABLE.name,
3333
AwsCloudTrailLogListener.VPC_PEERING.name,
34-
AwsCloudTrailLogListener.VPN.name,
34+
AwsCloudTrailLogListener.VPN_CONNECTION.name,
35+
AwsCloudTrailLogListener.VPN_GATEWAY.name,
3536
AwsCloudTrailLogListener.OPS_WORKS.name,
3637
AwsCloudTrailLogListener.OPS_WORKS_CLONE.name,
3738
AwsCloudTrailLogListener.IAM_USER.name,
38-
AwsCloudTrailLogListener.IAM_ROLE.name
39+
AwsCloudTrailLogListener.IAM_ROLE.name,
40+
AwsCloudTrailLogListener.CUSTOMER_GATEWAY.name,
41+
AwsCloudTrailLogListener.DHCP_OPTIONS.name,
42+
AwsCloudTrailLogListener.LAMBDA_FUNCTION_2015.name,
43+
AwsCloudTrailLogListener.LAMBDA_FUNCTION_2014.name,
44+
AwsCloudTrailLogListener.CLOUDWATCH_ALARM.name,
45+
AwsCloudTrailLogListener.CLOUDWATCH_EVENTS_RULE.name,
46+
AwsCloudTrailLogListener.CLOUDWATCH_LOG_GROUP.name
47+
3948
];
4049

4150
const listener = new AwsCloudTrailLogListener(cloudtrailEvent, context, enabledListeners);

0 commit comments

Comments
 (0)