[Asset Inventory][AWS & Azure] Support organization account deployment type #2591
Conversation
|
This pull request does not have a backport label. Could you fix it @kubasobon? 🙏
|
| @@ -0,0 +1,444 @@ | |||
| { | |||
There was a problem hiding this comment.
Isn't arm for Azure? I had understood this PR is for AWS only
There was a problem hiding this comment.
This comment actually goes for this whole folder.
There was a problem hiding this comment.
Updated the description and title. Azure needed me to just clone the ARM templates.
| @@ -0,0 +1,209 @@ | |||
| // Licensed to Elasticsearch B.V. under one or more contributor | |||
There was a problem hiding this comment.
Do I understand correctly that running this will directly start a new stack?
Is this dev only? That's not how we use on pro, right?
There was a problem hiding this comment.
Yeah, this is a copy of CSPM devtools. Just like we have just deploy-cloudformation, we now get just deploy-asset-inventory-cloudformation. Not used in CI, just by developers.
|
|
||
| const ( | ||
| rootRole = "cloudbeat-asset-inventory-root" | ||
| memberRole = "cloudbeat-asset-inventory-securityaudit" |
There was a problem hiding this comment.
Is this role expected to be created by the cloud formation?
There was a problem hiding this comment.
Yes. If account_type is set to organization-account we assume the deployment was done via updated CloudFormation or the proper roles have been created manually. Either way, we assume the roles are there.
kubasobon
changed the title
|
@romulets Please take another look |
Summary of your changes
AWS: Clones CloudFormation templates for Asset Inventory and enables it to work in Organization mode.
Azure: Clones ARM templates.
Screenshot/Data
Kibana showing data from multiple accounts in the organization; Please note the absence of "Sandbox" account from "test-organization" OU
Related Issues
Fixes https://github.com/elastic/security-team/issues/10606
Checklist