Skip to content

Commit 42eb6e8

Browse files
Nadia-JSchNadia-JSch
authored
Merge pull request #749 from ritza-co/code-samples
add expandable code blocks
2 parents d1e16d8 + 24615c3 commit 42eb6e8

1 file changed

Lines changed: 162 additions & 142 deletions

File tree

‎docs/auto-discovery/cloud-auto-discovery/aws-autodiscovery.mdx‎

Lines changed: 162 additions & 142 deletions
Original file line numberDiff line numberDiff line change
@@ -150,87 +150,91 @@ Note that some Discovery items require enabling the feature and cannot be discov
150150

151151
**Example IAM Policy** (except for the K8s cluster endpoints, since it is controlled by K8s RBAC)
152152

153-
```
154-
{
155-
"Version": "2012-10-17",
156-
"Statement": [
157-
{
158-
"Effect": "Allow",
159-
"Action": [
160-
"acm:DescribeCertificate",
161-
"acm:List*",
162-
"apigateway:GET",
163-
"autoscaling:Describe*",
164-
"cloudfront:ListDistributions",
165-
"cloudfront:ListTagsForResource",
166-
"cloudsearch:DescribeDomains",
167-
"cloudwatch:Describe*",
168-
"cloudwatch:GetMetricData",
169-
"cloudwatch:GetMetricStatistics",
170-
"cloudwatch:ListMetrics",
171-
"config:SelectResourceConfig",
172-
"dynamodb:DescribeGlobalTable",
173-
"dynamodb:DescribeLimits",
174-
"dynamodb:DescribeTable",
175-
"dynamodb:ListGlobalTables",
176-
"dynamodb:ListTables",
177-
"ec2:Describe*",
178-
"eks:DescribeCluster",
179-
"eks:DescribeNodegroup",
180-
"eks:DescribeUpdate",
181-
"eks:ListClusters",
182-
"eks:ListNodegroups",
183-
"eks:ListUpdates",
184-
"elasticache:Describe*",
185-
"elasticfilesystem:DescribeAccessPoints",
186-
"elasticfilesystem:DescribeAccountPreferences",
187-
"elasticfilesystem:DescribeFileSystems",
188-
"elasticfilesystem:DescribeMountTargets",
189-
"elasticloadbalancing:Describe*",
190-
"iam:ListAccountAliases",
191-
"kms:DescribeKey",
192-
"kms:ListKeys",
193-
"kms:ListResourceTags",
194-
"lambda:GetAccountSettings",
195-
"lambda:GetFunction",
196-
"lambda:GetPolicy",
197-
"lambda:List*",
198-
"logs:DescribeLogStreams",
199-
"logs:GetLogEvents",
200-
"organizations:DescribeAccount",
201-
"organizations:ListAccountsForParent",
202-
"organizations:ListOrganizationalUnitsForParent",
203-
"organizations:ListRoots",
204-
"organizations:ListTagsForResource",
205-
"rds:Describe*",
206-
"rds:ListTagsForResource",
207-
"redshift:DescribeClusters",
208-
"redshift:DescribeReservedNodes",
209-
"route53:ListHostedZones",
210-
"route53:ListResourceRecordSets",
211-
"route53:ListTagsForResource",
212-
"route53domains:ListDomains",
213-
"s3:GetAccessPointPolicyStatus",
214-
"s3:GetBucketAcl",
215-
"s3:GetBucketLocation",
216-
"s3:GetBucketPolicyStatus",
217-
"s3:GetBucketPublicAccessBlock",
218-
"s3:GetBucketTagging",
219-
"s3:GetEncryptionConfiguration",
220-
"s3:ListAccessPoints",
221-
"s3:ListAllMyBuckets",
222-
"sns:GetTopicAttributes",
223-
"sns:ListTagsForResource",
224-
"sns:ListTopics",
225-
"sqs:GetQueueAttributes",
226-
"sqs:ListQueues",
227-
"sqs:ListQueueTags"
228-
],
229-
"Resource": "*"
230-
}
231-
]
232-
}
233-
```
153+
<details>
154+
<summary>Click to expand code example</summary>
155+
156+
```js
157+
{
158+
"Version": "2012-10-17",
159+
"Statement": [
160+
{
161+
"Effect": "Allow",
162+
"Action": [
163+
"acm:DescribeCertificate",
164+
"acm:List*",
165+
"apigateway:GET",
166+
"autoscaling:Describe*",
167+
"cloudfront:ListDistributions",
168+
"cloudfront:ListTagsForResource",
169+
"cloudsearch:DescribeDomains",
170+
"cloudwatch:Describe*",
171+
"cloudwatch:GetMetricData",
172+
"cloudwatch:GetMetricStatistics",
173+
"cloudwatch:ListMetrics",
174+
"config:SelectResourceConfig",
175+
"dynamodb:DescribeGlobalTable",
176+
"dynamodb:DescribeLimits",
177+
"dynamodb:DescribeTable",
178+
"dynamodb:ListGlobalTables",
179+
"dynamodb:ListTables",
180+
"ec2:Describe*",
181+
"eks:DescribeCluster",
182+
"eks:DescribeNodegroup",
183+
"eks:DescribeUpdate",
184+
"eks:ListClusters",
185+
"eks:ListNodegroups",
186+
"eks:ListUpdates",
187+
"elasticache:Describe*",
188+
"elasticfilesystem:DescribeAccessPoints",
189+
"elasticfilesystem:DescribeAccountPreferences",
190+
"elasticfilesystem:DescribeFileSystems",
191+
"elasticfilesystem:DescribeMountTargets",
192+
"elasticloadbalancing:Describe*",
193+
"iam:ListAccountAliases",
194+
"kms:DescribeKey",
195+
"kms:ListKeys",
196+
"kms:ListResourceTags",
197+
"lambda:GetAccountSettings",
198+
"lambda:GetFunction",
199+
"lambda:GetPolicy",
200+
"lambda:List*",
201+
"logs:DescribeLogStreams",
202+
"logs:GetLogEvents",
203+
"organizations:DescribeAccount",
204+
"organizations:ListAccountsForParent",
205+
"organizations:ListOrganizationalUnitsForParent",
206+
"organizations:ListRoots",
207+
"organizations:ListTagsForResource",
208+
"rds:Describe*",
209+
"rds:ListTagsForResource",
210+
"redshift:DescribeClusters",
211+
"redshift:DescribeReservedNodes",
212+
"route53:ListHostedZones",
213+
"route53:ListResourceRecordSets",
214+
"route53:ListTagsForResource",
215+
"route53domains:ListDomains",
216+
"s3:GetAccessPointPolicyStatus",
217+
"s3:GetBucketAcl",
218+
"s3:GetBucketLocation",
219+
"s3:GetBucketPolicyStatus",
220+
"s3:GetBucketPublicAccessBlock",
221+
"s3:GetBucketTagging",
222+
"s3:GetEncryptionConfiguration",
223+
"s3:ListAccessPoints",
224+
"s3:ListAllMyBuckets",
225+
"sns:GetTopicAttributes",
226+
"sns:ListTagsForResource",
227+
"sns:ListTopics",
228+
"sqs:GetQueueAttributes",
229+
"sqs:ListQueues",
230+
"sqs:ListQueueTags"
231+
],
232+
"Resource": "*"
233+
}
234+
]
235+
}
236+
```
237+
</details>
234238

235239
### AWS Tags
236240

@@ -373,42 +377,17 @@ When **Use Environment Credentials** is enabled, the discovery job can be saved
373377

374378
*Example IAM Policy*
375379

376-
```
377-
{
378-
"Version": "2012-10-17",
379-
"Statement": [
380-
{
381-
"Effect": "Allow",
382-
"Action": [
383-
"sts:assumerole"
384-
],
385-
"Resource": [
386-
"*"
387-
]
388-
}
389-
]
390-
}
391-
```
380+
<details>
381+
<summary>Click to expand code example</summary>
392382

393-
- Option 3: Role Assumption Using Dynamic Account Discovery
394-
395-
This option is good if you want to discover resources in all member accounts without the need to specify individual Account IDs.
396-
397-
**Note:** This requires the associated Remote Collector or Main Appliance to be deployed within the organization's root (management) account.
398-
399-
See: [Setting Up Dynamic Account Discovery Roles](#setting-up-dynamic-account-discovery-roles) for more details on configuring Dynamic Account Discovery.
400-
401-
*Example IAM Policy*
402-
403-
```
383+
```js
404384
{
405385
"Version": "2012-10-17",
406386
"Statement": [
407387
{
408388
"Effect": "Allow",
409389
"Action": [
410-
"sts:assumerole",
411-
"organizations:listaccounts"
390+
"sts:assumerole"
412391
],
413392
"Resource": [
414393
"*"
@@ -417,6 +396,39 @@ When **Use Environment Credentials** is enabled, the discovery job can be saved
417396
]
418397
}
419398
```
399+
</details>
400+
401+
- Option 3: Role Assumption Using Dynamic Account Discovery
402+
403+
This option is good if you want to discover resources in all member accounts without the need to specify individual Account IDs.
404+
405+
**Note:** This requires the associated Remote Collector or Main Appliance to be deployed within the organization's root (management) account.
406+
407+
See: [Setting Up Dynamic Account Discovery Roles](#setting-up-dynamic-account-discovery-roles) for more details on configuring Dynamic Account Discovery.
408+
409+
*Example IAM Policy*
410+
411+
<details>
412+
<summary>Click to expand code example</summary>
413+
414+
```js
415+
{
416+
"Version": "2012-10-17",
417+
"Statement": [
418+
{
419+
"Effect": "Allow",
420+
"Action": [
421+
"sts:assumerole",
422+
"organizations:listaccounts"
423+
],
424+
"Resource": [
425+
"*"
426+
]
427+
}
428+
]
429+
}
430+
```
431+
</details>
420432

421433
When you've confirmed you have the appropriate permission set selected, click **Next**, give the policy a name and description, and click **Create Policy**.
422434

@@ -428,24 +440,28 @@ When **Use Environment Credentials** is enabled, the discovery job can be saved
428440
If you want to do the role preparation via the AWS CLI and not within the AWS Management Console, you can reference the trust policy below:
429441

430442
*Example Trust Policy*
431-
```
432-
{
433-
"Version": "2012-10-17",
434-
"Statement": [
435-
{
436-
"Effect": "Allow",
437-
"Action": [
438-
"sts:AssumeRole"
439-
],
440-
"Principal": {
441-
"Service": [
442-
"ec2.amazonaws.com"
443-
]
444-
}
445-
}
446-
]
447-
}
448-
```
443+
<details>
444+
<summary>Click to expand code example</summary>
445+
446+
```js
447+
{
448+
"Version": "2012-10-17",
449+
"Statement": [
450+
{
451+
"Effect": "Allow",
452+
"Action": [
453+
"sts:AssumeRole"
454+
],
455+
"Principal": {
456+
"Service": [
457+
"ec2.amazonaws.com"
458+
]
459+
}
460+
}
461+
]
462+
}
463+
```
464+
</details>
449465

450466
4. **Attach the role:**
451467
- From the EC2 Instances list page, select the EC2 instance created in Step 1. Then click **Actions > Security > Modify IAM role**.
@@ -461,20 +477,24 @@ When **Use Environment Credentials** is enabled, the discovery job can be saved
461477
Follow Step 3 again but this time select **Custom trust policy** instead of **AWS service**. Copy and paste the trust policy below. At the add permissions screen, search for and select the discovery policy created in the previous step.
462478

463479
*Example Trust Policy*
464-
```
465-
{
466-
"Version": "2012-10-17",
467-
"Statement": [
468-
{
469-
"Effect": "Allow",
470-
"Principal": {
471-
"AWS": "arn:aws:iam::ROOT_ACCOUNT_ID:role/EC2_D42_RC_ROLE"
472-
},
473-
"Action": "sts:AssumeRole"
474-
}
475-
]
476-
}
477-
```
480+
<details>
481+
<summary>Click to expand code example</summary>
482+
483+
```js
484+
{
485+
"Version": "2012-10-17",
486+
"Statement": [
487+
{
488+
"Effect": "Allow",
489+
"Principal": {
490+
"AWS": "arn:aws:iam::ROOT_ACCOUNT_ID:role/EC2_D42_RC_ROLE"
491+
},
492+
"Action": "sts:AssumeRole"
493+
}
494+
]
495+
}
496+
```
497+
</details>
478498

479499
Replace `ROOT_ACCOUNT_ID` and `EC2_D42_RC_ROLE` with your own values.
480500

0 commit comments

Comments
 (0)