Merge pull request #2703 from guardian/pm-fix-guard-duty-ecs-task

Add necessary permissions for guard duty runtime monitoring of ecs tasks

Author: philmcmahon

.changeset/lemon-pans-grab.md

@@ -0,0 +1,5 @@
+---
+"@guardian/cdk": minor
+---
+
+Add required permissions to GuEcsTask pattern for guard duty sidecar container

src/constructs/ecs/__snapshots__/ecs-task.test.ts.snap

@@ -551,6 +551,16 @@ exports[`The GuEcsTask pattern should create the correct resources with lots of
                 ],
               },
             },
+            {
+              "Action": [
+                "ecr:GetAuthorizationToken",
+                "ecr:BatchCheckLayerAvailability",
+                "ecr:GetDownloadUrlForLayer",
+                "ecr:BatchGetImage",
+              ],
+              "Effect": "Allow",
+              "Resource": "694911143906.dkr.ecr.eu-west-1.amazonaws.com/aws-guardduty-agent-fargate",
+            },
           ],
           "Version": "2012-10-17",
         },
@@ -1263,6 +1273,16 @@ exports[`The GuEcsTask pattern should support overriding the subnets used by the
                 ],
               },
             },
+            {
+              "Action": [
+                "ecr:GetAuthorizationToken",
+                "ecr:BatchCheckLayerAvailability",
+                "ecr:GetDownloadUrlForLayer",
+                "ecr:BatchGetImage",
+              ],
+              "Effect": "Allow",
+              "Resource": "694911143906.dkr.ecr.eu-west-1.amazonaws.com/aws-guardduty-agent-fargate",
+            },
           ],
           "Version": "2012-10-17",
         },

src/constructs/ecs/ecs-task.ts

@@ -14,7 +14,7 @@ import {
   TaskDefinition,
 } from "aws-cdk-lib/aws-ecs";
 import type { ContainerDefinition, ContainerInsights, RepositoryImageProps } from "aws-cdk-lib/aws-ecs";
-import type { PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { Topic } from "aws-cdk-lib/aws-sns";
 import { DefinitionBody, IntegrationPattern, JsonPath, StateMachine, Timeout } from "aws-cdk-lib/aws-stepfunctions";
 import type { TaskEnvironmentVariable } from "aws-cdk-lib/aws-stepfunctions-tasks";
@@ -236,6 +236,22 @@ export class GuEcsTask extends Construct {
       taskDefinition.addToTaskRolePolicy(distPolicy);
     }
 
+    // See https://docs.aws.amazon.com/guardduty/latest/ug/prereq-runtime-monitoring-ecs-support.html#before-enable-runtime-monitoring-ecs
+    const guardDutyPolicy = new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: [
+        "ecr:GetAuthorizationToken",
+        "ecr:BatchCheckLayerAvailability",
+        "ecr:GetDownloadUrlForLayer",
+        "ecr:BatchGetImage",
+      ],
+      // See https://docs.aws.amazon.com/guardduty/latest/ug/runtime-monitoring-ecr-repository-gdu-agent.html
+      // note that if you are using a region other than eu-west-1 you'll need to add extra repositories here
+      resources: ["694911143906.dkr.ecr.eu-west-1.amazonaws.com/aws-guardduty-agent-fargate"],
+    });
+
+    taskDefinition.addToExecutionRolePolicy(guardDutyPolicy);
+
     (customTaskPolicies ?? []).forEach((p) => taskDefinition.addToTaskRolePolicy(p));
 
     const task = new EcsRunTask(scope, `${id}-task`, {