diff --git a/DataConnectors/AWS-S3/ConfigAwsS3DataConnectorScripts.zip b/DataConnectors/AWS-S3/ConfigAwsS3DataConnectorScripts.zip index 7a35edfac21..4115b142cee 100644 Binary files a/DataConnectors/AWS-S3/ConfigAwsS3DataConnectorScripts.zip and b/DataConnectors/AWS-S3/ConfigAwsS3DataConnectorScripts.zip differ diff --git a/DataConnectors/AWS-S3/ConfigAwsS3DataConnectorScriptsGov.zip b/DataConnectors/AWS-S3/ConfigAwsS3DataConnectorScriptsGov.zip index 4065d278089..90576377477 100644 Binary files a/DataConnectors/AWS-S3/ConfigAwsS3DataConnectorScriptsGov.zip and b/DataConnectors/AWS-S3/ConfigAwsS3DataConnectorScriptsGov.zip differ diff --git a/DataConnectors/AWS-S3/ConfigCloudTrailDataConnector.ps1 b/DataConnectors/AWS-S3/ConfigCloudTrailDataConnector.ps1 index 4ace555db46..d4299dc49dd 100644 --- a/DataConnectors/AWS-S3/ConfigCloudTrailDataConnector.ps1 +++ b/DataConnectors/AWS-S3/ConfigCloudTrailDataConnector.ps1 @@ -238,9 +238,7 @@ Write-Log -Message "This script creates an Assume Role with minimal permissions Write-ScriptNotes # Add an Identity Provider -if($CloudEnv -eq "Gov"){ - New-OidcProvider -} +New-OidcProvider New-ArnRole Write-Log -Message "Executing: aws iam get-role --role-name $roleName" -LogFileName $LogFileName -Severity Verbose diff --git a/DataConnectors/AWS-S3/ConfigCloudWatchDataConnector.ps1 b/DataConnectors/AWS-S3/ConfigCloudWatchDataConnector.ps1 index e8b591922a6..6eb73d0514f 100644 --- a/DataConnectors/AWS-S3/ConfigCloudWatchDataConnector.ps1 +++ b/DataConnectors/AWS-S3/ConfigCloudWatchDataConnector.ps1 @@ -76,9 +76,7 @@ Write-Log -Message "This script creates an Assume Role with minimal permissions Write-ScriptNotes # Add an Identity Provider -if($CloudEnv -eq "Gov"){ - New-OidcProvider -} +New-OidcProvider New-ArnRole Write-Log -Message "Executing: aws iam get-role --role-name $roleName" -LogFileName $LogFileName -Severity Verbose $roleArnObject = aws iam get-role --role-name $roleName diff --git a/DataConnectors/AWS-S3/ConfigCustomLogDataConnector.ps1 b/DataConnectors/AWS-S3/ConfigCustomLogDataConnector.ps1 index 6d44759a220..8cef508fea0 100644 --- a/DataConnectors/AWS-S3/ConfigCustomLogDataConnector.ps1 +++ b/DataConnectors/AWS-S3/ConfigCustomLogDataConnector.ps1 @@ -8,9 +8,7 @@ Write-Log -Message "This script creates an Assume Role with minimal permissions Write-ScriptNotes # Add an Identity Provider -if($CloudEnv -eq "Gov"){ - New-OidcProvider -} +New-OidcProvider New-ArnRole Write-Log -Message "Executing: aws iam get-role --role-name $roleName" -LogFileName $LogFileName -Severity Verbose $roleArnObject = aws iam get-role --role-name $roleName diff --git a/DataConnectors/AWS-S3/ConfigGuardDutyDataConnector.ps1 b/DataConnectors/AWS-S3/ConfigGuardDutyDataConnector.ps1 index b0b9286ff99..70d0c344b61 100644 --- a/DataConnectors/AWS-S3/ConfigGuardDutyDataConnector.ps1 +++ b/DataConnectors/AWS-S3/ConfigGuardDutyDataConnector.ps1 @@ -274,9 +274,7 @@ Write-Log -Message "This script creates an Assume Role with minimal permissions Write-ScriptNotes # Add an Identity Provider -if($CloudEnv -eq "Gov"){ - New-OidcProvider -} +New-OidcProvider New-ArnRole Write-Log -Message "Executing: aws iam get-role --role-name $roleName" -LogFileName $LogFileName -Severity Verbose $roleArnObject = aws iam get-role --role-name $roleName diff --git a/DataConnectors/AWS-S3/ConfigVpcFlowDataConnector.ps1 b/DataConnectors/AWS-S3/ConfigVpcFlowDataConnector.ps1 index 53b6b9d7fa2..d2e3d7eb404 100644 --- a/DataConnectors/AWS-S3/ConfigVpcFlowDataConnector.ps1 +++ b/DataConnectors/AWS-S3/ConfigVpcFlowDataConnector.ps1 @@ -6,9 +6,7 @@ Write-Log -Message "This script creates an Assume Role with minimal permissions Write-ScriptNotes # Add an Identity Provider -if($CloudEnv -eq "Gov"){ - New-OidcProvider -} +New-OidcProvider # Create new Arn Role New-ArnRole Write-Log -Message "Executing: aws iam get-role --role-name $roleName" -LogFileName $LogFileName -Severity Verbose diff --git a/DataConnectors/AWS-S3/Enviornment/EnviornmentConstants.ps1 b/DataConnectors/AWS-S3/Enviornment/EnviornmentConstants.ps1 index 6a04291d5b0..bb5c60ee9fa 100644 --- a/DataConnectors/AWS-S3/Enviornment/EnviornmentConstants.ps1 +++ b/DataConnectors/AWS-S3/Enviornment/EnviornmentConstants.ps1 @@ -4,7 +4,7 @@ #$script:AwsCloudResource = 'arn:aws-us-gov' -$script:SentinelClientId = 'api://21f935c0-8092-4b62-a772-5a2afd714569' +$script:SentinelClientId = 'api://1462b192-27f7-4cb9-8523-0f4ecb54b47e' $script:SentinelTenantId = '33e01921-4d64-4f8c-a055-5bdaffd5e33d' $script:CloudEnv = 'Com' $script:AwsCloudResource = 'arn:aws' \ No newline at end of file diff --git a/DataConnectors/AWS-S3/Utils/AwsResourceCreator.ps1 b/DataConnectors/AWS-S3/Utils/AwsResourceCreator.ps1 index 67c8b295d08..f126fea9d37 100644 --- a/DataConnectors/AWS-S3/Utils/AwsResourceCreator.ps1 +++ b/DataConnectors/AWS-S3/Utils/AwsResourceCreator.ps1 @@ -80,7 +80,8 @@ function New-ArnRole Set-RetryAction({ $script:roleName = Read-ValidatedHost -Prompt 'Please enter role name. If you have already configured an assume role for Azure Sentinel, use the same role name' - Write-Log -Message "Using role name: $roleName" -LogFileName $LogFileName -Severity Information -Indent 2 + $script:roleName = "OIDC_$roleName" + Write-Log -Message "Using role name: $roleName with OIDC prefix because OpenID Connect authentication is being used." -LogFileName $LogFileName -Severity Information -Indent 2 # Determine if this role already exists before continuing Write-Log "Executing: aws iam get-role --role-name $roleName 2>&1| Out-Null" -LogFileName $LogFileName -Severity Verbose @@ -96,16 +97,9 @@ function New-ArnRole $workspaceId = Read-ValidatedHost -Prompt "Please enter your Azure Sentinel External ID (Workspace ID)" Write-Log "Using Azure Sentinel Workspace ID: $workspaceId" -LogFileName $LogFileName -Severity Information -Indent 2 - if($CloudEnv -eq "Gov") - { - - $CustomerAWSAccountId = aws sts get-caller-identity --query "Account" --output text - $rolePolicy = Get-OIDCRoleArnPolicy -WorkspaceId $workspaceId -CustomerAWSAccountId $CustomerAWSAccountId - } - else - { - $rolePolicy = Get-RoleArnPolicy -WorkspaceId $workspaceId - } + $CustomerAWSAccountId = aws sts get-caller-identity --query "Account" --output text + $rolePolicy = Get-OIDCRoleArnPolicy -WorkspaceId $workspaceId -CustomerAWSAccountId $CustomerAWSAccountId + # $rolePolicy = Get-RoleArnPolicy -WorkspaceId $workspaceId Write-Log "Executing: aws iam create-role --role-name $roleName --assume-role-policy-document $rolePolicy --tags $(Get-SentinelTagInJsonFormat) 2>&1" -LogFileName $LogFileName -Severity Verbose $tempForOutput = aws iam create-role --role-name $roleName --assume-role-policy-document $rolePolicy --tags [$(Get-SentinelTagInJsonFormat)] 2>&1