diff --git a/aws_quickstart/datadog_agentless_scanning.yaml b/aws_quickstart/datadog_agentless_scanning.yaml index 0577376..81bcfe0 100644 --- a/aws_quickstart/datadog_agentless_scanning.yaml +++ b/aws_quickstart/datadog_agentless_scanning.yaml @@ -22,7 +22,7 @@ Parameters: - true - false Description: >- - Enable Agentless Scanning of host vulnerabilities. "CloudSecurityPostureManagement" must be set to 'true'. + Enable Agentless Scanning of host vulnerabilities. Default: false AgentlessContainerScanning: @@ -31,7 +31,7 @@ Parameters: - true - false Description: >- - Enable Agentless Scanning of container vulnerabilities. "CloudSecurityPostureManagement" must be set to 'true'. + Enable Agentless Scanning of container vulnerabilities. Default: false AgentlessLambdaScanning: @@ -40,7 +40,7 @@ Parameters: - true - false Description: >- - Enable Agentless Scanning of Lambda vulnerabilities. "CloudSecurityPostureManagement" must be set to 'true'. + Enable Agentless Scanning of Lambda vulnerabilities. Default: false AgentlessSensitiveDataScanning: @@ -49,7 +49,7 @@ Parameters: - true - false Description: >- - Enable Agentless Scanning of datastores (S3 buckets). "CloudSecurityPostureManagement" must be set to 'true'. + Enable Agentless Scanning of datastores (S3 buckets). Default: false DatadogAPIKeySecretArn: diff --git a/aws_quickstart/main_extended.yaml b/aws_quickstart/main_extended.yaml index 7420fc5..7e0cf22 100644 --- a/aws_quickstart/main_extended.yaml +++ b/aws_quickstart/main_extended.yaml @@ -92,7 +92,7 @@ Parameters: - true - false Description: >- - Enable Agentless Scanning of host vulnerabilities. "CloudSecurityPostureManagement" must be set to 'true'. + Enable Agentless Scanning of host vulnerabilities. Default: false AgentlessContainerScanning: Type: String @@ -100,7 +100,7 @@ Parameters: - true - false Description: >- - Enable Agentless Scanning of container vulnerabilities. "CloudSecurityPostureManagement" must be set to 'true'. + Enable Agentless Scanning of container vulnerabilities. Default: false AgentlessLambdaScanning: Type: String @@ -108,7 +108,7 @@ Parameters: - true - false Description: >- - Enable Agentless Scanning of Lambda vulnerabilities. "CloudSecurityPostureManagement" must be set to 'true'. + Enable Agentless Scanning of Lambda vulnerabilities. Default: false AgentlessSensitiveDataScanning: Type: String @@ -116,10 +116,10 @@ Parameters: - true - false Description: >- - Enable Agentless Scanning of datastores (S3 buckets). "CloudSecurityPostureManagement" must be set to 'true'. + Enable Agentless Scanning of datastores (S3 buckets). Default: false Rules: - ResourceCollectionValidState: + CSPMResourceCollectionValidState: Assertions: - Assert: Fn::Not: @@ -131,6 +131,28 @@ Rules: - Ref: CloudSecurityPostureManagement - 'true' AssertDescription: CloudSecurityPostureManagement requires ResourceCollection, must enable ResourceCollection + AgentlessResourceCollectionValidState: + Assertions: + - Assert: + Fn::Not: + - Fn::And: + - Fn::Equals: + - Ref: DisableResourceCollection + - 'true' + - Fn::Or: + - Fn::Equals: + - Ref: AgentlessHostScanning + - 'true' + - Fn::Equals: + - Ref: AgentlessContainerScanning + - 'true' + - Fn::Equals: + - Ref: AgentlessLambdaScanning + - 'true' + - Fn::Equals: + - Ref: AgentlessSensitiveDataScanning + - 'true' + AssertDescription: Agentless Scanning options require ResourceCollection, must enable ResourceCollection Conditions: InstallForwarder: Fn::Equals: @@ -146,9 +168,6 @@ Conditions: - Fn::Equals: - !Ref DatadogSite - ddog-gov.com - - Fn::Equals: - - !Ref CloudSecurityPostureManagement - - true - Fn::Or: - Fn::Equals: - !Ref AgentlessHostScanning diff --git a/aws_quickstart/taskcat/.taskcat_extended.yml b/aws_quickstart/taskcat/.taskcat_extended.yml index 6983d8f..2653500 100644 --- a/aws_quickstart/taskcat/.taskcat_extended.yml +++ b/aws_quickstart/taskcat/.taskcat_extended.yml @@ -18,3 +18,7 @@ tests: InstallLambdaLogForwarder: "true" DisableMetricCollection: "false" CloudSecurityPostureManagement: "false" + AgentlessHostScanning: "true" + AgentlessContainerScanning: "true" + AgentlessLambdaScanning: "true" + AgentlessSensitiveDataScanning: "true" \ No newline at end of file diff --git a/aws_quickstart/version.txt b/aws_quickstart/version.txt index 0ac852d..f3b15f3 100644 --- a/aws_quickstart/version.txt +++ b/aws_quickstart/version.txt @@ -1 +1 @@ -v2.0.1 +v2.0.2