elastic / cloudbeat / 41634405209

63%

main: 76%

Build Type

push

github

Committed by web-flow

Commit Message

fix(aws): use the partition of the caller identity in organization mode (GovCloud, CSPM, CAD) (#9230)

### Summary of your changes

Organization mode fails in AWS GovCloud for CSPM and CAD. Cloudbeat
writes the role ARNs with the commercial partition (`arn:aws:iam::`). In
GovCloud, the role ARNs must start with `arn:aws-us-gov:iam::`. STS
cannot assume a role in a different partition. Thus, the `AssumeRole`
call fails for the root role and for each member role.

This PR gets the partition from the ARN of the caller identity
(`GetCallerIdentity`). Cloudbeat then uses this partition for all role
ARNs in organization mode.

Changes:

- `awslib/partition.go` (new file): `PartitionFromARN` and `IAMRoleARN`.
These functions replace the two copies of `fmtIAMRole`. If the ARN is
empty or not valid, `PartitionFromARN` returns `aws`. Thus, the behavior
in the commercial partition does not change. `PartitionFromRegion` uses
the same partition constants (new constant `ChinaPartition`).
- `cloud.Identity`: new field `Partition`. The AWS providers always set
it.
- `awslib.IdentityProvider.GetIdentity`: sets `Partition` from the
caller ARN.
- `awslib.AccountProvider.ListAccounts`: sets `Partition` of each member
account from the ARN of the account in the Organizations `ListAccounts`
response.
- `awslib/govcloud.go` (new file): `WithGovCloudFallback`. If the
identity call fails and the configuration has no default region, it
tries again in `us-gov-east-1`. If the second call also fails, the error
contains the errors of the two calls. CSPM (`benchmark/aws.go`,
`benchmark/aws_org.go`) and CAD use this helper.
- `iam.Provider`: the ARN of the AWS managed policy `AWSSupportAccess`
uses the partition of the region
(`arn:aws-us-gov:iam::aws:policy/AWSSupportAccess` in GovCloud). Before,
`GetPolicy` failed in GovCloud, and `GetPolicies` returned no policies.
- CSPM (`benchmark/aws_org.go`):
- The ARN of the `cloudbeat-root` role uses the partition of the caller
ARN.
- The A... (continued)

Coverage Stats

50 of 75 new or added lines in 10 files covered. (66.67%)

1 existing line in 1 file now uncovered.

7437 of 11846 relevant lines covered (62.78%)

10.11 hits per line