SAAS-29781 - Split CSPM Role to Registry and Serverless Roles (Single/Org)

[idanch4]

Note

Introduce Registry (ECR) and Serverless (Lambda) scanning with separate IAM roles, end-to-end wiring, validations, and docs updates.

• Terraform modules:
  • Single/Organization:
    • Add inputs/toggles: registry_scanning_deployment, serverless_scanning_deployment, custom_registry_scanning_role_name, custom_serverless_scanning_role_name, and pass through to submodules.
    • Organization StackSet parameters include BaseCSPM, GroupId, and new scanning toggles/role names.
  • Lambda (single):
    • Create new IAM roles: aws_iam_role.registry_scanning_role and aws_iam_role.serverless_scanning_role (conditional on toggles).
    • Expose outputs: registry_scanning_role_arn, serverless_scanning_role_arn.
  • Trigger (single):
    • Extend trigger-aws.py and trigger.tf to send registry_scanning_deployment, serverless_scanning_deployment, and role ARNs in discovery payload.
• Variables/validations:
  • Root and organization: add validations for volume_scanning_deployment and new toggles; define custom role name vars with length/charset checks; add aqua_cspm_group_id.
• Outputs:
  • Surface new role ARNs from modules/single.
• Docs:
  • README inputs updated with new variables and toggles.

^{Written by Cursor Bugbot for commit 264cd92. This will update automatically on new commits. Configure here.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
0 out of 2 committers have signed the CLA.

❌ Idan Chernihov
❌ github-actions[bot]

---

Idan Chernihov seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

Terraform Validation Results:

Terraform Format Check ✅
Terraform Init ✅
Terraform Validate ✅
Terraform Test ✅
TFLint Check ✅

Pusher: @idanch4, Action: pull_request, Workflow: PR Checks