Skip to content

Commit 86cd1aa

Browse files
tas50claude
tas50
and
claude
authored
✨ Add config aggregators, ECR repo policy, and EC2 launch templates (#7052)
* ✨ Add aws.config.aggregators, aws.ecr.repository.policy, and aws.ec2.launchTemplates Add three new AWS provider resources/fields to unblock security checks: - aws.config.aggregators: List configuration aggregators with typed sub-resources for account and organization aggregation sources, including IAM role references on org sources. - aws.ecr.repository.policy: Lazy-loaded repository access policy (parsed JSON dict) on private ECR repositories. Returns null for public repos or when no policy is set. - aws.ec2.launchTemplates: New launch template resource with lazy-loaded userData field that base64-decodes the default version's user data, enabling secret scanning in launch template configurations. All implementations follow existing patterns: jobpool for multi-region listing, access-denied graceful degradation, proper StateIsNull handling for nullable resource returns, and lazy loading for expensive fields. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * 🧹 Bump AWS provider to 13.5.0 and add launchtemplate to spell check Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent f062a5c commit 86cd1aa

File tree

9 files changed

+1040
-3
lines changed

9 files changed

+1040
-3
lines changed

‎.github/actions/spelling/expect.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,7 @@ junos
126126
kqueue
127127
KSK
128128
labelmatchstatement
129+
launchtemplate
129130
lfs
130131
limitrange
131132
linuxefi

‎providers/aws/config/config.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ import (
1414
var Config = plugin.Provider{
1515
Name: "aws",
1616
ID: "go.mondoo.com/cnquery/v9/providers/aws",
17-
Version: "13.4.0",
17+
Version: "13.5.0",
1818
ConnectionTypes: []string{provider.DefaultConnectionType, string(awsec2ebsconn.EBSConnectionType)},
1919
Connectors: []plugin.Connector{
2020
{

‎providers/aws/resources/aws.lr‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5111,6 +5111,8 @@ private aws.ecr.repository @defaults("uri region") {
51115111
createdAt time
51125112
// Scanning frequency for the repository: SCAN_ON_PUSH, CONTINUOUS_SCAN, or MANUAL
51135113
scanningFrequency() string
5114+
// Access policy for the repository (parsed JSON; private repositories only)
5115+
policy() dict
51145116
// Lifecycle policy for the repository
51155117
lifecyclePolicy() aws.ecr.lifecyclePolicy
51165118
// About text from catalog data (public repositories only)
@@ -5624,6 +5626,8 @@ aws.ec2 {
56245626
images() []aws.ec2.image
56255627
// List of transit gateways
56265628
transitGateways() []aws.ec2.transitgateway
5629+
// List of launch templates
5630+
launchTemplates() []aws.ec2.launchtemplate
56275631
}
56285632

56295633
// Amazon Elastic IP (EIP)
@@ -5873,6 +5877,30 @@ private aws.ec2.transitgateway @defaults("arn id state") {
58735877
propagationDefaultRouteTableId string
58745878
}
58755879

5880+
// Amazon EC2 launch template
5881+
private aws.ec2.launchtemplate @defaults("name region") {
5882+
// Launch template ID
5883+
id string
5884+
// ARN of the launch template
5885+
arn string
5886+
// Name of the launch template
5887+
name string
5888+
// Region for the launch template
5889+
region string
5890+
// Time the launch template was created
5891+
createdAt time
5892+
// Principal that created the launch template
5893+
createdBy string
5894+
// Default version number
5895+
defaultVersion int
5896+
// Latest version number
5897+
latestVersion int
5898+
// Tags for the launch template
5899+
tags map[string]string
5900+
// User data from the default version (base64-decoded)
5901+
userData() string
5902+
}
5903+
58765904
// Amazon EC2 (EBS) snapshot
58775905
private aws.ec2.snapshot @defaults("id region volumeSize state") {
58785906
// ARN for the snapshot
@@ -6500,6 +6528,8 @@ aws.config {
65006528
rules() []aws.config.rule
65016529
// List of delivery channels for each region in the account
65026530
deliveryChannels() []aws.config.deliverychannel
6531+
// List of configuration aggregators
6532+
aggregators() []aws.config.aggregator
65036533
}
65046534

65056535
// AWS Config rule
@@ -6556,6 +6586,44 @@ private aws.config.deliverychannel @defaults("name region") {
65566586
region string
65576587
}
65586588

6589+
// AWS Config aggregator
6590+
private aws.config.aggregator @defaults("name region") {
6591+
// ARN of the configuration aggregator
6592+
arn string
6593+
// Name of the configuration aggregator
6594+
name string
6595+
// Region for the configuration aggregator
6596+
region string
6597+
// Account aggregation sources
6598+
accountAggregationSources []aws.config.aggregator.accountAggregationSource
6599+
// Organization aggregation source
6600+
organizationAggregationSource() aws.config.aggregator.organizationAggregationSource
6601+
// Time the aggregator was created
6602+
createdAt time
6603+
// Time the aggregator was last updated
6604+
lastUpdatedAt time
6605+
}
6606+
6607+
// AWS Config aggregator account aggregation source
6608+
private aws.config.aggregator.accountAggregationSource {
6609+
// List of account IDs included in the aggregation
6610+
accountIds []string
6611+
// Whether all AWS regions are included
6612+
allAwsRegions bool
6613+
// List of AWS regions included in the aggregation
6614+
awsRegions []string
6615+
}
6616+
6617+
// AWS Config aggregator organization aggregation source
6618+
private aws.config.aggregator.organizationAggregationSource {
6619+
// IAM role used for organization aggregation
6620+
iamRole() aws.iam.role
6621+
// Whether all AWS regions are included
6622+
allAwsRegions bool
6623+
// List of AWS regions included in the aggregation
6624+
awsRegions []string
6625+
}
6626+
65596627
// Amazon Elastic Kubernetes Service (EKS)
65606628
aws.eks {
65616629
// EKS clusters

‎providers/aws/resources/aws.lr.go‎

Lines changed: 576 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎providers/aws/resources/aws.lr.versions‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -587,6 +587,22 @@ aws.cognito.userPool.tags 11.16.1
587587
aws.cognito.userPool.updatedAt 11.16.1
588588
aws.cognito.userPools 11.16.1
589589
aws.config 11.15.2
590+
aws.config.aggregator 13.5.0
591+
aws.config.aggregator.accountAggregationSource 13.5.0
592+
aws.config.aggregator.accountAggregationSource.accountIds 13.5.0
593+
aws.config.aggregator.accountAggregationSource.allAwsRegions 13.5.0
594+
aws.config.aggregator.accountAggregationSource.awsRegions 13.5.0
595+
aws.config.aggregator.accountAggregationSources 13.5.0
596+
aws.config.aggregator.arn 13.5.0
597+
aws.config.aggregator.createdAt 13.5.0
598+
aws.config.aggregator.lastUpdatedAt 13.5.0
599+
aws.config.aggregator.name 13.5.0
600+
aws.config.aggregator.organizationAggregationSource 13.5.0
601+
aws.config.aggregator.organizationAggregationSource.allAwsRegions 13.5.0
602+
aws.config.aggregator.organizationAggregationSource.awsRegions 13.5.0
603+
aws.config.aggregator.organizationAggregationSource.iamRole 13.5.0
604+
aws.config.aggregator.region 13.5.0
605+
aws.config.aggregators 13.5.0
590606
aws.config.deliveryChannels 11.15.2
591607
aws.config.deliverychannel 11.15.2
592608
aws.config.deliverychannel.name 11.15.2
@@ -1002,6 +1018,18 @@ aws.ec2.keypair.region 11.15.2
10021018
aws.ec2.keypair.tags 11.15.2
10031019
aws.ec2.keypair.type 11.15.2
10041020
aws.ec2.keypairs 11.15.2
1021+
aws.ec2.launchTemplates 13.5.0
1022+
aws.ec2.launchtemplate 13.5.0
1023+
aws.ec2.launchtemplate.arn 13.5.0
1024+
aws.ec2.launchtemplate.createdAt 13.5.0
1025+
aws.ec2.launchtemplate.createdBy 13.5.0
1026+
aws.ec2.launchtemplate.defaultVersion 13.5.0
1027+
aws.ec2.launchtemplate.id 13.5.0
1028+
aws.ec2.launchtemplate.latestVersion 13.5.0
1029+
aws.ec2.launchtemplate.name 13.5.0
1030+
aws.ec2.launchtemplate.region 13.5.0
1031+
aws.ec2.launchtemplate.tags 13.5.0
1032+
aws.ec2.launchtemplate.userData 13.5.0
10051033
aws.ec2.networkAcls 11.15.2
10061034
aws.ec2.networkacl 11.15.2
10071035
aws.ec2.networkacl.arn 11.15.2
@@ -1172,6 +1200,7 @@ aws.ecr.repository.images 11.15.2
11721200
aws.ecr.repository.lifecyclePolicy 11.15.2
11731201
aws.ecr.repository.name 11.15.2
11741202
aws.ecr.repository.operatingSystems 11.16.1
1203+
aws.ecr.repository.policy 13.5.0
11751204
aws.ecr.repository.public 11.15.2
11761205
aws.ecr.repository.region 11.15.2
11771206
aws.ecr.repository.registryId 11.15.2

‎providers/aws/resources/aws.permissions.json‎

Lines changed: 43 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"provider": "aws",
3-
"version": "13.3.0",
4-
"generated_at": "2026-03-25T10:56:42-07:00",
3+
"version": "13.4.1",
4+
"generated_at": "2026-03-27T09:44:53+01:00",
55
"permissions": [
66
"access-analyzer:ListAnalyzers",
77
"access-analyzer:ListFindingsV2",
@@ -63,6 +63,7 @@
6363
"cognito-idp:GetUserPoolMfaConfig",
6464
"cognito-idp:ListUserPools",
6565
"config:DescribeConfigRules",
66+
"config:DescribeConfigurationAggregators",
6667
"config:DescribeConfigurationRecorders",
6768
"config:DescribeDeliveryChannels",
6869
"dms:DescribeReplicationInstances",
@@ -91,6 +92,8 @@
9192
"ec2:DescribeInstances",
9293
"ec2:DescribeInternetGateways",
9394
"ec2:DescribeKeyPairs",
95+
"ec2:DescribeLaunchTemplateVersions",
96+
"ec2:DescribeLaunchTemplates",
9497
"ec2:DescribeNatGateways",
9598
"ec2:DescribeNetworkAcls",
9699
"ec2:DescribeNetworkInterfaces",
@@ -112,6 +115,7 @@
112115
"ecr:DescribeImages",
113116
"ecr:DescribeRepositories",
114117
"ecr:GetLifecyclePolicy",
118+
"ecr:GetRepositoryPolicy",
115119
"ecrpublic:DescribeImages",
116120
"ecrpublic:DescribeRepositories",
117121
"ecrpublic:GetRepositoryCatalogData",
@@ -140,6 +144,7 @@
140144
"eks:ListClusters",
141145
"eks:ListNodegroups",
142146
"elasticache:DescribeCacheClusters",
147+
"elasticache:DescribeReplicationGroups",
143148
"elasticache:DescribeServerlessCaches",
144149
"elasticbeanstalk:DescribeApplications",
145150
"elasticbeanstalk:DescribeEnvironments",
@@ -738,6 +743,12 @@
738743
"action": "DescribeConfigRules",
739744
"source_file": "aws_config.go"
740745
},
746+
{
747+
"permission": "config:DescribeConfigurationAggregators",
748+
"service": "config",
749+
"action": "DescribeConfigurationAggregators",
750+
"source_file": "aws_config.go"
751+
},
741752
{
742753
"permission": "config:DescribeConfigurationRecorders",
743754
"service": "config",
@@ -912,6 +923,18 @@
912923
"action": "DescribeKeyPairs",
913924
"source_file": "aws_ec2.go"
914925
},
926+
{
927+
"permission": "ec2:DescribeLaunchTemplateVersions",
928+
"service": "ec2",
929+
"action": "DescribeLaunchTemplateVersions",
930+
"source_file": "aws_ec2.go"
931+
},
932+
{
933+
"permission": "ec2:DescribeLaunchTemplates",
934+
"service": "ec2",
935+
"action": "DescribeLaunchTemplates",
936+
"source_file": "aws_ec2.go"
937+
},
915938
{
916939
"permission": "ec2:DescribeNatGateways",
917940
"service": "ec2",
@@ -1062,6 +1085,12 @@
10621085
"action": "GetLifecyclePolicy",
10631086
"source_file": "aws_ecr.go"
10641087
},
1088+
{
1089+
"permission": "ecr:GetRepositoryPolicy",
1090+
"service": "ecr",
1091+
"action": "GetRepositoryPolicy",
1092+
"source_file": "aws_ecr.go"
1093+
},
10651094
{
10661095
"permission": "ecrpublic:DescribeImages",
10671096
"service": "ecrpublic",
@@ -1230,6 +1259,12 @@
12301259
"action": "DescribeCacheClusters",
12311260
"source_file": "aws_elasticache.go"
12321261
},
1262+
{
1263+
"permission": "elasticache:DescribeReplicationGroups",
1264+
"service": "elasticache",
1265+
"action": "DescribeReplicationGroups",
1266+
"source_file": "aws_elasticache.go"
1267+
},
12331268
{
12341269
"permission": "elasticache:DescribeServerlessCaches",
12351270
"service": "elasticache",
@@ -1704,6 +1739,12 @@
17041739
"action": "ListTagsForStream",
17051740
"source_file": "aws_kinesis.go"
17061741
},
1742+
{
1743+
"permission": "kms:DescribeKey",
1744+
"service": "kms",
1745+
"action": "DescribeKey",
1746+
"source_file": "aws_kinesis.go"
1747+
},
17071748
{
17081749
"permission": "kms:DescribeKey",
17091750
"service": "kms",

0 commit comments

Comments
 (0)