Merge agentless scanning params into single AgentlessVulnerabilityScanning

aws_quickstart/datadog_agentless_api_call.py

@@ -15,9 +15,7 @@ def call_datadog_agentless_api(context, event, method):
     app_key = event["ResourceProperties"]["APPKey"]
     dd_site = event["ResourceProperties"]["DatadogSite"]
     account_id = event["ResourceProperties"]["AccountId"]
-    hosts = event["ResourceProperties"]["Hosts"]
-    containers = event["ResourceProperties"]["Containers"]
-    lambdas = event["ResourceProperties"]["Lambdas"]
+    vulnerability_scanning = event["ResourceProperties"]["VulnerabilityScanning"]
     sensitive_data = event["ResourceProperties"]["SensitiveData"]
     # Optional parameters
     launch_template_id = event["ResourceProperties"].get("LaunchTemplateId")
@@ -76,9 +74,9 @@ def call_datadog_agentless_api(context, event, method):
                 "id": account_id,
                 "type": "aws_scan_options",
                 "attributes": {
-                    "vuln_containers_os": containers == "true",
-                    "vuln_host_os": hosts == "true",
-                    "lambda": lambdas == "true",
+                    "vuln_containers_os": vulnerability_scanning == "true",
+                    "vuln_host_os": vulnerability_scanning == "true",
+                    "lambda": vulnerability_scanning == "true",
                     "sensitive_data": sensitive_data == "true",
                 },
             },

aws_quickstart/datadog_agentless_api_call_test.py

@@ -33,9 +33,7 @@ def setUp(self):
                 "APPKey": "0123456789abcdef0123456789abcdef12345678",
                 "DatadogSite": "datadoghq.com",
                 "AccountId": "123456789012",
-                "Hosts": "true",
-                "Containers": "false",
-                "Lambdas": "true",
+                "VulnerabilityScanning": "true",
                 "SensitiveData": "false",
             },
             "StackId": "arn:aws:cloudformation:us-east-1:358251252154:stack/DatadogAgentlessIntegration/22b23bca-de8b-451c-99e4-c69b9ad20ec7",

aws_quickstart/datadog_agentless_delegate_role.yaml

@@ -32,28 +32,12 @@ Parameters:
       - ap1.datadoghq.com
       - ap2.datadoghq.com
 
-  AgentlessHostScanning:
+  AgentlessVulnerabilityScanning:
     Type: String
     AllowedValues:
       - true
       - false
-    Description: Enable Agentless Scanning of host vulnerabilities.
-    Default: false
-
-  AgentlessContainerScanning:
-    Type: String
-    AllowedValues:
-      - true
-      - false
-    Description: Enable Agentless Scanning of container vulnerabilities.
-    Default: false
-
-  AgentlessLambdaScanning:
-    Type: String
-    AllowedValues:
-      - true
-      - false
-    Description: Enable Agentless Scanning of Lambda vulnerabilities.
+    Description: Enable Agentless Vulnerability Scanning (hosts, containers, and Lambda functions).
     Default: false
 
   AgentlessSensitiveDataScanning:
@@ -353,9 +337,7 @@ Resources:
       APPKey: !Ref "DatadogAPPKey"
       DatadogSite: !Ref "DatadogSite"
       AccountId: !Ref "AWS::AccountId"
-      Hosts: !Ref "AgentlessHostScanning"
-      Containers: !Ref "AgentlessContainerScanning"
-      Lambdas: !Ref "AgentlessLambdaScanning"
+      VulnerabilityScanning: !Ref "AgentlessVulnerabilityScanning"
       SensitiveData: !Ref "AgentlessSensitiveDataScanning"
       IntegrationRoleName: !Ref "DatadogIntegrationRoleName"
       Partition: !Ref "AWS::Partition"

aws_quickstart/datadog_agentless_delegate_role_stackset.yaml

@@ -321,9 +321,7 @@ Resources:
       APPKey: !Ref "DatadogAPPKey"
       DatadogSite: !Ref "DatadogSite"
       AccountId: !Ref "AWS::AccountId"
-      Hosts: !Ref "AgentlessVulnerabilityScanning"
-      Containers: !Ref "AgentlessVulnerabilityScanning"
-      Lambdas: !Ref "AgentlessVulnerabilityScanning"
+      VulnerabilityScanning: !Ref "AgentlessVulnerabilityScanning"
       SensitiveData: !Ref "AgentlessSensitiveDataScanning"
       IntegrationRoleName: !Ref "DatadogIntegrationRoleName"
       Partition: !Ref "AWS::Partition"

aws_quickstart/datadog_agentless_scanning.yaml

@@ -26,31 +26,13 @@ Parameters:
     Description: Your current AWS account ID for stack deployment
     AllowedPattern: "^[0-9]{12}$"
 
-  AgentlessHostScanning:
+  AgentlessVulnerabilityScanning:
     Type: String
     AllowedValues:
       - true
       - false
     Description: >-
-      Enable Agentless Scanning of host vulnerabilities.
-    Default: false
-
-  AgentlessContainerScanning:
-    Type: String
-    AllowedValues:
-      - true
-      - false
-    Description: >-
-      Enable Agentless Scanning of container vulnerabilities.
-    Default: false
-
-  AgentlessLambdaScanning:
-    Type: String
-    AllowedValues:
-      - true
-      - false
-    Description: >-
-      Enable Agentless Scanning of Lambda vulnerabilities.
+      Enable Agentless Vulnerability Scanning (hosts, containers, and Lambda functions).
     Default: false
 
   AgentlessSensitiveDataScanning:
@@ -1074,9 +1056,7 @@ Resources:
       APPKey: !Ref "DatadogAPPKey"
       DatadogSite: !Ref "DatadogSite"
       AccountId: !Ref "AWS::AccountId"
-      Hosts: !Ref "AgentlessHostScanning"
-      Containers: !Ref "AgentlessContainerScanning"
-      Lambdas: !Ref "AgentlessLambdaScanning"
+      VulnerabilityScanning: !Ref "AgentlessVulnerabilityScanning"
       SensitiveData: !Ref "AgentlessSensitiveDataScanning"
       IntegrationRoleName: !Ref "DatadogIntegrationRoleName"
       Partition: !Ref "AWS::Partition"
@@ -1117,9 +1097,7 @@ Metadata:
           - DatadogIntegrationRoleName
           - AccountId
           - DatadogSite
-          - AgentlessHostScanning
-          - AgentlessContainerScanning
-          - AgentlessLambdaScanning
+          - AgentlessVulnerabilityScanning
           - AgentlessSensitiveDataScanning
       - Label:
           default: Advanced
@@ -1148,11 +1126,7 @@ Metadata:
         default: "AWS Account ID *"
       DatadogSite:
         default: "DatadogSite *"
-      AgentlessHostScanning:
-        default: "AgentlessHostScanning *"
-      AgentlessContainerScanning:
-        default: "AgentlessContainerScanning *"
-      AgentlessLambdaScanning:
-        default: "AgentlessLambdaScanning *"
+      AgentlessVulnerabilityScanning:
+        default: "AgentlessVulnerabilityScanning *"
       AgentlessSensitiveDataScanning:
         default: "AgentlessSensitiveDataScanning *"

aws_quickstart/main_extended.yaml

@@ -87,29 +87,13 @@ Parameters:
       Datadog CSPM is a product that automatically detects resource misconfigurations in your AWS account according to
       industry benchmarks. More info: https://www.datadoghq.com/product/security-platform/cloud-security-posture-management/
     Default: false
-  AgentlessHostScanning:
+  AgentlessVulnerabilityScanning:
     Type: String
     AllowedValues:
       - true
       - false
     Description: >-
-      Enable Agentless Scanning of host vulnerabilities.
-    Default: false
-  AgentlessContainerScanning:
-    Type: String
-    AllowedValues:
-      - true
-      - false
-    Description: >-
-      Enable Agentless Scanning of container vulnerabilities.
-    Default: false
-  AgentlessLambdaScanning:
-    Type: String
-    AllowedValues:
-      - true
-      - false
-    Description: >-
-      Enable Agentless Scanning of Lambda vulnerabilities.
+      Enable Agentless Vulnerability Scanning (hosts, containers, and Lambda functions).
     Default: false
   AgentlessSensitiveDataScanning:
     Type: String
@@ -152,13 +136,7 @@ Rules:
                     - 'true'
                 - Fn::Or:
                     - Fn::Equals:
-                        - Ref: AgentlessHostScanning
-                        - 'true'
-                    - Fn::Equals:
-                        - Ref: AgentlessContainerScanning
-                        - 'true'
-                    - Fn::Equals:
-                        - Ref: AgentlessLambdaScanning
+                        - Ref: AgentlessVulnerabilityScanning
                         - 'true'
                     - Fn::Equals:
                         - Ref: AgentlessSensitiveDataScanning
@@ -181,13 +159,7 @@ Conditions:
           - ddog-gov.com
       - Fn::Or:
         - Fn::Equals:
-          - !Ref AgentlessHostScanning
-          - true
-        - Fn::Equals:
-          - !Ref AgentlessContainerScanning
-          - true
-        - Fn::Equals:
-          - !Ref AgentlessLambdaScanning
+          - !Ref AgentlessVulnerabilityScanning
           - true
         - Fn::Equals:
           - !Ref AgentlessSensitiveDataScanning
@@ -229,9 +201,7 @@ Resources:
         DatadogAPPKey: !Ref APPKey
         DatadogSite: !Ref DatadogSite
         AccountId: !Ref AWS::AccountId
-        AgentlessHostScanning: !Ref AgentlessHostScanning
-        AgentlessContainerScanning: !Ref AgentlessContainerScanning
-        AgentlessLambdaScanning: !Ref AgentlessLambdaScanning
+        AgentlessVulnerabilityScanning: !Ref AgentlessVulnerabilityScanning
         AgentlessSensitiveDataScanning: !Ref AgentlessSensitiveDataScanning
         ScannerDelegateRoleName: !Ref ScannerDelegateRoleName
         ScannerInstanceRoleARN: !If [IsCrossAccountScanning, !Join [",", !Ref "ScannerInstanceRoleARN"], !Ref "AWS::NoValue"]
@@ -311,9 +281,7 @@ Metadata:
         - DatadogSite
         - InstallLambdaLogForwarder
         - CloudSecurityPostureManagement
-        - AgentlessHostScanning
-        - AgentlessContainerScanning
-        - AgentlessLambdaScanning
+        - AgentlessVulnerabilityScanning
         - AgentlessSensitiveDataScanning
     - Label:
         default: Advanced
@@ -331,12 +299,8 @@ Metadata:
         default: "DatadogSite *"
       CloudSecurityPostureManagement:
         default: "CloudSecurityPostureManagement *"
-      AgentlessHostScanning:
-        default: "AgentlessHostScanning *"
-      AgentlessContainerScanning:
-        default: "AgentlessContainerScanning *"
-      AgentlessLambdaScanning:
-        default: "AgentlessLambdaScanning *"
+      AgentlessVulnerabilityScanning:
+        default: "AgentlessVulnerabilityScanning *"
       AgentlessSensitiveDataScanning:
         default: "AgentlessSensitiveDataScanning *"
       InstallLambdaLogForwarder:

aws_quickstart/main_extended_workflow.yaml

@@ -97,29 +97,13 @@ Parameters:
       Datadog CSPM is a product that automatically detects resource misconfigurations in your AWS account according to
       industry benchmarks. More info: https://www.datadoghq.com/product/security-platform/cloud-security-posture-management/
     Default: false
-  AgentlessHostScanning:
+  AgentlessVulnerabilityScanning:
     Type: String
     AllowedValues:
       - true
       - false
     Description: >-
-      Enable Agentless Scanning of host vulnerabilities.
-    Default: false
-  AgentlessContainerScanning:
-    Type: String
-    AllowedValues:
-      - true
-      - false
-    Description: >-
-      Enable Agentless Scanning of container vulnerabilities.
-    Default: false
-  AgentlessLambdaScanning:
-    Type: String
-    AllowedValues:
-      - true
-      - false
-    Description: >-
-      Enable Agentless Scanning of Lambda vulnerabilities.
+      Enable Agentless Vulnerability Scanning (hosts, containers, and Lambda functions).
     Default: false
   AgentlessSensitiveDataScanning:
     Type: String
@@ -172,13 +156,7 @@ Rules:
                     - 'true'
                 - Fn::Or:
                     - Fn::Equals:
-                        - Ref: AgentlessHostScanning
-                        - 'true'
-                    - Fn::Equals:
-                        - Ref: AgentlessContainerScanning
-                        - 'true'
-                    - Fn::Equals:
-                        - Ref: AgentlessLambdaScanning
+                        - Ref: AgentlessVulnerabilityScanning
                         - 'true'
                     - Fn::Equals:
                         - Ref: AgentlessSensitiveDataScanning
@@ -204,13 +182,7 @@ Conditions:
           - ddog-gov.com
       - Fn::Or:
         - Fn::Equals:
-          - !Ref AgentlessHostScanning
-          - true
-        - Fn::Equals:
-          - !Ref AgentlessContainerScanning
-          - true
-        - Fn::Equals:
-          - !Ref AgentlessLambdaScanning
+          - !Ref AgentlessVulnerabilityScanning
           - true
         - Fn::Equals:
           - !Ref AgentlessSensitiveDataScanning
@@ -575,9 +547,7 @@ Resources:
         DatadogAPPKey: !Ref APPKey
         DatadogSite: !Ref DatadogSite
         AccountId: !Ref AWS::AccountId
-        AgentlessHostScanning: !Ref AgentlessHostScanning
-        AgentlessContainerScanning: !Ref AgentlessContainerScanning
-        AgentlessLambdaScanning: !Ref AgentlessLambdaScanning
+        AgentlessVulnerabilityScanning: !Ref AgentlessVulnerabilityScanning
         AgentlessSensitiveDataScanning: !Ref AgentlessSensitiveDataScanning
         ScannerDelegateRoleName: !Ref ScannerDelegateRoleName
         ScannerInstanceRoleARN: !If [IsCrossAccountScanning, !Join [",", !Ref "ScannerInstanceRoleARN"], !Ref "AWS::NoValue"]
@@ -730,9 +700,7 @@ Metadata:
         - ExternalId
         - InstallLambdaLogForwarder
         - CloudSecurityPostureManagement
-        - AgentlessHostScanning
-        - AgentlessContainerScanning
-        - AgentlessLambdaScanning
+        - AgentlessVulnerabilityScanning
         - AgentlessSensitiveDataScanning
     - Label:
         default: Advanced
@@ -754,12 +722,8 @@ Metadata:
         default: "ExternalId *"
       CloudSecurityPostureManagement:
         default: "CloudSecurityPostureManagement *"
-      AgentlessHostScanning:
-        default: "AgentlessHostScanning *"
-      AgentlessContainerScanning:
-        default: "AgentlessContainerScanning *"
-      AgentlessLambdaScanning:
-        default: "AgentlessLambdaScanning *"
+      AgentlessVulnerabilityScanning:
+        default: "AgentlessVulnerabilityScanning *"
       AgentlessSensitiveDataScanning:
         default: "AgentlessSensitiveDataScanning *"
       InstallLambdaLogForwarder:

aws_quickstart/taskcat/.taskcat_extended.yml

@@ -19,7 +19,5 @@ tests:
       DisableMetricCollection: "false"
       CloudSecurityPostureManagement: "false"
       DisableResourceCollection: "false"
-      AgentlessHostScanning: "true"
-      AgentlessContainerScanning: "true"
-      AgentlessLambdaScanning: "true"
+      AgentlessVulnerabilityScanning: "true"
       AgentlessSensitiveDataScanning: "true"

aws_quickstart/version.txt

@@ -1 +1 @@
-v4.6.3
+v4.6.4