{"action":"created","issue":{"url":"https://api.github.com/repos/Netflix/security_monkey/issues/101","labels_url":"https://api.github.com/repos/Netflix/security_monkey/issues/101/labels{/name}","comments_url":"https://api.github.com/repos/Netflix/security_monkey/issues/101/comments","events_url":"https://api.github.com/repos/Netflix/security_monkey/issues/101/events","html_url":"https://github.com/Netflix/security_monkey/issues/101","id":55145211,"number":101,"title":"secmonkey is incompatible with cloudformation setup","user":{"login":"lucab","id":98086,"avatar_url":"https://avatars.githubusercontent.com/u/98086?v=3","gravatar_id":"","url":"https://api.github.com/users/lucab","html_url":"https://github.com/lucab","followers_url":"https://api.github.com/users/lucab/followers","following_url":"https://api.github.com/users/lucab/following{/other_user}","gists_url":"https://api.github.com/users/lucab/gists{/gist_id}","starred_url":"https://api.github.com/users/lucab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lucab/subscriptions","organizations_url":"https://api.github.com/users/lucab/orgs","repos_url":"https://api.github.com/users/lucab/repos","events_url":"https://api.github.com/users/lucab/events{/privacy}","received_events_url":"https://api.github.com/users/lucab/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-01-22T12:01:16Z","updated_at":"2015-02-09T18:04:11Z","closed_at":null,"body":"I recently had to monitor several accounts, not managed by me, and provisioned by cloudformation. The owner just took the IAM \"SecurityMonkey\" role details and translated them into a cloudformation template which sets up all the IAM bits.\r\n\r\nUnfortunately, it looks like in its current incarnation secmonkey doesn't work in such scenario, because the AssumeRole fails. This is due to two facts:\r\n * cloudformation will generate a dynamic role name for you, in the form of `<stackname>-<rolelabel>-<dynrandomID>`\r\n * we hardcode the role name as \"SecurityMonkey\" in `sts_connect.py`\r\n\r\nI'm currently playing more with cloudformation parameters, but I currently think there is no way for me to specify the name. I've a ticket open with them to see if it is doable, and I'm not noting the issue here in case other users are going the cloudformation path.\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/Netflix/security_monkey/issues/comments/73557487","html_url":"https://github.com/Netflix/security_monkey/issues/101#issuecomment-73557487","issue_url":"https://api.github.com/repos/Netflix/security_monkey/issues/101","id":73557487,"user":{"login":"lucab","id":98086,"avatar_url":"https://avatars.githubusercontent.com/u/98086?v=3","gravatar_id":"","url":"https://api.github.com/users/lucab","html_url":"https://github.com/lucab","followers_url":"https://api.github.com/users/lucab/followers","following_url":"https://api.github.com/users/lucab/following{/other_user}","gists_url":"https://api.github.com/users/lucab/gists{/gist_id}","starred_url":"https://api.github.com/users/lucab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lucab/subscriptions","organizations_url":"https://api.github.com/users/lucab/orgs","repos_url":"https://api.github.com/users/lucab/repos","events_url":"https://api.github.com/users/lucab/events{/privacy}","received_events_url":"https://api.github.com/users/lucab/received_events","type":"User","site_admin":false},"created_at":"2015-02-09T18:04:11Z","updated_at":"2015-02-09T18:04:11Z","body":"Probably not.\r\n\r\nFirst, we should put up a field in web settings to override the hardcoded role name *per AWS account*. But then, I'm not sure if at every cloudformation run, the role name will be updated (randomly). If it is, it's a war already lost. If not, maybe there is hope.\r\n\r\nI'll ask tomorrow my colleagues to check for the behaviour..."}}