Skip to content

Commit 81addc2

Browse files
jose-pablo-camachojose-pablo-camacho
authored
enhance(s3): add support for Govcloud account/org for fedramp (#24)
* enhance(s3): add support for Govcloud account/org for fedramp * enhance(s3): add support for Govcloud account/org for s3 * fix version * fix version
1 parent 6869379 commit 81addc2

File tree

8 files changed

+150
-28
lines changed

8 files changed

+150
-28
lines changed

‎modules/integrations/cloud-logs/README.md

+35-27
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,30 @@
11
# AWS Cloud Logs Module
22

3-
This Module creates the resources required to send CloudTrail logs to Sysdig by enabling access to the CloudTrail associated s3 bucket through a dedicated IAM role.
3+
This Module creates the resources required to send CloudTrail logs to Sysdig by enabling access to the CloudTrail
4+
associated s3 bucket through a dedicated IAM role.
45

56
The following resources will be created in each instrumented account:
6-
- An IAM Role and associated policies that gives the ingestion component in Sysdig's account permission to list and retrieve items from it.
7+
8+
- An IAM Role and associated policies that gives the ingestion component in Sysdig's account permission to list and
9+
retrieve items from it.
10+
11+
If instrumenting an AWS Gov account/organization, resources will be created in `aws-us-gov` region.
712

813
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
14+
915
## Requirements
1016

11-
| Name | Version |
12-
|------|-----------|
17+
| Name | Version |
18+
|---------------------------------------------------------------------------|-----------|
1319
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
14-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.60.0 |
15-
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) |
16-
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 3.1 |
20+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.60.0 |
21+
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | ~>1.39 |
22+
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 3.1 |
1723

1824
## Providers
1925

20-
| Name | Version |
21-
|------|---------|
26+
| Name | Version |
27+
|---------------------------------------------------|-----------|
2228
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.60.0 |
2329

2430
## Modules
@@ -27,33 +33,35 @@ No modules.
2733

2834
## Resources
2935

30-
| Name | Type |
31-
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------|
32-
| [random_id.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
33-
| [aws_iam_role.cloudlogs_s3_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
34-
| [aws_iam_role_policy.cloudlogs_s3_access_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
36+
| Name | Type |
37+
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------|
38+
| [random_id.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
39+
| [aws_iam_role.cloudlogs_s3_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
40+
| [aws_iam_role_policy.cloudlogs_s3_access_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
3541
| [aws_iam_policy_document.assume_cloudlogs_s3_access_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
3642
| [aws_iam_policy_document.cloudlogs_s3_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
37-
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
38-
| [sysdig_secure_trusted_cloud_identity.trusted_identity](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_trusted_cloud_identity) | data source |
39-
| [sysdig_secure_tenant_external_id.external_id](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_tenant_external_id) | data source |
40-
| [sysdig_secure_cloud_auth_account_component.aws_cloud_logs](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/resources/secure_cloud_auth_account_component) | resource |
43+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
44+
| [sysdig_secure_trusted_cloud_identity.trusted_identity](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_trusted_cloud_identity) | data source |
45+
| [sysdig_secure_tenant_external_id.external_id](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_tenant_external_id) | data source |
46+
| [sysdig_secure_cloud_auth_account_component.aws_cloud_logs](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/resources/secure_cloud_auth_account_component) | resource |
4147

4248
## Inputs
4349

44-
| Name | Description | Type | Default | Required |
45-
|------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------|---------------|-----------------------------------------------------------|:--------:|
46-
| <a name="input_sysdig_secure_account_id"></a> [sysdig\_secure\_account\_id](#input\_sysdig\_secure\_account\_id) | (Required) ID of the Sysdig Cloud Account to enable Cloud Logs integration for (in case of organization, ID of the Sysdig management account) | `string` | n/a | yes |
47-
| <a name="input_folder_arn"></a> [folder\_arn](#input\_folder\_arn) | (Required) The ARN of your CloudTrail Bucket Folder | `string` | n/a | yes |
48-
| <a name="input_tags"></a> [tags](#input\_tags) | (Optional) Name to be assigned to all child resources. A suffix may be added internally when required. | `map(string)` | <pre>{<br> "product": "sysdig-secure-for-cloud"<br>}</pre> | no |
49-
| <a name="input_name"></a> [name](#input\_name) | (Optional) Sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning | `string` | sysdig-secure-cloudlogs | no |
50-
| <a name="input_regions"></a> [regions](#input\_regions) | (Optional) The list of AWS regions we want to scrape data from | `set(string)` | `[]` | no |
50+
| Name | Description | Type | Default | Required |
51+
|------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|---------------|-------------------------------------------------------------|:--------:|
52+
| <a name="input_sysdig_secure_account_id"></a> [sysdig\_secure\_account\_id](#input\_sysdig\_secure\_account\_id) | (Required) ID of the Sysdig Cloud Account to enable Cloud Logs integration for (in case of organization, ID of the Sysdig management account) | `string` | n/a | yes |
53+
| <a name="input_folder_arn"></a> [folder\_arn](#input\_folder\_arn) | (Required) The ARN of your CloudTrail Bucket Folder | `string` | n/a | yes |
54+
| <a name="input_tags"></a> [tags](#input\_tags) | (Optional) Name to be assigned to all child resources. A suffix may be added internally when required. | `map(string)` | <pre>{<br> "product": "sysdig-secure-for-cloud"<br>}</pre> | no |
55+
| <a name="input_name"></a> [name](#input\_name) | (Optional) Sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning | `string` | sysdig-secure-cloudlogs | no |
56+
| <a name="input_regions"></a> [regions](#input\_regions) | (Optional) The list of AWS regions we want to scrape data from | `set(string)` | `[]` | no |
57+
| <a name="input_is_gov_cloud_onboarding"></a> [is\_gov\_cloud](#input\_is\_gov\_cloud\_onboarding) | true/false whether secure-for-cloud should be deployed in a govcloud account/org or not | `bool` | `false` | no |
5158

5259
## Outputs
5360

54-
| Name | Description |
55-
|-----------------------------------------------------------------------------------------------------------------|-------------|
61+
| Name | Description |
62+
|-----------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------|
5663
| <a name="output_cloud_logs_component_id"></a> [cloud\_logs\_component\_id](#output\_cloud\_logs\_component\_id) | Component identifier of Cloud Logs integration created in Sysdig Backend for Log Ingestion |
64+
5765
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
5866

5967
## Authors

‎modules/integrations/cloud-logs/main.tf

+2-1
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ locals {
2828
account_id_hash = substr(md5(data.aws_caller_identity.current.account_id), 0, 4)
2929
role_name = "${var.name}-${random_id.suffix.hex}-${local.account_id_hash}"
3030
bucket_arn = regex("^([^/]+)", var.folder_arn)[0]
31+
trusted_identity = var.is_gov_cloud_onboarding ? data.sysdig_secure_trusted_cloud_identity.trusted_identity.gov_identity : data.sysdig_secure_trusted_cloud_identity.trusted_identity.identity
3132
}
3233

3334
#-----------------------------------------------------------------------------------------------------------------------
@@ -59,7 +60,7 @@ data "aws_iam_policy_document" "assume_cloudlogs_s3_access_role" {
5960

6061
principals {
6162
type = "AWS"
62-
identifiers = [data.sysdig_secure_trusted_cloud_identity.trusted_identity.identity]
63+
identifiers = [local.trusted_identity]
6364
}
6465

6566
actions = ["sts:AssumeRole"]

‎modules/integrations/cloud-logs/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,9 @@ variable "regions" {
2828
type = set(string)
2929
default = []
3030
}
31+
32+
variable "is_gov_cloud_onboarding" {
33+
type = bool
34+
default = false
35+
description = "true/false whether secure-for-cloud should be deployed in a govcloud account/org or not"
36+
}

‎modules/integrations/cloud-logs/versions.tf

+1
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ terraform {
88
}
99
sysdig = {
1010
source = "sysdiglabs/sysdig"
11+
version = "~> 1.39"
1112
}
1213
random = {
1314
source = "hashicorp/random"

‎test/examples/organization/cloud_logs.tf

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#---------------------------------------------------------------------------------------------
2+
# Ensure installation flow for foundational onboarding has been completed before
3+
# installing additional Sysdig features.
4+
#---------------------------------------------------------------------------------------------
5+
6+
module "cloud-logs" {
7+
source = "../../../modules/integrations/cloud-logs"
8+
folder_arn = "<FOLDER_ARN"
9+
sysdig_secure_account_id = module.onboarding.sysdig_secure_account_id
10+
}
11+
12+
resource "sysdig_secure_cloud_auth_account_feature" "threat_detection" {
13+
account_id = module.onboarding.sysdig_secure_account_id
14+
type = "FEATURE_SECURE_THREAT_DETECTION"
15+
enabled = true
16+
components = [module.cloud-logs.cloud_logs_component_id]
17+
depends_on = [module.cloud-logs]
18+
}
19+
20+
resource "sysdig_secure_cloud_auth_account_feature" "identity_entitlement" {
21+
account_id = module.onboarding.sysdig_secure_account_id
22+
type = "FEATURE_SECURE_IDENTITY_ENTITLEMENT"
23+
enabled = true
24+
components = [module.cloud-logs.cloud_logs_component_id]
25+
depends_on = [module.cloud-logs, sysdig_secure_cloud_auth_account_feature.config_posture]
26+
}

‎test/examples/organization/cloud_logs_gov.tf

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#---------------------------------------------------------------------------------------------
2+
# Ensure installation flow for foundational onboarding has been completed before
3+
# installing additional Sysdig features.
4+
#---------------------------------------------------------------------------------------------
5+
6+
module "cloud-logs" {
7+
source = "../../../modules/integrations/cloud-logs"
8+
folder_arn = "<FOLDER_ARN"
9+
sysdig_secure_account_id = module.onboarding.sysdig_secure_account_id
10+
is_gov_cloud_onboarding = module.onboarding.is_gov_cloud_onboarding
11+
}
12+
13+
resource "sysdig_secure_cloud_auth_account_feature" "threat_detection" {
14+
account_id = module.onboarding.sysdig_secure_account_id
15+
type = "FEATURE_SECURE_THREAT_DETECTION"
16+
enabled = true
17+
components = [module.cloud-logs.cloud_logs_component_id]
18+
depends_on = [module.cloud-logs]
19+
}
20+
21+
resource "sysdig_secure_cloud_auth_account_feature" "identity_entitlement" {
22+
account_id = module.onboarding.sysdig_secure_account_id
23+
type = "FEATURE_SECURE_IDENTITY_ENTITLEMENT"
24+
enabled = true
25+
components = [module.cloud-logs.cloud_logs_component_id]
26+
depends_on = [module.cloud-logs, sysdig_secure_cloud_auth_account_feature.config_posture]
27+
}

‎test/examples/single_account/cloud_logs.tf

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#---------------------------------------------------------------------------------------------
2+
# Ensure installation flow for foundational onboarding has been completed before
3+
# installing additional Sysdig features.
4+
#---------------------------------------------------------------------------------------------
5+
6+
module "cloud-logs" {
7+
source = "../../../modules/integrations/cloud-logs"
8+
folder_arn = "<FOLDER_ARN"
9+
sysdig_secure_account_id = module.onboarding.sysdig_secure_account_id
10+
}
11+
12+
resource "sysdig_secure_cloud_auth_account_feature" "threat_detection" {
13+
account_id = module.onboarding.sysdig_secure_account_id
14+
type = "FEATURE_SECURE_THREAT_DETECTION"
15+
enabled = true
16+
components = [module.cloud-logs.cloud_logs_component_id]
17+
depends_on = [module.cloud-logs]
18+
}
19+
20+
resource "sysdig_secure_cloud_auth_account_feature" "identity_entitlement" {
21+
account_id = module.onboarding.sysdig_secure_account_id
22+
type = "FEATURE_SECURE_IDENTITY_ENTITLEMENT"
23+
enabled = true
24+
components = [module.cloud-logs.cloud_logs_component_id]
25+
depends_on = [module.cloud-logs, sysdig_secure_cloud_auth_account_feature.config_posture]
26+
}

‎test/examples/single_account/cloud_logs_gov.tf

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#---------------------------------------------------------------------------------------------
2+
# Ensure installation flow for foundational onboarding has been completed before
3+
# installing additional Sysdig features.
4+
#---------------------------------------------------------------------------------------------
5+
6+
module "cloud-logs" {
7+
source = "../../../modules/integrations/cloud-logs"
8+
folder_arn = "<FOLDER_ARN"
9+
sysdig_secure_account_id = module.onboarding.sysdig_secure_account_id
10+
is_gov_cloud_onboarding = module.onboarding.is_gov_cloud_onboarding
11+
}
12+
13+
resource "sysdig_secure_cloud_auth_account_feature" "threat_detection" {
14+
account_id = module.onboarding.sysdig_secure_account_id
15+
type = "FEATURE_SECURE_THREAT_DETECTION"
16+
enabled = true
17+
components = [module.cloud-logs.cloud_logs_component_id]
18+
depends_on = [module.cloud-logs]
19+
}
20+
21+
resource "sysdig_secure_cloud_auth_account_feature" "identity_entitlement" {
22+
account_id = module.onboarding.sysdig_secure_account_id
23+
type = "FEATURE_SECURE_IDENTITY_ENTITLEMENT"
24+
enabled = true
25+
components = [module.cloud-logs.cloud_logs_component_id]
26+
depends_on = [module.cloud-logs, sysdig_secure_cloud_auth_account_feature.config_posture]
27+
}

0 commit comments

Comments
 (0)