Skip to content

Commit 985bfbe

Browse files
NoamstraussNoamstrauss
committed
feat: Adding support for organization onboarding
- Implemented dedicated and same onboarding process - Updated examples to include organization onboarding - Updated README with instructions for organization onboarding - Added CSPM_iam module for organization - same deployment methods
1 parent 2ae939f commit 985bfbe

File tree

50 files changed

+1276
-156
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+1276
-156
lines changed

‎.github/workflows/pr-checks.yaml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,12 @@ jobs:
1919
- name: Run tests for each example folder
2020
run: |
2121
TEST_CASES=(
22-
examples/dedicated-project
23-
examples/same-project
24-
examples/multiple-dedicated-project
22+
examples/single-dedicated-project
23+
examples/single-same-project
24+
examples/single-dedicated-project-addition
25+
examples/organization-same-project
26+
examples/organization-same-project-list
27+
examples/organization-dedicated-project
2528
)
2629
2730
for tcase in ${TEST_CASES[@]}; do

‎README.md‎

Lines changed: 200 additions & 29 deletions
Large diffs are not rendered by default.

‎examples/organization-dedicated-project/README.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# Onboarding an Organization with Infrastructure on a Dedicated Project Example
2+
3+
---
4+
5+
## Overview
6+
7+
This example demonstrates how to onboard a Google Cloud Platform (GCP) organization for Aqua Security integration by creating a dedicated project and provisioning all Aqua's resources within it.
8+
9+
## Pre-requisites
10+
11+
Before running this example, ensure that you have the following:
12+
13+
1. Terraform installed (version 1.6.4 or later).
14+
2. `gcloud` CLI installed and configured.
15+
3. Aqua Security account API credentials.
16+
4. Appropriate permissions to manage resources at the organization level and within the specified projects.
17+
18+
## Usage
19+
20+
1. Obtain the Terraform configuration file generated by the Aqua platform.
21+
2. Important: Replace `<aqua_api_key>` and `<aqua_api_secret>` with your generated API credentials.
22+
3. Run `terraform init` to initialize the Terraform working directory.
23+
4. Run `terraform apply` to create the resources.
24+
25+
## Providing Project ID List
26+
27+
You can provide your own list of project IDs by populating the `projects_list` local. To accommodate this, ensure to remove the `data "google_projects"` and then replace the local `projects_list` with your list.
28+
29+
```hcl
30+
locals {
31+
projects_list = [
32+
"my-project-id-1",
33+
"my-project-id-2",
34+
// Add more project IDs as needed
35+
]
36+
}
37+
```
38+
39+
## What's Happening
40+
41+
1. The `aqua_gcp_dedicated_project` module is called to create a dedicated GCP project with the name `aqua-agentless-<tenant_id>-<org_hash>`, where `org_hash` is the first six characters of the SHA1 hash of your organization name.
42+
2. The `aqua_gcp_onboarding` module is called to provision the necessary resources (service accounts, roles, networking, etc.) in the dedicated GCP project.
43+
3. The `aqua_gcp_project_attachment` module is called for each GCP project in the organization to create the required IAM resources and trigger the Aqua API to onboard the project.
44+
45+
## Outputs
46+
47+
- `onboarding_status`: This output displays the result of the onboarding process for each project, indicating whether it was successful or encountered any errors.
48+
49+
## Cleanup
50+
51+
To remove the resources created by this example, including the organization-level resources, dedicated project, and attached projects, run `terraform destroy`.
52+

‎examples/organization-dedicated-project/main.tf‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
2+
# Defining local variables
3+
locals {
4+
region = "us-central1"
5+
dedicated = true
6+
type = "organization"
7+
org_name = "my-org-name"
8+
aqua_tenant_id = "12345"
9+
billing_account_id = "012A3B-4567CD-8EFGH9"
10+
aqua_aws_account_id = "123456789101"
11+
aqua_bucket_name = "generic-bucket-name"
12+
aqua_configuration_id = "234e3cea-d84a-4b9e-bb36-92518e6a5772"
13+
aqua_cspm_group_id = 123456
14+
aqua_custom_labels = { label = "true" }
15+
aqua_api_key = "<REPLACE_ME>"
16+
aqua_api_secret = "<REPLACE_ME>"
17+
aqua_autoconnect_url = "https://example-aqua-autoconnect-url.com"
18+
aqua_volscan_api_token = "<REPLACE_ME>"
19+
aqua_volscan_api_url = "https://example-aqua-volscan-api-url.com"
20+
dedicated_project_id = "aqua-agentless-${local.aqua_tenant_id}-${local.org_hash}"
21+
labels = merge(local.aqua_custom_labels, { "aqua-agentless-scanner" = "true" })
22+
org_hash = substr(sha1(local.org_name), 0, 6)
23+
}
24+
25+
################################
26+
27+
# Defining the root google provider
28+
provider "google" {
29+
region = local.region
30+
default_labels = local.labels
31+
}
32+
33+
# Getting google organization ID
34+
data "google_organization" "org" {
35+
domain = local.org_name
36+
}
37+
38+
################################
39+
40+
# Getting all projects ID's that are active under the organization ID
41+
data "google_projects" "projects" {
42+
filter = "parent.id=${data.google_organization.org.org_id} AND parent.type=organization AND lifecycleState:ACTIVE"
43+
}
44+
45+
# Filter out projects containing "aqua-agentless" in their names
46+
locals {
47+
projects_list = [
48+
for project in data.google_projects.projects.projects :
49+
project.project_id
50+
if !can(regex("^.*aqua-agentless.*$", project.project_id))
51+
]
52+
}
53+
54+
################################
55+
56+
# Creating a dedicated project
57+
module "aqua_gcp_dedicated_project" {
58+
source = "../../modules/dedicated_project"
59+
org_name = local.org_name
60+
project_id = local.dedicated_project_id
61+
type = local.type
62+
billing_account_id = local.billing_account_id
63+
labels = local.labels
64+
}
65+
66+
################################
67+
68+
# Defining the dedicated google provider
69+
provider "google" {
70+
alias = "dedicated"
71+
project = module.aqua_gcp_dedicated_project.project_id
72+
region = local.region
73+
default_labels = local.labels
74+
}
75+
76+
# Creating discovery and scanning resources on the dedicated project
77+
module "aqua_gcp_onboarding" {
78+
source = "../../"
79+
providers = {
80+
google.onboarding = google.dedicated
81+
}
82+
type = local.type
83+
project_id = module.aqua_gcp_dedicated_project.project_id
84+
dedicated_project = local.dedicated
85+
region = local.region
86+
org_name = local.org_name
87+
aqua_tenant_id = local.aqua_tenant_id
88+
aqua_aws_account_id = local.aqua_aws_account_id
89+
aqua_bucket_name = local.aqua_bucket_name
90+
aqua_volscan_api_token = local.aqua_volscan_api_token
91+
aqua_volscan_api_url = local.aqua_volscan_api_url
92+
depends_on = [module.aqua_gcp_dedicated_project]
93+
}
94+
95+
################################
96+
97+
## Iterating over all project and attaching them to the dedicated project
98+
module "aqua_gcp_projects_attachment" {
99+
source = "../../modules/project_attachment"
100+
providers = {
101+
google = google
102+
}
103+
for_each = toset(local.projects_list)
104+
aqua_api_key = local.aqua_api_key
105+
type = local.type
106+
aqua_api_secret = local.aqua_api_secret
107+
aqua_autoconnect_url = local.aqua_autoconnect_url
108+
aqua_bucket_name = local.aqua_bucket_name
109+
aqua_configuration_id = local.aqua_configuration_id
110+
aqua_cspm_group_id = local.aqua_cspm_group_id
111+
org_name = local.org_name
112+
project_id = each.value
113+
dedicated_project = local.dedicated
114+
labels = local.aqua_custom_labels
115+
onboarding_create_role_id = module.aqua_gcp_onboarding.create_role_id # Referencing outputs from the onboarding module
116+
onboarding_cspm_service_account_key = module.aqua_gcp_onboarding.cspm_service_account_key # Referencing outputs from the onboarding module
117+
onboarding_service_account_email = module.aqua_gcp_onboarding.service_account_email # Referencing outputs from the onboarding module
118+
onboarding_workload_identity_pool_id = module.aqua_gcp_onboarding.workload_identity_pool_id # Referencing outputs from the onboarding module
119+
onboarding_workload_identity_pool_provider_id = module.aqua_gcp_onboarding.workload_identity_pool_provider_id # Referencing outputs from the onboarding module
120+
onboarding_project_number = module.aqua_gcp_onboarding.project_number # Referencing outputs from the onboarding module
121+
depends_on = [module.aqua_gcp_onboarding]
122+
}
123+
124+
output "onboarding_status" {
125+
value = {
126+
for project_id, attachment_instance in module.aqua_gcp_projects_attachment :
127+
project_id => attachment_instance.onboarding_status
128+
}
129+
}

‎examples/organization-same-project-list/README.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Onboarding an Organization with Infrastructure in Each Project Using a Project List Example
2+
3+
---
4+
5+
## Overview
6+
7+
This example demonstrates how to onboard a Google Cloud Platform (GCP) organization for Aqua Security integration. It creates necessary infrastructure resources within each specified GCP project (`projects_list` local), and it creates the necessary infrastructure resources.
8+
9+
## Pre-requisites
10+
11+
Before running this example, ensure that you have the following:
12+
13+
1. Terraform installed (version 1.6.4 or later).
14+
2. `gcloud` CLI installed and configured.
15+
3. Aqua Security account API credentials.
16+
4. Appropriate permissions to manage resources at the organization level and within the specified projects.
17+
18+
## Usage
19+
20+
1. Obtain the Terraform configuration file generated by the Aqua platform.
21+
2. Important: Replace `<aqua_api_key>` and `<aqua_api_secret>` with your generated API credentials.
22+
3. Modify the `projects_list` local in the Terraform configuration to include the list of GCP project IDs you want to onboard, e.g.: `projects_list = ["my-project-id-1", "my-project-id-2"]`.
23+
4. Run `terraform init` to initialize the Terraform working directory.
24+
5. Run `terraform apply` to create the resources.
25+
26+
## What's Happening
27+
28+
1. The `aqua_gcp_onboarding` module is called for each GCP project specified in the `projects_list` variable to provision the necessary resources (service accounts, roles, networking, etc.).
29+
2. The `aqua_gcp_project_attachment` module is called for each specified GCP project to create the required IAM resources and trigger the Aqua API to onboard the project.
30+
31+
## Outputs
32+
33+
- `onboarding_status`: The output from the `aqua_gcp_project_attachment` module, displaying the result of the onboarding process for each project.
34+
35+
## Cleanup
36+
37+
To remove the resources created by this example, including the organization-level resources and project-specific resources, run `terraform destroy`.

‎examples/organization-same-project-list/main.tf‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
2+
# Defining local variables
3+
locals {
4+
region = "us-central1"
5+
dedicated = false
6+
type = "organization"
7+
org_name = "my-org-name"
8+
aqua_tenant_id = "12345"
9+
aqua_aws_account_id = "123456789101"
10+
aqua_bucket_name = "generic-bucket-name"
11+
aqua_configuration_id = "234e3cea-d84a-4b9e-bb36-92518e6a5772"
12+
aqua_cspm_group_id = 123456
13+
aqua_custom_labels = { label = "true" }
14+
aqua_api_key = "<REPLACE_ME>"
15+
aqua_api_secret = "<REPLACE_ME>"
16+
aqua_autoconnect_url = "https://example-aqua-autoconnect-url.com"
17+
aqua_volscan_api_token = "<REPLACE_ME>"
18+
aqua_volscan_api_url = "https://example-aqua-volscan-api-url.com"
19+
cspm_project_id = "" # project id where CSPM iam resources will be provisioned. If not set, it will be set by default to the first project in the organization
20+
labels = merge(local.aqua_custom_labels, { "aqua-agentless-scanner" = "true" })
21+
projects_list = ["my-project-id-1", "my-project-id-2"]
22+
}
23+
24+
################################
25+
26+
# Defining the root google provider
27+
provider "google" {
28+
region = local.region
29+
default_labels = local.labels
30+
}
31+
32+
# Getting google organization ID
33+
data "google_organization" "org" {
34+
domain = local.org_name
35+
}
36+
37+
################################
38+
39+
# Creating CSPM IAM resources
40+
module "aqua_gcp_cspm_iam" {
41+
source = "../../modules/cspm_iam"
42+
providers = {
43+
google = google
44+
}
45+
project_id = local.cspm_project_id == "" ? local.projects_list[0] : local.cspm_project_id
46+
aqua_bucket_name = local.aqua_bucket_name
47+
aqua_tenant_id = local.aqua_tenant_id
48+
org_id = data.google_organization.org.org_id
49+
}
50+
51+
################################
52+
53+
# Iterating over all project and creating discovery and scanning resources each project
54+
module "aqua_gcp_onboarding" {
55+
source = "../../"
56+
providers = {
57+
google.onboarding = google
58+
}
59+
for_each = toset(local.projects_list)
60+
type = local.type
61+
project_id = each.value
62+
dedicated_project = local.dedicated
63+
region = local.region
64+
org_name = local.org_name
65+
aqua_tenant_id = local.aqua_tenant_id
66+
aqua_aws_account_id = local.aqua_aws_account_id
67+
aqua_bucket_name = local.aqua_bucket_name
68+
aqua_volscan_api_token = local.aqua_volscan_api_token
69+
aqua_volscan_api_url = local.aqua_volscan_api_url
70+
}
71+
72+
################################
73+
74+
## Iterating over all project and creating attachment resources
75+
module "aqua_gcp_projects_attachment" {
76+
source = "../../modules/project_attachment"
77+
providers = {
78+
google = google
79+
}
80+
for_each = toset(local.projects_list)
81+
aqua_api_key = local.aqua_api_key
82+
type = local.type
83+
aqua_api_secret = local.aqua_api_secret
84+
aqua_autoconnect_url = local.aqua_autoconnect_url
85+
aqua_bucket_name = local.aqua_bucket_name
86+
aqua_configuration_id = local.aqua_configuration_id
87+
aqua_cspm_group_id = local.aqua_cspm_group_id
88+
org_name = local.org_name
89+
project_id = each.value
90+
dedicated_project = local.dedicated
91+
labels = local.aqua_custom_labels
92+
onboarding_create_role_id = module.aqua_gcp_onboarding[each.value].create_role_id # Referencing outputs from the onboarding module
93+
onboarding_service_account_email = module.aqua_gcp_onboarding[each.value].service_account_email # Referencing outputs from the onboarding module
94+
onboarding_cspm_service_account_key = module.aqua_gcp_cspm_iam.cspm_service_account_key # Referencing outputs from the cspm_iam module
95+
onboarding_workload_identity_pool_id = module.aqua_gcp_onboarding[each.value].workload_identity_pool_id # Referencing outputs from the onboarding module
96+
onboarding_workload_identity_pool_provider_id = module.aqua_gcp_onboarding[each.value].workload_identity_pool_provider_id # Referencing outputs from the onboarding module
97+
onboarding_project_number = module.aqua_gcp_onboarding[each.value].project_number # Referencing outputs from the onboarding module
98+
depends_on = [module.aqua_gcp_onboarding]
99+
}
100+
101+
output "onboarding_status" {
102+
value = {
103+
for project_id, attachment_instance in module.aqua_gcp_projects_attachment :
104+
project_id => attachment_instance.onboarding_status
105+
}
106+
}

‎examples/organization-same-project/README.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Onboarding an Organization with Infrastructure on Each Project Example
2+
3+
---
4+
5+
## Overview
6+
7+
This example demonstrates how to onboard a Google Cloud Platform (GCP) organization for Aqua Security integration. It creates necessary infrastructure resources within each GCP project.
8+
9+
## Pre-requisites
10+
11+
Before running this example, ensure that you have the following:
12+
13+
1. Terraform installed (version 1.6.4 or later).
14+
2. `gcloud` CLI installed and configured.
15+
3. Aqua Security account API credentials.
16+
4. Appropriate permissions to manage resources at the organization level and within the specified projects.
17+
18+
## Usage
19+
20+
1. Obtain the Terraform configuration file generated by the Aqua platform.
21+
2. Important: Replace `<aqua_api_key>` and `<aqua_api_secret>` with your generated API credentials.
22+
3. Run `terraform init` to initialize the Terraform working directory.
23+
4. Run `terraform apply` to create the resources.
24+
25+
## What's Happening
26+
27+
1. The `aqua_gcp_onboarding` module is called for each GCP project to provision the necessary resources (service accounts, roles, networking, etc.).
28+
2. The `aqua_gcp_project_attachment` module is called for each GCP project to create the required IAM resources and trigger the Aqua API to onboard the project.
29+
30+
## Outputs
31+
32+
- `onboarding_status`: The output from the `aqua_gcp_project_attachment` module, displaying the result of the onboarding process for each project.
33+
34+
## Cleanup
35+
36+
To remove the resources created by this example, including the organization-level resources and project-specific resources, run `terraform destroy`.

0 commit comments

Comments
 (0)