Skip to content

Commit e481833

Browse files
NoamstraussNoamstrauss
authored
Merge pull request #9 from aquasecurity/existing_service_account
Adding support for bringing your own service account
2 parents 1e77e34 + 91b27c8 commit e481833

File tree

30 files changed

+280
-99
lines changed

30 files changed

+280
-99
lines changed

‎README.md‎

Lines changed: 62 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ to enable seamless integration with Aqua’s platform.
2323
- [Excluding Projects Using Regex](#excluding-projects-using-regex)
2424
- [Using Dedicated Project](#using-an-existing-dedicated-project)
2525
- [Using Existing Network](#using-existing-network-and-firewall)
26+
- [Using Existing Service Accounts](#using-existing-service-accounts)
2627

2728
## Pre-requisites
2829

@@ -134,14 +135,15 @@ module "aqua_gcp_project_attachment" {
134135
aqua_cspm_group_id = local.aqua_cspm_group_id
135136
type = local.type
136137
org_name = local.org_name
137-
project_id = local.project_id # Existing project to be onboarded
138+
project_id = local.project_id # Existing project to be onboarded
138139
dedicated_project = local.dedicated
139140
labels = local.aqua_custom_labels
140141
onboarding_create_role_id = module.aqua_gcp_onboarding.create_role_id # Referencing outputs from the onboarding module
141142
onboarding_service_account_email = module.aqua_gcp_onboarding.service_account_email # Referencing outputs from the onboarding module
142143
onboarding_workload_identity_pool_id = module.aqua_gcp_onboarding.workload_identity_pool_id # Referencing outputs from the onboarding module
143144
onboarding_workload_identity_pool_provider_id = module.aqua_gcp_onboarding.workload_identity_pool_provider_id # Referencing outputs from the onboarding module
144145
onboarding_project_number = module.aqua_gcp_onboarding.project_number # Referencing outputs from the onboarding module
146+
onboarding_project_id = module.aqua_gcp_onboarding.project_id # Referencing outputs from the onboarding module
145147
depends_on = [module.aqua_gcp_onboarding]
146148
}
147149
@@ -275,15 +277,16 @@ module "aqua_gcp_projects_attachment" {
275277
aqua_configuration_id = local.aqua_configuration_id
276278
aqua_cspm_group_id = local.aqua_cspm_group_id
277279
org_name = local.org_name
278-
project_id = each.value # Referencing each project from given project id list
280+
project_id = each.value # Referencing each project from given project id list
279281
dedicated_project = local.dedicated
280282
labels = local.aqua_custom_labels
281-
onboarding_create_role_id = module.aqua_gcp_onboarding.create_role_id # Referencing outputs from the onboarding module
282-
onboarding_cspm_service_account_key = module.aqua_gcp_onboarding.cspm_service_account_key # Referencing outputs from the onboarding module
283+
onboarding_create_role_id = module.aqua_gcp_onboarding.create_role_id # Referencing outputs from the onboarding module
284+
onboarding_cspm_service_account_key = module.aqua_gcp_onboarding.cspm_service_account_key # Referencing outputs from the onboarding module
283285
onboarding_service_account_email = module.aqua_gcp_onboarding.service_account_email # Referencing outputs from the onboarding module
284286
onboarding_workload_identity_pool_id = module.aqua_gcp_onboarding.workload_identity_pool_id # Referencing outputs from the onboarding module
285287
onboarding_workload_identity_pool_provider_id = module.aqua_gcp_onboarding.workload_identity_pool_provider_id # Referencing outputs from the onboarding module
286288
onboarding_project_number = module.aqua_gcp_onboarding.project_number # Referencing outputs from the onboarding module
289+
onboarding_project_id = module.aqua_gcp_onboarding.project_id # Referencing outputs from the onboarding module
287290
depends_on = [module.aqua_gcp_onboarding]
288291
}
289292
@@ -298,7 +301,7 @@ For more examples and use cases, please refer to the examples folder in the repo
298301

299302
## Providing Project ID List
300303

301-
By default we fetch all active projects and use that project list, but you can also provide your own list of project IDs by populating the `projects_list` local. To accommodate this, ensure to remove the `module.aqua_gcp_org_projects` and then replace the local `projects_list` with your list.
304+
By default, we fetch all active projects and use that project list, but you can also provide your own list of project IDs by populating the `projects_list` local. To accommodate this, ensure to remove the `module.aqua_gcp_org_projects` and then replace the local `projects_list` with your list.
302305

303306
```hcl
304307
locals {
@@ -370,23 +373,68 @@ For example, if your Aqua tenant ID is `12345` and the first six characters of t
370373

371374
## Using Existing Network and Firewall
372375

373-
374376
If you prefer to use an existing network and firewall instead of creating new ones,
375377
you can do so by setting `create_network = false` in the onboarding module input variables.
376378
In this case, you will need to create,
377379
prior to onboarding, network and firewall resources with the following naming convention:
378380

379-
Dedicated project:
380-
* Firewall: `<project_id>-rules-aqua-aas`
381-
* Network: `<project_id>-network`
381+
### Dedicated project:
382+
* **Firewall**: `<project_id>-rules-aqua-aas`
383+
* **Network**: `<project_id>-network`
382384

383-
Same project:
384-
* Firewall: `<project_id>-rules-<aqua_tenant_id>aqua-aas`
385-
* Network: `<project_id>-network-<aqua_tenant_id>`
385+
### Same project:
386+
* **Firewall**: `<project_id>-rules-<aqua_tenant_id>aqua-aas`
387+
* **Network**: `<project_id>-network-<aqua_tenant_id>`
386388

387389
When using a dedicated project, the `<project_id>` should follow the format `"aqua-agentless-${local.tenant_id}-${local.org_hash}"` as mentioned above.
388390

389391

392+
## Using Existing Service Accounts
393+
394+
By default, this module creates the necessary service accounts for you.
395+
396+
However, you can use existing service accounts by adding the flag `create_service_account = false` in the module’s input variables.
397+
398+
In dedicated project mode, ensure to create the service accounts within your provided dedicated project. Refer to the section [Using Dedicated Project](#using-an-existing-dedicated-project) for guidance on this setup.
399+
400+
Prior to onboarding, create the required service account and service account key resources with the following configurations:
401+
402+
### Service Account Configuration
403+
- **CSPM Service Account Name**: `aqua-cspm-scanner-<aqua_tenant_id>`
404+
- **CSPM Service Account Project ID**:
405+
- Same: `<project_id>`
406+
- Dedicated: `<dedicated_project_id>`
407+
- **CSPM Service Account Key Format**: `json`
408+
- **Agentless Service Account Name**: `aqua-agentless-sa-<aqua_tenant_id>`
409+
- **Agentless Service Account Project ID**:
410+
- Same: each `<project_id>`
411+
- Dedicated: `<dedicated_project_id>`
412+
413+
414+
After creating the required resources, supply the base64 encoded service account key for the CSPM service account in the `onboarding_cspm_service_account_key` parameter in the `aqua_gcp_projects_attachment` module.
415+
Ensure to set `create_service_account` to `false` in both `aqua_gcp_onboarding` and `aqua_gcp_projects_attachment` modules, as well as `aqua_gcp_cspm_iam` module during organization same project mode, to skip the creation of service accounts.
416+
417+
For example:
418+
419+
```hcl
420+
module "aqua_gcp_onboarding" {
421+
source = "../../"
422+
#(unchanged)
423+
create_service_account = false # Set to false to skip service accounts creation
424+
#(unchanged)
425+
}
426+
427+
module "aqua_gcp_projects_attachment" {
428+
source = "../../modules/project_attachment"
429+
#(unchanged)
430+
create_service_account = false # Set to false to skip service accounts creation
431+
onboarding_cspm_service_account_key = "<base64-encoded-service-account-key>" # Referencing CSPM base64 encoded service account key created prior to onboarding
432+
# You can optionally provide a decrypted service account key and use filebase64 function to encode it
433+
# onboarding_cspm_service_account_key = filebase64("${path.module}/decoded_service_account_key.json")
434+
#(unchanged)
435+
}
436+
```
437+
390438
<!-- BEGIN_TF_DOCS -->
391439
## Requirements
392440

@@ -428,7 +476,9 @@ When using a dedicated project, the `<project_id>` should follow the format `"aq
428476
| <a name="input_aqua_volscan_api_url"></a> [aqua\_volscan\_api\_url](#input\_aqua\_volscan\_api\_url) | Aqua volume scanning API URL | `string` | n/a | yes |
429477
| <a name="input_create_network"></a> [create\_network](#input\_create\_network) | Toggle to create network resources | `bool` | `true` | no |
430478
| <a name="input_create_role_name"></a> [create\_role\_name](#input\_create\_role\_name) | The name of the role to be created for Aqua | `string` | `"AquaAutoConnectAgentlessRole"` | no |
479+
| <a name="input_create_service_account"></a> [create\_service\_account](#input\_create\_service\_account) | Toggle to create service account | `bool` | `true` | no |
431480
| <a name="input_cspm_role_name"></a> [cspm\_role\_name](#input\_cspm\_role\_name) | The name of the role used for CSPM | `string` | `"AquaAutoConnectCSPMRole"` | no |
481+
| <a name="input_cspm_service_account_name"></a> [cspm\_service\_account\_name](#input\_cspm\_service\_account\_name) | Name of the CSPM service account. If not provided, the default value is set to 'aqua-cspm-scanner-<aqua\_tenant\_id>' in the 'cspm\_service\_account\_name' local | `string` | `null` | no |
432482
| <a name="input_dedicated_project"></a> [dedicated\_project](#input\_dedicated\_project) | Indicates whether dedicated project is enabled | `bool` | `true` | no |
433483
| <a name="input_delete_role_name"></a> [delete\_role\_name](#input\_delete\_role\_name) | The name of the role used for deleting Aqua resources | `string` | `"AutoConnectDeleteRole"` | no |
434484
| <a name="input_identity_pool_name"></a> [identity\_pool\_name](#input\_identity\_pool\_name) | Name of the identity pool. If not provided, the default value is set to 'aqua-agentless-pool-<aqua\_tenant\_id>' in the 'identity\_pool\_name' local | `string` | `null` | no |

‎examples/organization-dedicated-project/main.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,7 @@ module "aqua_gcp_projects_attachment" {
105105
for_each = toset(local.projects_list)
106106
aqua_api_key = local.aqua_api_key
107107
type = local.type
108+
aqua_tenant_id = local.aqua_tenant_id
108109
aqua_api_secret = local.aqua_api_secret
109110
aqua_autoconnect_url = local.aqua_autoconnect_url
110111
aqua_bucket_name = local.aqua_bucket_name
@@ -120,6 +121,7 @@ module "aqua_gcp_projects_attachment" {
120121
onboarding_workload_identity_pool_id = module.aqua_gcp_onboarding.workload_identity_pool_id # Referencing outputs from the onboarding module
121122
onboarding_workload_identity_pool_provider_id = module.aqua_gcp_onboarding.workload_identity_pool_provider_id # Referencing outputs from the onboarding module
122123
onboarding_project_number = module.aqua_gcp_onboarding.project_number # Referencing outputs from the onboarding module
124+
onboarding_project_id = module.aqua_gcp_onboarding.project_id # Referencing outputs from the onboarding module
123125
depends_on = [module.aqua_gcp_onboarding]
124126
}
125127

‎examples/organization-same-project-list/main.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,7 @@ module "aqua_gcp_projects_attachment" {
8080
for_each = toset(local.projects_list)
8181
aqua_api_key = local.aqua_api_key
8282
type = local.type
83+
aqua_tenant_id = local.aqua_tenant_id
8384
aqua_api_secret = local.aqua_api_secret
8485
aqua_autoconnect_url = local.aqua_autoconnect_url
8586
aqua_bucket_name = local.aqua_bucket_name
@@ -95,6 +96,7 @@ module "aqua_gcp_projects_attachment" {
9596
onboarding_workload_identity_pool_id = module.aqua_gcp_onboarding[each.value].workload_identity_pool_id # Referencing outputs from the onboarding module
9697
onboarding_workload_identity_pool_provider_id = module.aqua_gcp_onboarding[each.value].workload_identity_pool_provider_id # Referencing outputs from the onboarding module
9798
onboarding_project_number = module.aqua_gcp_onboarding[each.value].project_number # Referencing outputs from the onboarding module
99+
onboarding_project_id = local.project_id
98100
depends_on = [module.aqua_gcp_onboarding]
99101
}
100102

‎examples/organization-same-project/main.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,7 @@ module "aqua_gcp_projects_attachment" {
9696
for_each = toset(local.projects_list)
9797
aqua_api_key = local.aqua_api_key
9898
type = local.type
99+
aqua_tenant_id = local.aqua_tenant_id
99100
aqua_api_secret = local.aqua_api_secret
100101
aqua_autoconnect_url = local.aqua_autoconnect_url
101102
aqua_bucket_name = local.aqua_bucket_name
@@ -111,6 +112,7 @@ module "aqua_gcp_projects_attachment" {
111112
onboarding_workload_identity_pool_id = module.aqua_gcp_onboarding[each.value].workload_identity_pool_id # Referencing outputs from the onboarding module
112113
onboarding_workload_identity_pool_provider_id = module.aqua_gcp_onboarding[each.value].workload_identity_pool_provider_id # Referencing outputs from the onboarding module
113114
onboarding_project_number = module.aqua_gcp_onboarding[each.value].project_number # Referencing outputs from the onboarding module
115+
onboarding_project_id = local.project_id
114116
depends_on = [module.aqua_gcp_onboarding]
115117
}
116118

‎examples/single-dedicated-project-addition/main.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,7 @@ module "aqua_gcp_project_attachment" {
8585
aqua_configuration_id = local.aqua_configuration_id
8686
aqua_cspm_group_id = local.aqua_cspm_group_id
8787
type = local.type
88+
aqua_tenant_id = local.aqua_tenant_id
8889
org_name = local.org_name
8990
project_id = local.project_id
9091
dedicated_project = local.dedicated
@@ -94,6 +95,7 @@ module "aqua_gcp_project_attachment" {
9495
onboarding_workload_identity_pool_id = module.aqua_gcp_onboarding.workload_identity_pool_id # Referencing outputs from the onboarding module
9596
onboarding_workload_identity_pool_provider_id = module.aqua_gcp_onboarding.workload_identity_pool_provider_id # Referencing outputs from the onboarding module
9697
onboarding_project_number = module.aqua_gcp_onboarding.project_number # Referencing outputs from the onboarding module
98+
onboarding_project_id = module.aqua_gcp_onboarding.project_id # Referencing outputs from the onboarding module
9799
depends_on = [module.aqua_gcp_onboarding]
98100
}
99101

@@ -124,6 +126,7 @@ module "aqua_gcp_additional_project_attachment" {
124126
aqua_configuration_id = local.aqua_configuration_id
125127
aqua_cspm_group_id = local.aqua_cspm_group_id
126128
type = local.type
129+
aqua_tenant_id = local.aqua_tenant_id
127130
org_name = local.org_name
128131
project_id = local.project_id
129132
dedicated_project = local.dedicated
@@ -133,6 +136,7 @@ module "aqua_gcp_additional_project_attachment" {
133136
onboarding_workload_identity_pool_id = module.aqua_gcp_onboarding.workload_identity_pool_id # Referencing outputs from the onboarding module
134137
onboarding_workload_identity_pool_provider_id = module.aqua_gcp_onboarding.workload_identity_pool_provider_id # Referencing outputs from the onboarding module
135138
onboarding_project_number = module.aqua_gcp_onboarding.project_number # Referencing outputs from the onboarding module
139+
onboarding_project_id = module.aqua_gcp_onboarding.project_id # Referencing outputs from the onboarding module
136140
depends_on = [module.aqua_gcp_onboarding]
137141
}
138142

‎examples/single-dedicated-project/main.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,7 @@ module "aqua_gcp_project_attachment" {
8484
aqua_bucket_name = local.aqua_bucket_name
8585
aqua_configuration_id = local.aqua_configuration_id
8686
aqua_cspm_group_id = local.aqua_cspm_group_id
87+
aqua_tenant_id = local.aqua_tenant_id
8788
type = local.type
8889
org_name = local.org_name
8990
project_id = local.project_id
@@ -94,6 +95,7 @@ module "aqua_gcp_project_attachment" {
9495
onboarding_workload_identity_pool_id = module.aqua_gcp_onboarding.workload_identity_pool_id # Referencing outputs from the onboarding module
9596
onboarding_workload_identity_pool_provider_id = module.aqua_gcp_onboarding.workload_identity_pool_provider_id # Referencing outputs from the onboarding module
9697
onboarding_project_number = module.aqua_gcp_onboarding.project_number # Referencing outputs from the onboarding module
98+
onboarding_project_id = module.aqua_gcp_onboarding.project_id # Referencing outputs from the onboarding module
9799
depends_on = [module.aqua_gcp_onboarding]
98100
}
99101

‎examples/single-same-project/main.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ module "aqua_gcp_project_attachment" {
6464
aqua_configuration_id = local.aqua_configuration_id
6565
aqua_cspm_group_id = local.aqua_cspm_group_id
6666
type = local.type
67+
aqua_tenant_id = local.aqua_tenant_id
6768
org_name = local.org_name
6869
project_id = local.project_id
6970
dedicated_project = local.dedicated
@@ -73,6 +74,7 @@ module "aqua_gcp_project_attachment" {
7374
onboarding_workload_identity_pool_id = module.aqua_gcp_onboarding.workload_identity_pool_id # Referencing outputs from the onboarding module
7475
onboarding_workload_identity_pool_provider_id = module.aqua_gcp_onboarding.workload_identity_pool_provider_id # Referencing outputs from the onboarding module
7576
onboarding_project_number = module.aqua_gcp_onboarding.project_number # Referencing outputs from the onboarding module
77+
onboarding_project_id = module.aqua_gcp_onboarding.project_id # Referencing outputs from the onboarding module
7678
depends_on = [module.aqua_gcp_onboarding]
7779
}
7880

0 commit comments

Comments
 (0)