Skip to content

Commit f89c866

Browse files
semyonmorsemyonmor
authored
Merge pull request #1 from aquasecurity/SAAS-23305
[SAAS-23305]: Onboarding | Terraform for GCP Account
2 parents a57f050 + 0a7b4f1 commit f89c866

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

70 files changed

+2882
-10
lines changed

‎.github/workflows/terraform-docs.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
name: Generate terraform docs
2+
on:
3+
- pull_request
4+
jobs:
5+
docs:
6+
runs-on: ubuntu-20.04
7+
steps:
8+
- uses: actions/checkout@v3
9+
with:
10+
ref: ${{ github.event.pull_request.head.ref }}
11+
12+
- name: Render terraform docs and push changes back to PR
13+
uses: terraform-docs/[email protected]
14+
with:
15+
working-dir: .
16+
output-file: README.md
17+
scan-ref: '.'
18+
scan-type: 'repo'
19+
output-method: inject
20+
git-push: "true"

‎.github/workflows/trivy-scan.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: Trivy
2+
on: pull_request
3+
jobs:
4+
aqua:
5+
name: Aqua scanner
6+
runs-on: ubuntu-20.04
7+
steps:
8+
- name: Checkout code
9+
uses: actions/checkout@v2
10+
11+
- name: Run Aqua scanner
12+
uses: docker://aquasec/aqua-scanner
13+
with:
14+
args: trivy fs --scanners misconfig,secret .
15+
env:
16+
AQUA_KEY: ${{ secrets.AQUA_KEY }}
17+
AQUA_SECRET: ${{ secrets.AQUA_SECRET }}
18+
GITHUB_TOKEN: ${{ github.token }}
19+
TRIVY_RUN_AS_PLUGIN: 'aqua'

‎.gitignore‎

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,22 @@
11
# Local .terraform directories
2-
**/.terraform/*
2+
**/.terraform*
3+
4+
# generated via "make ci"
5+
examples/**/.terraform.lock.hcl
36

47
# .tfstate files
58
*.tfstate
69
*.tfstate.*
710

811
# Crash log files
912
crash.log
10-
crash.*.log
1113

12-
# Exclude all .tfvars files, which are likely to contain sensitive data, such as
13-
# password, private keys, and other secrets. These should not be part of version
14-
# control as they are data points which are potentially sensitive and subject
15-
# to change depending on the environment.
14+
# Ignore any .tfvars files that are generated automatically for each Terraform run. Most
15+
# .tfvars files are managed as part of configuration and so should be included in
16+
# version control.
17+
#
18+
# example.tfvars
1619
*.tfvars
17-
*.tfvars.json
1820

1921
# Ignore override files as they are usually used to override resources locally and so
2022
# are not checked in
@@ -24,11 +26,20 @@ override.tf.json
2426
*_override.tf.json
2527

2628
# Include override files you do wish to add to version control using negated pattern
29+
#
2730
# !example_override.tf
2831

2932
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
3033
# example: *tfplan*
3134

32-
# Ignore CLI configuration files
33-
.terraformrc
34-
terraform.rc
35+
# Credentials Files
36+
**/credentials.json
37+
**/*.json
38+
39+
# Local testing variables
40+
41+
# vim
42+
*.swp
43+
44+
/.idea/
45+
.DS_Store

‎README.md‎

Lines changed: 265 additions & 0 deletions
Large diffs are not rendered by default.

‎data.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# data.tf
2+
3+
# Retrieve information about the Google Cloud organization
4+
data "google_organization" "organization" {
5+
domain = var.org_name
6+
}
7+
8+
# Retrieve information about the root Google Cloud project
9+
data "google_project" "project" {
10+
project_id = var.project_id
11+
}
12+
13+

‎examples/dedicated-project/README.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# GCP Dedicated Project Onboarding Example
2+
3+
---
4+
5+
## Overview
6+
7+
This example demonstrates how to onboard a GCP project by creating a dedicated project to provision all of Aqua’s resources into and apply the required labels for Aqua Security integration.
8+
9+
## Pre-requisites
10+
11+
Before running this example, ensure that you have the following:
12+
13+
1. Terraform installed (version 1.6.4 or later).
14+
2. `Gcloud` CLI installed and configured.
15+
3. Aqua Security account API credentials.
16+
17+
## Usage
18+
19+
1. Obtain the Terraform configuration file generated by the Aqua Security UI.
20+
2. Important: Replace `<aqua_api_key>` and `<aqua_api_secret>` with your generated API credentials.
21+
3. Run `terraform init` to initialize the Terraform working directory.
22+
4. Run `terraform apply` to create the dedicated project.
23+
24+
## What's Happening
25+
26+
1. The `aqua_gcp_dedicated_project` module is called to create a dedicated GCP project with the name `aqua-agentless-<tenant_id>-<org_hash>`, where `org_hash` is the first six characters of the SHA1 hash of your organization name.
27+
2. The `aqua_gcp_onboarding` module is called to provision the necessary resources (service accounts, roles, networking, etc.) in the dedicated GCP project.
28+
3. The `aqua_gcp_project_attachment` module is called to create the required IAM resources in the existing project and trigger the Aqua API to onboard the project.
29+
30+
31+
## Outputs
32+
33+
- `onboarding_status`: The output from the `aqua_gcp_project_attachment` module, displaying the result of the onboarding process.
34+
35+
## Cleanup
36+
37+
To remove the dedicated project created by this example, run `terraform destroy`.

‎examples/dedicated-project/main.tf‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
2+
# Defining local variables
3+
locals {
4+
region = "us-central1"
5+
dedicated = true
6+
type = "single"
7+
org_name = "<org_name>"
8+
aqua_tenant_id = "<tenant_id>"
9+
project_id = "<project_id>"
10+
aqua_aws_account_id = "123456789101"
11+
aqua_bucket_name = "<aqua_bucket_name>"
12+
aqua_configuration_id = "<aqua_configuration_id>"
13+
aqua_cspm_group_id = 123456
14+
aqua_custom_labels = {}
15+
aqua_api_key = "<aqua_api_key>"
16+
aqua_api_secret = "<aqua_api_secret>"
17+
aqua_autoconnect_url = "https://<aqua_autoconnect_url>.com"
18+
aqua_volscan_api_token = "<aqua_volscan_api_token>"
19+
aqua_volscan_api_url = "https://<aqua_volscan_api_url>.com"
20+
dedicated_project_id = "aqua-agentless-${local.aqua_tenant_id}-${local.org_hash}"
21+
labels = merge(local.aqua_custom_labels, { "aqua-agentless-scanner" = "true" })
22+
org_hash = substr(sha1(local.org_name), 0, 6)
23+
}
24+
25+
################################
26+
27+
# Defining the root google provider
28+
provider "google" {
29+
project = local.project_id
30+
region = local.region
31+
default_labels = local.labels
32+
}
33+
34+
# Creating a dedicated project
35+
module "aqua_gcp_dedicated_project" {
36+
source = "../../modules/dedicated_project"
37+
org_name = local.org_name
38+
project_id = local.dedicated_project_id
39+
root_project_id = local.project_id
40+
labels = local.labels
41+
}
42+
43+
################################
44+
45+
# Defining the dedicated google provider
46+
provider "google" {
47+
alias = "dedicated"
48+
project = module.aqua_gcp_dedicated_project.project_id
49+
region = local.region
50+
default_labels = local.labels
51+
}
52+
53+
# Creating discovery and scanning resources on the project
54+
module "aqua_gcp_onboarding" {
55+
source = "../../"
56+
providers = {
57+
google.onboarding = google.dedicated
58+
}
59+
type = local.type
60+
project_id = module.aqua_gcp_dedicated_project.project_id
61+
region = local.region
62+
org_name = local.org_name
63+
aqua_tenant_id = local.aqua_tenant_id
64+
aqua_aws_account_id = local.aqua_aws_account_id
65+
aqua_bucket_name = local.aqua_bucket_name
66+
aqua_custom_labels = local.aqua_custom_labels
67+
aqua_volscan_api_token = local.aqua_volscan_api_token
68+
aqua_volscan_api_url = local.aqua_volscan_api_url
69+
depends_on = [module.aqua_gcp_dedicated_project]
70+
}
71+
72+
################################
73+
74+
## Onboarding a project and attaching it to the dedicated project
75+
module "aqua_gcp_project_attachment" {
76+
source = "../../modules/project_attachment"
77+
providers = {
78+
google = google
79+
}
80+
aqua_api_key = local.aqua_api_key
81+
aqua_api_secret = local.aqua_api_secret
82+
aqua_autoconnect_url = local.aqua_autoconnect_url
83+
aqua_bucket_name = local.aqua_bucket_name
84+
aqua_configuration_id = local.aqua_configuration_id
85+
aqua_cspm_group_id = local.aqua_cspm_group_id
86+
org_name = local.org_name
87+
project_id = local.project_id
88+
dedicated_project = local.dedicated
89+
labels = local.aqua_custom_labels
90+
create_role_id = module.aqua_gcp_onboarding.create_role_id
91+
onboarding_service_account_email = module.aqua_gcp_onboarding.service_account_email
92+
onboarding_workload_identity_pool_id = module.aqua_gcp_onboarding.workload_identity_pool_id
93+
onboarding_workload_identity_pool_provider_id = module.aqua_gcp_onboarding.workload_identity_pool_provider_id
94+
onboarding_project_number = module.aqua_gcp_onboarding.project_number
95+
depends_on = [module.aqua_gcp_onboarding]
96+
}
97+
98+
output "onboarding_status" {
99+
value = module.aqua_gcp_project_attachment.onboarding_status
100+
}

‎examples/same-project/README.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# GCP Same Project Onboarding Example
2+
3+
---
4+
5+
## Overview
6+
7+
This example demonstrates how to onboard an existing Google Cloud Platform (GCP) project to Aqua Security by provisioning all the necessary resources directly into the existing project, without creating a dedicated project.
8+
9+
## Prerequisites
10+
11+
Before running this example, ensure that you have the following:
12+
13+
1. Terraform installed (version 1.6.4 or later).
14+
2. `gcloud` CLI installed and configured.
15+
3. Aqua Security account and API credentials.
16+
17+
## Usage
18+
19+
1. Obtain the Terraform configuration file generated by the Aqua Security UI.
20+
2. Replace the placeholders `<aqua_api_key>` and `<aqua_api_secret>` with your actual Aqua Security API key and secret.
21+
3. Run `terraform init` to initialize the Terraform working directory.
22+
4. Run `terraform apply` to create the resources.
23+
24+
## What's Happening
25+
26+
1. The `aqua_gcp_onboarding` module is called to provision the necessary resources (service accounts, roles, networking, etc.) directly in the existing GCP project.
27+
2. The `aqua_gcp_project_attachment` module is called to create the required IAM resources in the existing project and trigger the Aqua API to onboard the project.
28+
29+
## Outputs
30+
31+
- `onboarding_status`: The output from the `aqua_gcp_project_attachment` module, displaying the result of the onboarding process.
32+
33+
## Cleanup
34+
35+
To remove the resources created by this example, run `terraform destroy`.

‎examples/same-project/main.tf‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
2+
# Defining local variables
3+
locals {
4+
region = "us-central1"
5+
dedicated = false
6+
type = "single"
7+
org_name = "<org_name>"
8+
aqua_tenant_id = "<tenant_id>"
9+
project_id = "<project_id>"
10+
aqua_aws_account_id = "123456789101"
11+
aqua_bucket_name = "<aqua_bucket_name>"
12+
aqua_configuration_id = "<aqua_configuration_id>"
13+
aqua_cspm_group_id = 123456
14+
aqua_custom_labels = { label = "true" }
15+
aqua_api_key = "<aqua_api_key>"
16+
aqua_api_secret = "<aqua_api_secret>"
17+
aqua_autoconnect_url = "https://<aqua_autoconnect_url>.com"
18+
aqua_volscan_api_token = "<aqua_volscan_api_token>"
19+
aqua_volscan_api_url = "https://<aqua_volscan_api_url>.com"
20+
dedicated_project_id = "aqua-agentless-${local.aqua_tenant_id}-${local.org_hash}"
21+
labels = merge(local.aqua_custom_labels, { "aqua-agentless-scanner" = "true" })
22+
org_hash = substr(sha1(local.org_name), 0, 6)
23+
}
24+
25+
################################
26+
27+
# Defining the root google provider
28+
provider "google" {
29+
project = local.project_id # Existing project to be onboarded
30+
region = local.region
31+
default_labels = local.labels
32+
}
33+
34+
################################
35+
36+
# Creating discovery and scanning resources on the project
37+
module "aqua_gcp_onboarding" {
38+
source = "../.."
39+
providers = {
40+
google.onboarding = google # Using the root project provider
41+
}
42+
type = local.type
43+
project_id = local.project_id
44+
region = local.region
45+
org_name = local.org_name
46+
aqua_tenant_id = local.aqua_tenant_id
47+
aqua_aws_account_id = local.aqua_aws_account_id
48+
aqua_bucket_name = local.aqua_bucket_name
49+
aqua_custom_labels = local.aqua_custom_labels
50+
aqua_volscan_api_token = local.aqua_volscan_api_token
51+
aqua_volscan_api_url = local.aqua_volscan_api_url
52+
}
53+
54+
################################
55+
56+
## Attaching the existing project to the onboarding resources
57+
module "aqua_gcp_project_attachment" {
58+
source = "../../modules/project_attachment"
59+
providers = {
60+
google = google # Using the root project provider
61+
}
62+
aqua_api_key = local.aqua_api_key
63+
aqua_api_secret = local.aqua_api_secret
64+
aqua_autoconnect_url = local.aqua_autoconnect_url
65+
aqua_bucket_name = local.aqua_bucket_name
66+
aqua_configuration_id = local.aqua_configuration_id
67+
aqua_cspm_group_id = local.aqua_cspm_group_id
68+
org_name = local.org_name
69+
project_id = local.project_id
70+
dedicated_project = local.dedicated
71+
labels = local.aqua_custom_labels
72+
create_role_id = module.aqua_gcp_onboarding.create_role_id # Referencing outputs from the onboarding module
73+
onboarding_service_account_email = module.aqua_gcp_onboarding.service_account_email # Referencing outputs from the onboarding module
74+
onboarding_workload_identity_pool_id = module.aqua_gcp_onboarding.workload_identity_pool_id # Referencing outputs from the onboarding module
75+
onboarding_workload_identity_pool_provider_id = module.aqua_gcp_onboarding.workload_identity_pool_provider_id # Referencing outputs from the onboarding module
76+
onboarding_project_number = module.aqua_gcp_onboarding.project_number # Referencing outputs from the onboarding module
77+
depends_on = [module.aqua_gcp_onboarding]
78+
}
79+
80+
81+
output "onboarding_status" {
82+
value = module.aqua_gcp_project_attachment.onboarding_status
83+
}

0 commit comments

Comments
 (0)