feat: add preflight check tool

[kirklandnuts]

Summary

This PR introduces a tool which helps users smoothly deploy AWLS on Azure by

1. interactively prompting the user for details on how they'd like to deploy AWLS
2. checking whether or not they have sufficient permissions to deploy AWLS via this terraform module
3. checking the usage quota limits for their scanning subscription are sufficient for the # of VMs expected to be monitored by AWLS in a given scan

The tool is a python module that lives in /preflight_check. Usage instructions are included at /preflight_check/README.md.

Future work:

1. Modify the terraform module so that, by default, it requires the user to have run the preflight check before executing the module.

• The TF module will read the output json file produced by the preflight check and validate that the permission checks and quota checks have succeeded.

1. Have the preflight check generate the input variables for the terraform module based on the deployment config they specified to the preflight check.

• The user should be able to run the preflight check, then immediately execute the terraform module without having to create the script

How did you test this change?

I created a SP as instructed in the preflight check README, then I ran the preflight check and verified that it

1. observed that the SP had all of the required permissions and was able to identify the role that satisfied each required permission.
2. properly calculated the required usage quotas
3. emitted a json output file that aligned with my expectations

Issue

AWLS2-368

[wilderj]

Just an aside, but we should follow up with the docs team to include reference to this tool after we merge and release.

[wilderj]

just curious, why do we need this?

[kirklandnuts]

It defines the scope for what's imported when a caller imports * from this package.

if a package’s __init__.py code defines a list named __all__, it is taken to be the list of module names that should be imported when from package import * is encountered.

source

[wilderj]

Really fantastic work here @kirklandnuts 👊 !

[PengyuanZhao]

We product platform team (growth team) built a CLI tool lacework preflight to do preflight check across all CSPs/ integrations here https://github.com/lacework-dev/cdk-preflight. It has minimal check on Azure currently but already fully supports AWS/GCP. Seems like we are making duplicated efforts in different ways.

Questions:

• Why do you do preflight check only for this Agentless module but not the other modules? I assume it's a question more about using cdk-preflight VS doing preflight check in every single module.
• If user to have run the preflight check before executing the module., how would the upstream dependencies be affected? We have CLI commands and self-deployment service that heavily depend on Terraform modules. The Terraform modules shouldn't be overburdened and their behavior should remain unchanged.

[kirklandnuts]

We product platform team (growth team) built a CLI tool lacework preflight to do preflight check across all CSPs/ integrations here https://github.com/lacework-dev/cdk-preflight. It has minimal check on Azure currently but already fully supports AWS/GCP. Seems like we are making duplicated efforts in different ways.

@PengyuanZhao thanks for raising this — I wasn't aware that we had an existing preflight check tool.

• Why do you do preflight check only for this Agentless module but not the other modules? I assume it's a question more about using cdk-preflight VS doing preflight check in every single module.

Depending on the feedback we receive on this tool, we'd planned to do implement something similar for other AWLS modules (https://github.com/lacework/terraform-aws-agentless-scanning/ and https://github.com/lacework/terraform-gcp-agentless-scanning). With regards to modules beyond those pertaining to AWLS, it simply comes down to the fact that our team is not acutely aware of what conditions need to be checked to ensure successful deployment of those components, so we would not be the ones to implement such checks.

• If user to have run the preflight check before executing the module., how would the upstream dependencies be affected? We have CLI commands and self-deployment service that heavily depend on Terraform modules. The Terraform modules shouldn't be overburdened and their behavior should remain unchanged.

As of right now, we are not enforcing the requirement that users must have run the preflight check before they can execute the module — this is being tracked as a separate follow-up task AWLS2-490. For context, the way we're considering enforcing this requirement is by having the module read the preflight check output file and validate that the checks had passed. In any case, when we make this change, we will also add a new input variable (e.g., skip_preflight (bool) that would enable users to opt out of the preflight check validation. Upstream dependencies would specify this input to maintain existing behavior — to ensure smooth transition, we could default the new input variable to True, start modifying those CLI commands and self-deployment services you'd mentioned to specify skip_preflight = True, and finally switch the default to False only after those changes are released.

Given the checks being performed by this tool, do you think that it's something that the platform team can replicate within the lacework preflight tool? If not, or until these checks have been integrated into lacework preflight, we can publish and maintain this tool separately. What do you think?

[PengyuanZhao]

@kirklandnuts thanks for the clarification!

As a lot of work has been done on lacework preflight, there is no need to go to the other path to let each team build such checks into each module. And technically the preflight check has lots of duplicate logic/code between different modules, especially the ones from the same CSP. So doing it centrally is better than separately. That being said, having this tool separately for Agentless won't hurt much for now I guess.

The skip_preflight param sounds great. But I believe we should provide a coherent preflight check experience not only for Agentless, but also for all the other modules(like AWS config, GCP config, etc.), otherwise it will confuse customers. So I would suggest we always make it optional(skip_preflight=true) for Agentless, unless we really choose to have preflight checks in every module.

Our team would add it to our roadmap to replicate this within lacework preflight. Hopefully the tools could converge somehow by then. For example, we could serve all the module preflight checks as libraries from our go-sdk. So they can be independently imported and used by Terraform modules, CLI commands or self-deployment.