Skip to content

Commit 1b82efe

Browse files
ravinadhruve10ravinadhruve10
authored
feat(modules): Support for include/exclude parameters (#145)
* feat(modules): Support for include/exclude parameters Change summary: ---------------- Adding new CFT template parameters to support include/exclude OUs and accounts. * Honor include/exclude params in deployment targets * Update cfn-lint version * Test without cfn-lint version * Temp remove to avoid lint checks * Add back the commented lines * Fix version command for GHA * Fix length function * Get rid of extensions * Lint fixes * Update all templates * Remove PARAM_EXCLUDE_OU_IDS since its a NOOP * Support migration by always checking OrganizationalUnitIDs first * Update modules README * Fix typo
1 parent 9b96bd5 commit 1b82efe

File tree

7 files changed

+461
-20
lines changed

7 files changed

+461
-20
lines changed

‎.github/workflows/ci-modules.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
- name: cfn-lint
2727
uses: scottbrenner/cfn-lint-action@v2
2828
with:
29-
version: 1.18.3
29+
version: "==1.18.3"
3030

3131
- name: Lint
3232
working-directory: modules

‎modules/Makefile‎

Lines changed: 25 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,11 @@ deploy:
5050
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
5151
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
5252
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
53-
"Partition=${PARAM_PARTITION}"
53+
"Partition=${PARAM_PARTITION}" \
54+
"RootOUID=$(PARAM_ROOT_OU_ID)" \
55+
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
56+
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
57+
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"
5458
aws cloudformation deploy \
5559
--stack-name $(STACK_NAME)-LogIngestion-EventBridge-$(PARAM_NAME_SUFFIX) \
5660
--template-file log_ingestion.events.cft.yaml \
@@ -63,7 +67,11 @@ deploy:
6367
"TargetEventBusARN=$(PARAM_TARGET_EVENT_BUS_ARN)" \
6468
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
6569
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
66-
"Partition=${PARAM_PARTITION}"
70+
"Partition=${PARAM_PARTITION}" \
71+
"RootOUID=$(PARAM_ROOT_OU_ID)" \
72+
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
73+
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
74+
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"
6775
aws cloudformation deploy \
6876
--stack-name $(STACK_NAME)-LogIngestion-S3-$(PARAM_NAME_SUFFIX) \
6977
--template-file log_ingestion.s3.cft.yaml \
@@ -74,7 +82,11 @@ deploy:
7482
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
7583
"BucketARN=$(PARAM_BUCKET_ARN)" \
7684
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
77-
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)"
85+
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
86+
"RootOUID=$(PARAM_ROOT_OU_ID)" \
87+
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
88+
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
89+
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"
7890
aws cloudformation deploy \
7991
--stack-name $(STACK_NAME)-VolumeAccess-$(PARAM_NAME_SUFFIX) \
8092
--template-file volume_access.cft.yaml \
@@ -85,7 +97,11 @@ deploy:
8597
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
8698
"Regions=$(PARAM_REGIONS)" \
8799
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
88-
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)"
100+
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
101+
"RootOUID=$(PARAM_ROOT_OU_ID)" \
102+
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
103+
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
104+
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"
89105

90106
aws cloudformation deploy \
91107
--stack-name $(STACK_NAME)-VMWorkloadScanning-$(PARAM_NAME_SUFFIX) \
@@ -97,7 +113,11 @@ deploy:
97113
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
98114
"LambdaScanningEnabled"=$(PARAM_LAMBDA_SCANNING_ENABLED) \
99115
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
100-
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)"
116+
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
117+
"RootOUID=$(PARAM_ROOT_OU_ID)" \
118+
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
119+
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
120+
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"
101121

102122
clean:
103123
aws cloudformation delete-stack --stack-name $(STACK_NAME)-Foundational-$(PARAM_NAME_SUFFIX)

‎modules/README.md‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,4 +12,14 @@ Modular templates support cross sections of Sysdig Secure feature sets. Each tem
1212

1313
Organizations are supported by setting the following template parameters
1414
* `IsOrganizational=true`
15-
* `OrganizationalUnitIDs=ou-...`
15+
* `OrganizationalUnitIDs=ou-...` (to be deprecated soon, please read below)
16+
17+
### Organizational Install Configurations
18+
19+
Following are the new parameters to configure organizational deployments on the cloud for Sysdig Secure for Cloud :-
20+
1. `RootOUID` - Root Organization Unit ID
21+
2. `IncludeOUIDs` - List of AWS Organizational Unit IDs to deploy the Sysdig Secure for Cloud resources in.
22+
3. `IncludeAccounts` - List of AWS Accounts to deploy the Sysdig Secure for Cloud resources in.
23+
4. `ExcludeAccounts` - List of AWS Accounts to exclude deploying the Sysdig Secure for Cloud resources in.
24+
25+
**WARNING**: module template parameter `OrganizationalUnitIDs` will be DEPRECATED soon going forward. Please work with Sysdig to migrate your CFT based installs to use `IncludeOUIDs` instead to achieve the same deployment outcome.

‎modules/foundational.cft.yaml‎

Lines changed: 100 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@ Metadata:
1212
- IsOrganizational
1313
- OrganizationalUnitIDs
1414
- Partition
15+
- RootOUID
16+
- IncludeOUIDs
17+
- IncludeAccounts
18+
- ExcludeAccounts
1519
ParameterLabels:
1620
NameSuffix:
1721
default: Name Suffix
@@ -22,9 +26,17 @@ Metadata:
2226
IsOrganizational:
2327
default: Is Organizational
2428
OrganizationalUnitIDs:
25-
default: Organizational Unit IDs
29+
default: (TO BE DEPRECATED Please work with Sysdig to migrate and use IncludeOUIDs) Organizational Unit IDs
2630
Partition:
2731
default: AWS Partition
32+
RootOUID:
33+
default: Root Organization Unit ID
34+
IncludeOUIDs:
35+
default: Include Organizational Unit IDs
36+
IncludeAccounts:
37+
default: Include AWS accounts
38+
ExcludeAccounts:
39+
default: Exclude AWS accounts
2840
Parameters:
2941
NameSuffix:
3042
Type: String
@@ -47,16 +59,78 @@ Parameters:
4759
- 'false'
4860
OrganizationalUnitIDs:
4961
Type: CommaDelimitedList
50-
Description: Comma separated list of organizational unit IDs to deploy
62+
Description: (WARNING - TO BE DEPRECATED Please work with Sysdig to migrate your installs to use IncludeOUIDs instead) Comma separated list of organizational unit IDs to deploy
5163
Partition:
5264
Type: String
5365
Description: AWS Partition of your account or organization to create resources in
5466
Default: 'aws'
67+
RootOUID:
68+
Type: CommaDelimitedList
69+
Description: Root Organizational Unit ID of your AWS organization
70+
IncludeOUIDs:
71+
Type: CommaDelimitedList
72+
Description: Comma separated list of organizational unit IDs to be included for deployment
73+
IncludeAccounts:
74+
Type: CommaDelimitedList
75+
Description: Comma separated list of AWS accounts in your organization to be included for deployment
76+
ExcludeAccounts:
77+
Type: CommaDelimitedList
78+
Description: Comma separated list of AWS accounts in your organization to be excluded for deployment
5579
Conditions:
5680
IsOrganizational:
5781
Fn::Equals:
5882
- Ref: IsOrganizational
5983
- 'true'
84+
# First check if old param OrganizationalUnitIDs configured - support till we DEPRECATE it
85+
IsOldOuidConfigured:
86+
!And
87+
- !Condition IsOrganizational
88+
- !Not
89+
- !Equals
90+
- !Join ["", !Ref OrganizationalUnitIDs]
91+
- ''
92+
93+
# Else, check for new Inclusion and Exclusion params
94+
# INCLUSIONS
95+
OUInclusionsConfigured:
96+
!And
97+
- !Condition IsOrganizational
98+
- !Not
99+
- !Equals
100+
- !Join ["", !Ref IncludeOUIDs]
101+
- ''
102+
AccountInclusionsConfigured:
103+
!And
104+
- !Condition IsOrganizational
105+
- !Not
106+
- !Equals
107+
- !Join ["", !Ref IncludeAccounts]
108+
- ''
109+
# -----------------------------------------------------------------------------------------------------
110+
# Remove below condition once AWS issue is fixed and replace with using UNION filter -
111+
# https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-cloudformation/issues/100
112+
# -----------------------------------------------------------------------------------------------------
113+
# XXX: due to AWS bug of not having UNION filter fully working, there is no way to add those extra accounts requested.
114+
# to not miss out on those extra accounts, deploy the cloud resources across entire org and noop the UNION filter.
115+
# i.e till we can't deploy UNION, we deploy it all
116+
AllowedInclusions:
117+
!And
118+
- !Condition OUInclusionsConfigured
119+
- !Not
120+
- !Condition AccountInclusionsConfigured
121+
122+
# EXCLUSIONS
123+
# cannot do OU exclusions from ExcludeOUIDs since CFT templates are static and don't have a way to fetch dynamic data from AWS
124+
AccountExclusionsConfigured:
125+
!And
126+
- !Condition IsOrganizational
127+
- !Equals
128+
- !Join ["", !Ref IncludeAccounts]
129+
- ''
130+
- !Not
131+
- !Equals
132+
- !Join ["", !Ref ExcludeAccounts]
133+
- ''
60134
Resources:
61135
ConfigPostureRole:
62136
Type: AWS::IAM::Role
@@ -166,7 +240,30 @@ Resources:
166240
Ref: Partition
167241
StackInstancesGroup:
168242
- DeploymentTargets:
169-
OrganizationalUnitIds: !Ref OrganizationalUnitIDs
243+
OrganizationalUnitIds:
244+
Fn::If:
245+
- IsOldOuidConfigured
246+
- !Ref OrganizationalUnitIDs
247+
- Fn::If:
248+
- AllowedInclusions
249+
- !Ref IncludeOUIDs
250+
- !Ref RootOUID
251+
AccountFilterType:
252+
Fn::If:
253+
- IsOldOuidConfigured
254+
- !Ref 'AWS::NoValue'
255+
- Fn::If:
256+
- AccountExclusionsConfigured
257+
- "DIFFERENCE"
258+
- "NONE"
259+
Accounts:
260+
Fn::If:
261+
- IsOldOuidConfigured
262+
- !Ref 'AWS::NoValue'
263+
- Fn::If:
264+
- AccountExclusionsConfigured
265+
- !Ref ExcludeAccounts
266+
- !Ref 'AWS::NoValue'
170267
Regions:
171268
- Ref: AWS::Region
172269
TemplateBody: |

0 commit comments

Comments
 (0)