Skip to content

Commit 429b983

Browse files
ravinadhruve10ravinadhruve10
authored
Deprecate legacy CFT parameters for OUs (#161)
DEPRECATION NOTICE ----------------------- Deprecating the following parameter from all templates :- - OrganizationalUnitIDs With this breaking change, above legacy param will no longer be supported for Secure installs. Recommended Solutions ------------------------ - For new Foundational installs: Users can use the new params only for including and excluding organizational_units and/or accounts. - For existing installs: - It is highly recommended to migrate to using new parameters. Please work with Sysdig to migrate your CFT installs to use new params instead to achieve the same deployment outcome. - Pin and use older template version if you do not wish to migrate.
1 parent fb9acaa commit 429b983

File tree

7 files changed

+62
-202
lines changed

7 files changed

+62
-202
lines changed

‎modules/Makefile‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,6 @@ deploy:
5757
"ExternalID=$(PARAM_EXTERNAL_ID)" \
5858
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
5959
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
60-
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
6160
"Partition=$(PARAM_PARTITION)" \
6261
"RootOUID=$(PARAM_ROOT_OU_ID)" \
6362
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
@@ -76,7 +75,6 @@ deploy:
7675
"IngestionUrl=$(PARAM_INGESTION_URL)" \
7776
"RateLimit=$(PARAM_RATE_LIMIT)" \
7877
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
79-
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
8078
"Partition=$(PARAM_PARTITION)" \
8179
"RootOUID=$(PARAM_ROOT_OU_ID)" \
8280
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
@@ -93,7 +91,6 @@ deploy:
9391
"Regions=$(PARAM_REGIONS)" \
9492
"TargetEventBusARN=$(PARAM_TARGET_EVENT_BUS_ARN)" \
9593
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
96-
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
9794
"Partition=$(PARAM_PARTITION)" \
9895
"RootOUID=$(PARAM_ROOT_OU_ID)" \
9996
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
@@ -109,7 +106,6 @@ deploy:
109106
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
110107
"BucketARN=$(PARAM_BUCKET_ARN)" \
111108
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
112-
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
113109
"RootOUID=$(PARAM_ROOT_OU_ID)" \
114110
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
115111
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
@@ -124,7 +120,6 @@ deploy:
124120
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
125121
"Regions=$(PARAM_REGIONS)" \
126122
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
127-
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
128123
"RootOUID=$(PARAM_ROOT_OU_ID)" \
129124
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
130125
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
@@ -140,7 +135,6 @@ deploy:
140135
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
141136
"LambdaScanningEnabled"=$(PARAM_LAMBDA_SCANNING_ENABLED) \
142137
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
143-
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
144138
"RootOUID=$(PARAM_ROOT_OU_ID)" \
145139
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
146140
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \

‎modules/README.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@ Modular templates support cross sections of Sysdig Secure feature sets. Each tem
1212

1313
Organizations are supported by setting the following template parameters
1414
* `IsOrganizational=true`
15-
* `OrganizationalUnitIDs=ou-...` (to be deprecated on 30th November, 2025, please read below)
1615

1716
### Organizational Install Configurations
1817

@@ -22,4 +21,4 @@ Following are the new parameters to configure organizational deployments on the
2221
3. `IncludeAccounts` - List of AWS Accounts to deploy the Sysdig Secure for Cloud resources in.
2322
4. `ExcludeAccounts` - List of AWS Accounts to exclude deploying the Sysdig Secure for Cloud resources in.
2423

25-
**WARNING**: module template parameter `OrganizationalUnitIDs` will be DEPRECATED on 30th November, 2025. Please work with Sysdig to migrate your CFT based installs to use `IncludeOUIDs` instead to achieve the same deployment outcome.
24+
**DEPRECATION NOTICE**: module template parameter `OrganizationalUnitIDs` has been DEPRECATED and is no longer supported. Please work with Sysdig to migrate your CFT based installs to use `IncludeOUIDs` instead to achieve the same deployment outcome.

‎modules/foundational.cft.yaml‎

Lines changed: 9 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ Metadata:
1010
- ExternalID
1111
- TrustedIdentity
1212
- IsOrganizational
13-
- OrganizationalUnitIDs
1413
- Partition
1514
- RootOUID
1615
- IncludeOUIDs
@@ -25,8 +24,6 @@ Metadata:
2524
default: Trusted Identity
2625
IsOrganizational:
2726
default: Is Organizational
28-
OrganizationalUnitIDs:
29-
default: (TO BE DEPRECATED on 30th November, 2025. Please work with Sysdig to migrate and use IncludeOUIDs) Organizational Unit IDs
3027
Partition:
3128
default: AWS Partition
3229
RootOUID:
@@ -57,9 +54,6 @@ Parameters:
5754
AllowedValues:
5855
- 'true'
5956
- 'false'
60-
OrganizationalUnitIDs:
61-
Type: CommaDelimitedList
62-
Description: (WARNING - TO BE DEPRECATED on 30th November, 2025. Please work with Sysdig to migrate your installs to use IncludeOUIDs instead) Comma separated list of organizational unit IDs to deploy
6357
Partition:
6458
Type: String
6559
Description: AWS Partition of your account or organization to create resources in
@@ -81,16 +75,8 @@ Conditions:
8175
Fn::Equals:
8276
- Ref: IsOrganizational
8377
- 'true'
84-
# First check if old param OrganizationalUnitIDs configured - support till we DEPRECATE it
85-
IsOldOuidConfigured:
86-
!And
87-
- !Condition IsOrganizational
88-
- !Not
89-
- !Equals
90-
- !Join ["", !Ref OrganizationalUnitIDs]
91-
- ''
9278

93-
# Else, check for new Inclusion and Exclusion params
79+
# check for new Inclusion and Exclusion params
9480
# INCLUSIONS
9581
OUInclusionsConfigured:
9682
!And
@@ -282,28 +268,19 @@ Resources:
282268
- DeploymentTargets:
283269
OrganizationalUnitIds:
284270
Fn::If:
285-
- IsOldOuidConfigured
286-
- !Ref OrganizationalUnitIDs
287-
- Fn::If:
288-
- AllowedInclusions
289-
- !Ref IncludeOUIDs
290-
- !Ref RootOUID
271+
- AllowedInclusions
272+
- !Ref IncludeOUIDs
273+
- !Ref RootOUID
291274
AccountFilterType:
292275
Fn::If:
293-
- IsOldOuidConfigured
294-
- !Ref 'AWS::NoValue'
295-
- Fn::If:
296-
- AccountExclusionsConfigured
297-
- "DIFFERENCE"
298-
- "NONE"
276+
- AccountExclusionsConfigured
277+
- "DIFFERENCE"
278+
- "NONE"
299279
Accounts:
300280
Fn::If:
301-
- IsOldOuidConfigured
281+
- AccountExclusionsConfigured
282+
- !Ref ExcludeAccounts
302283
- !Ref 'AWS::NoValue'
303-
- Fn::If:
304-
- AccountExclusionsConfigured
305-
- !Ref ExcludeAccounts
306-
- !Ref 'AWS::NoValue'
307284
Regions:
308285
- Ref: AWS::Region
309286
TemplateBody: |

‎modules/log_ingestion.events.cft.yaml‎

Lines changed: 17 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ Metadata:
1919
- Regions
2020
- RuleState
2121
- IsOrganizational
22-
- OrganizationalUnitIDs
2322
- Partition
2423
- RootOUID
2524
- IncludeOUIDs
@@ -46,8 +45,6 @@ Metadata:
4645
default: EventBridge Rule event pattern
4746
IsOrganizational:
4847
default: Is Organizational
49-
OrganizationalUnitIDs:
50-
default: (TO BE DEPRECATED on 30th November, 2025. Please work with Sysdig to migrate and use IncludeOUIDs) Organizational Unit IDs
5148
Partition:
5249
default: AWS Partition
5350
RootOUID:
@@ -84,9 +81,6 @@ Parameters:
8481
Regions:
8582
Type: CommaDelimitedList
8683
Description: Comma separated list of regions to monitor with EventBridge
87-
OrganizationalUnitIDs:
88-
Type: CommaDelimitedList
89-
Description: (WARNING - TO BE DEPRECATED on 30th November, 2025. Please work with Sysdig to migrate your installs to use IncludeOUIDs instead) Comma separated list of organizational unit IDs to deploy
9084
RuleState:
9185
Type: String
9286
Description: The state of the EventBridge Rule
@@ -145,16 +139,8 @@ Conditions:
145139
Fn::Equals:
146140
- Ref: IsOrganizational
147141
- 'true'
148-
# First check if old param OrganizationalUnitIDs configured - support till we DEPRECATE it
149-
IsOldOuidConfigured:
150-
!And
151-
- !Condition IsOrganizational
152-
- !Not
153-
- !Equals
154-
- !Join ["", !Ref OrganizationalUnitIDs]
155-
- ''
156142

157-
# Else, check for new Inclusion and Exclusion params
143+
# check for new Inclusion and Exclusion params
158144
# INCLUSIONS
159145
OUInclusionsConfigured:
160146
!And
@@ -418,28 +404,19 @@ Resources:
418404
- DeploymentTargets:
419405
OrganizationalUnitIds:
420406
Fn::If:
421-
- IsOldOuidConfigured
422-
- !Ref OrganizationalUnitIDs
423-
- Fn::If:
424-
- AllowedInclusions
425-
- !Ref IncludeOUIDs
426-
- !Ref RootOUID
407+
- AllowedInclusions
408+
- !Ref IncludeOUIDs
409+
- !Ref RootOUID
427410
AccountFilterType:
428411
Fn::If:
429-
- IsOldOuidConfigured
430-
- !Ref 'AWS::NoValue'
431-
- Fn::If:
432-
- AccountExclusionsConfigured
433-
- "DIFFERENCE"
434-
- "NONE"
412+
- AccountExclusionsConfigured
413+
- "DIFFERENCE"
414+
- "NONE"
435415
Accounts:
436416
Fn::If:
437-
- IsOldOuidConfigured
417+
- AccountExclusionsConfigured
418+
- !Ref ExcludeAccounts
438419
- !Ref 'AWS::NoValue'
439-
- Fn::If:
440-
- AccountExclusionsConfigured
441-
- !Ref ExcludeAccounts
442-
- !Ref 'AWS::NoValue'
443420
Regions: [!Ref "AWS::Region"]
444421
TemplateBody: |
445422
AWSTemplateFormatVersion: "2010-09-09"
@@ -550,28 +527,19 @@ Resources:
550527
- DeploymentTargets:
551528
OrganizationalUnitIds:
552529
Fn::If:
553-
- IsOldOuidConfigured
554-
- !Ref OrganizationalUnitIDs
555-
- Fn::If:
556-
- AllowedInclusions
557-
- !Ref IncludeOUIDs
558-
- !Ref RootOUID
530+
- AllowedInclusions
531+
- !Ref IncludeOUIDs
532+
- !Ref RootOUID
559533
AccountFilterType:
560534
Fn::If:
561-
- IsOldOuidConfigured
562-
- !Ref 'AWS::NoValue'
563-
- Fn::If:
564-
- AccountExclusionsConfigured
565-
- "DIFFERENCE"
566-
- "NONE"
535+
- AccountExclusionsConfigured
536+
- "DIFFERENCE"
537+
- "NONE"
567538
Accounts:
568539
Fn::If:
569-
- IsOldOuidConfigured
540+
- AccountExclusionsConfigured
541+
- !Ref ExcludeAccounts
570542
- !Ref 'AWS::NoValue'
571-
- Fn::If:
572-
- AccountExclusionsConfigured
573-
- !Ref ExcludeAccounts
574-
- !Ref 'AWS::NoValue'
575543
Regions: !Ref Regions
576544
TemplateBody: |
577545
AWSTemplateFormatVersion: "2010-09-09"

‎modules/log_ingestion.legacy_events.cft.yaml‎

Lines changed: 17 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@ Metadata:
1717
- Regions
1818
- RuleState
1919
- IsOrganizational
20-
- OrganizationalUnitIDs
2120
- Partition
2221
- RootOUID
2322
- IncludeOUIDs
@@ -40,8 +39,6 @@ Metadata:
4039
default: EventBridge Rule event pattern
4140
IsOrganizational:
4241
default: Is Organizational
43-
OrganizationalUnitIDs:
44-
default: (TO BE DEPRECATED Please work with Sysdig to migrate and use IncludeOUIDs) Organizational Unit IDs
4542
Partition:
4643
default: AWS Partition (GovCloud Only)
4744
RootOUID:
@@ -73,9 +70,6 @@ Parameters:
7370
Regions:
7471
Type: CommaDelimitedList
7572
Description: Comma separated list of regions to monitor with EventBridge
76-
OrganizationalUnitIDs:
77-
Type: CommaDelimitedList
78-
Description: (WARNING - TO BE DEPRECATED Please work with Sysdig to migrate your installs to use IncludeOUIDs instead) Comma separated list of organizational unit IDs to deploy
7973
RuleState:
8074
Type: String
8175
Description: The state of the EventBridge Rule
@@ -136,16 +130,8 @@ Conditions:
136130
Fn::Equals:
137131
- Ref: IsOrganizational
138132
- 'true'
139-
# First check if old param OrganizationalUnitIDs configured - support till we DEPRECATE it
140-
IsOldOuidConfigured:
141-
!And
142-
- !Condition IsOrganizational
143-
- !Not
144-
- !Equals
145-
- !Join ["", !Ref OrganizationalUnitIDs]
146-
- ''
147133

148-
# Else, check for new Inclusion and Exclusion params
134+
# check for new Inclusion and Exclusion params
149135
# INCLUSIONS
150136
OUInclusionsConfigured:
151137
!And
@@ -368,28 +354,19 @@ Resources:
368354
- DeploymentTargets:
369355
OrganizationalUnitIds:
370356
Fn::If:
371-
- IsOldOuidConfigured
372-
- !Ref OrganizationalUnitIDs
373-
- Fn::If:
374-
- AllowedInclusions
375-
- !Ref IncludeOUIDs
376-
- !Ref RootOUID
357+
- AllowedInclusions
358+
- !Ref IncludeOUIDs
359+
- !Ref RootOUID
377360
AccountFilterType:
378361
Fn::If:
379-
- IsOldOuidConfigured
380-
- !Ref 'AWS::NoValue'
381-
- Fn::If:
382-
- AccountExclusionsConfigured
383-
- "DIFFERENCE"
384-
- "NONE"
362+
- AccountExclusionsConfigured
363+
- "DIFFERENCE"
364+
- "NONE"
385365
Accounts:
386366
Fn::If:
387-
- IsOldOuidConfigured
367+
- AccountExclusionsConfigured
368+
- !Ref ExcludeAccounts
388369
- !Ref 'AWS::NoValue'
389-
- Fn::If:
390-
- AccountExclusionsConfigured
391-
- !Ref ExcludeAccounts
392-
- !Ref 'AWS::NoValue'
393370
Regions: [!Ref "AWS::Region"]
394371
TemplateBody: |
395372
AWSTemplateFormatVersion: "2010-09-09"
@@ -479,28 +456,19 @@ Resources:
479456
- DeploymentTargets:
480457
OrganizationalUnitIds:
481458
Fn::If:
482-
- IsOldOuidConfigured
483-
- !Ref OrganizationalUnitIDs
484-
- Fn::If:
485-
- AllowedInclusions
486-
- !Ref IncludeOUIDs
487-
- !Ref RootOUID
459+
- AllowedInclusions
460+
- !Ref IncludeOUIDs
461+
- !Ref RootOUID
488462
AccountFilterType:
489463
Fn::If:
490-
- IsOldOuidConfigured
491-
- !Ref 'AWS::NoValue'
492-
- Fn::If:
493-
- AccountExclusionsConfigured
494-
- "DIFFERENCE"
495-
- "NONE"
464+
- AccountExclusionsConfigured
465+
- "DIFFERENCE"
466+
- "NONE"
496467
Accounts:
497468
Fn::If:
498-
- IsOldOuidConfigured
469+
- AccountExclusionsConfigured
470+
- !Ref ExcludeAccounts
499471
- !Ref 'AWS::NoValue'
500-
- Fn::If:
501-
- AccountExclusionsConfigured
502-
- !Ref ExcludeAccounts
503-
- !Ref 'AWS::NoValue'
504472
Regions: !Ref Regions
505473
TemplateBody: |
506474
AWSTemplateFormatVersion: "2010-09-09"

0 commit comments

Comments
 (0)