Skip to content

Commit 633fc29

Browse files
cgeerscgeers
authored
modular templates (#127)
* add foundational module * fix(foundational): single account * feat(modules): foundational org template * use yaml shorthand * feat(modules): combine org and single templates * feat(modules): add log ingestion eventbridge * feat(modules): add log ingestion s3 * feat(modules): add volume access * feat(modules): consolidate ci * rolls up all modules into single CI workflow * extend deploy target for all modules * fix(modules): add `posture` to cspm role name * fix(modules): tight execution role permissions
1 parent b2e5f76 commit 633fc29

11 files changed

+1433
-0
lines changed

‎.github/workflows/ci-modules.yaml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: CI - Modules
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
paths:
8+
- 'modules/**'
9+
push:
10+
branches:
11+
- main
12+
paths:
13+
- 'modules/**'
14+
15+
jobs:
16+
lint:
17+
name: Lint Templates
18+
runs-on: ubuntu-latest
19+
20+
steps:
21+
- name: Check out code
22+
uses: actions/checkout@v3
23+
24+
- name: cfn-lint
25+
uses: scottbrenner/cfn-lint-action@v2
26+
27+
- name: Lint
28+
working-directory: modules
29+
run: make lint
30+
31+
validate:
32+
name: Validate Templates
33+
runs-on: ubuntu-latest
34+
35+
steps:
36+
- name: Check out code
37+
uses: actions/checkout@v3
38+
39+
- name: Configure AWS credentials
40+
uses: aws-actions/configure-aws-credentials@v1
41+
with:
42+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
43+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
44+
aws-region: eu-west-1
45+
46+
- name: Validate Templates
47+
run: make validate
48+
working-directory: modules
49+
50+
publish:
51+
name: Publish Templates
52+
runs-on: ubuntu-latest
53+
needs:
54+
- lint
55+
- validate
56+
57+
steps:
58+
- name: Check out code
59+
uses: actions/checkout@v3
60+
61+
- name: Configure AWS credentials
62+
uses: aws-actions/configure-aws-credentials@v1
63+
with:
64+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
65+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
66+
aws-region: eu-west-1
67+
68+
- name: Publish Templates
69+
run: make publish
70+
working-directory: modules
71+
env:
72+
S3_BUCKET: cf-templates-cloudvision-ci
73+
S3_PREFIX: ${{ github.event.name == 'push' && 'main' || format('pr/{0}', github.event.pull_request.number)}}

‎modules/Makefile‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
# requires AWS_PROFILE
2+
# bucket must exist, prefix will be created
3+
S3_BUCKET ?= "s4c-cft"
4+
S3_PREFIX ?= "test"
5+
S3_REGION ?= eu-west-1
6+
STACK_NAME = Sysdig-Secure
7+
PARAM_NAME_SUFFIX ?= test
8+
PARAM_IS_ORGANIZATIONAL ?= false
9+
PARAM_EXTERNAL_ID ?= test
10+
PARAM_TRUSTED_IDENTITY ?= arn:aws:iam:::role/$(PARAM_NAME_SUFFIX)
11+
PARAM_TARGET_EVENT_BUS_ARN ?= arn:aws:events:us-east-1::event-bus/default
12+
PARAM_BUCKET_ARN ?= arn:aws:s3:::cloudtrail-$(PARAM_NAME_SUFFIX)
13+
PARAM_REGIONS ?= us-east-1
14+
15+
.PHONY: validate lint deploy test clean
16+
validate: export AWS_PAGER=""
17+
validate:
18+
aws cloudformation validate-template --template-body file://./foundational.cft.yaml
19+
aws cloudformation validate-template --template-body file://./log_ingestion.events.cft.yaml
20+
aws cloudformation validate-template --template-body file://./log_ingestion.s3.cft.yaml
21+
aws cloudformation validate-template --template-body file://./volume_access.cft.yaml
22+
23+
lint:
24+
cfn-lint *.cft.yaml
25+
yq '.Resources.OrganizationStackSet.Properties.TemplateBody' foundational.cft.yaml | cfn-lint -
26+
yq '.Resources.EventBridgeRuleStackSet.Properties.TemplateBody' log_ingestion.events.cft.yaml | cfn-lint -
27+
yq '.Resources.OrganizationRoleStackSet.Properties.TemplateBody' log_ingestion.events.cft.yaml | cfn-lint -
28+
yq '.Resources.OrganizationRuleStackSet.Properties.TemplateBody' log_ingestion.events.cft.yaml | cfn-lint -
29+
yq '.Resources.ScanningKmsKeyStackSet.Properties.TemplateBody' volume_access.cft.yaml | cfn-lint -
30+
yq '.Resources.OrganizationRoleStackSet.Properties.TemplateBody' volume_access.cft.yaml | cfn-lint -
31+
yq '.Resources.OrganizationKMSKeyStackSet.Properties.TemplateBody' volume_access.cft.yaml | cfn-lint -
32+
33+
publish:
34+
aws s3 cp foundational.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/foundational.cft.yaml
35+
aws s3 cp log_ingestion.s3.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/log_ingestion.s3.cft.yaml
36+
aws s3 cp log_ingestion.events.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/log_ingestion.events.cft.yaml
37+
aws s3 cp volume_access.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/volume_access.cft.yaml
38+
39+
deploy:
40+
aws cloudformation deploy \
41+
--stack-name $(STACK_NAME)-Foundational-$(PARAM_NAME_SUFFIX) \
42+
--template-file foundational.cft.yaml \
43+
--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
44+
--parameter-overrides \
45+
"NameSuffix=$(PARAM_NAME_SUFFIX)" \
46+
"ExternalID=$(PARAM_EXTERNAL_ID)" \
47+
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
48+
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
49+
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)"
50+
aws cloudformation deploy \
51+
--stack-name $(STACK_NAME)-LogIngestion-EventBridge-$(PARAM_NAME_SUFFIX) \
52+
--template-file log_ingestion.events.cft.yaml \
53+
--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
54+
--parameter-overrides \
55+
"NameSuffix=$(PARAM_NAME_SUFFIX)" \
56+
"ExternalID=$(PARAM_EXTERNAL_ID)" \
57+
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
58+
"Regions=$(PARAM_REGIONS)" \
59+
"TargetEventBusARN=$(PARAM_TARGET_EVENT_BUS_ARN)" \
60+
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
61+
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)"
62+
aws cloudformation deploy \
63+
--stack-name $(STACK_NAME)-LogIngestion-S3-$(PARAM_NAME_SUFFIX) \
64+
--template-file log_ingestion.s3.cft.yaml \
65+
--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
66+
--parameter-overrides \
67+
"NameSuffix=$(PARAM_NAME_SUFFIX)" \
68+
"ExternalID=$(PARAM_EXTERNAL_ID)" \
69+
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
70+
"BucketARN=$(PARAM_BUCKET_ARN)" \
71+
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
72+
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)"
73+
aws cloudformation deploy \
74+
--stack-name $(STACK_NAME)-VolumeAccess-$(PARAM_NAME_SUFFIX) \
75+
--template-file volume_access.cft.yaml \
76+
--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
77+
--parameter-overrides \
78+
"NameSuffix=$(PARAM_NAME_SUFFIX)" \
79+
"ExternalID=$(PARAM_EXTERNAL_ID)" \
80+
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
81+
"Regions=$(PARAM_REGIONS)" \
82+
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
83+
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)"
84+
85+
clean:
86+
aws cloudformation delete-stack --stack-name $(STACK_NAME)-Foundational-$(PARAM_NAME_SUFFIX)
87+
aws cloudformation delete-stack --stack-name $(STACK_NAME)-LogIngestion-EventBridge-$(PARAM_NAME_SUFFIX)
88+
aws cloudformation delete-stack --stack-name $(STACK_NAME)-LogIngestion-S3-$(PARAM_NAME_SUFFIX)
89+
aws cloudformation delete-stack --stack-name $(STACK_NAME)-VolumeAccess-$(PARAM_NAME_SUFFIX)
90+
91+

‎modules/README.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# Sysdig Secure - Modular Templates
2+
3+
Modular templates support cross sections of Sysdig Secure feature sets. Each template is intended to be installable alongside one another, and amongst multiple instances.
4+
5+
## Common parameters
6+
7+
* `NameSuffix` - a unique string suffix given to named resources where applicable.
8+
* `TrustedIdentity` - a Sysdig owned identity trusted to assume a permission limited customer installed role
9+
* `ExternalID` - a Sysdig assigned value
10+
11+
## Organizations
12+
13+
Organizations are supported by setting the following template parameters
14+
* `IsOrganizational=true`
15+
* `OrganizationalUnitsIDs=ou-...`

0 commit comments

Comments
 (0)