Skip to content

Commit abcf780

Browse files
ismael-penacho-sysdigismael-penacho-sysdig
committed
Merge remote-tracking branch 'origin' into add-bedrock-perm
2 parents 6b11d81 + 7f0dc34 commit abcf780

19 files changed

+2867
-100
lines changed

‎.github/workflows/ci-modules.yaml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
name: CI - Modules
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
paths:
8+
- 'modules/**'
9+
push:
10+
branches:
11+
- main
12+
tags:
13+
- 'v**'
14+
paths:
15+
- 'modules/**'
16+
17+
jobs:
18+
lint:
19+
name: Lint Templates
20+
runs-on: ubuntu-latest
21+
22+
steps:
23+
- name: Check out code
24+
uses: actions/checkout@v3
25+
26+
- name: cfn-lint
27+
uses: scottbrenner/cfn-lint-action@v2
28+
with:
29+
version: "==1.18.3"
30+
31+
- name: Lint
32+
working-directory: modules
33+
run: make lint
34+
35+
validate:
36+
name: Validate Templates
37+
runs-on: ubuntu-latest
38+
39+
steps:
40+
- name: Check out code
41+
uses: actions/checkout@v3
42+
43+
- name: Configure AWS credentials
44+
uses: aws-actions/configure-aws-credentials@v1
45+
with:
46+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
47+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
48+
aws-region: eu-west-1
49+
50+
- name: Validate Templates
51+
run: make validate
52+
working-directory: modules
53+
54+
publish:
55+
name: Publish Templates
56+
runs-on: ubuntu-latest
57+
needs:
58+
- lint
59+
- validate
60+
61+
steps:
62+
- name: Check out code
63+
uses: actions/checkout@v3
64+
65+
- name: Configure AWS credentials
66+
uses: aws-actions/configure-aws-credentials@v1
67+
with:
68+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
69+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
70+
aws-region: eu-west-1
71+
72+
- name: Publish Templates
73+
run: make publish
74+
working-directory: modules
75+
env:
76+
S3_BUCKET: cf-templates-cloudvision-ci
77+
S3_PREFIX: ${{ github.event_name == 'push' && ((contains(github.ref, '/tags/v') && github.ref_name) || 'main') || format('pr/{0}', github.event.pull_request.number)}}

‎modules/Makefile‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
# requires AWS_PROFILE
2+
# bucket must exist, prefix will be created
3+
S3_BUCKET ?= "s4c-cft"
4+
S3_PREFIX ?= "test"
5+
S3_REGION ?= eu-west-1
6+
STACK_NAME = Sysdig-Secure
7+
PARAM_NAME_SUFFIX ?= test
8+
PARAM_IS_ORGANIZATIONAL ?= false
9+
PARAM_EXTERNAL_ID ?= test
10+
PARAM_TRUSTED_IDENTITY ?= arn:aws:iam:::role/$(PARAM_NAME_SUFFIX)
11+
PARAM_API_KEY ?= <your_api_key>
12+
PARAM_INGESTION_URL ?= https://app-staging.sysdigcloud.com/api/cloudingestion/webhooks/eventbridge/v1/64616366-3130-6163-3665-346636653537
13+
PARAM_RATE_LIMIT ?= 300
14+
PARAM_BUCKET_ARN ?= arn:aws:s3:::cloudtrail-$(PARAM_NAME_SUFFIX)
15+
PARAM_REGIONS ?= us-east-1
16+
PARAM_LAMBDA_SCANNING_ENABLED ?= true
17+
18+
.PHONY: validate lint deploy test clean
19+
validate: export AWS_PAGER=""
20+
validate:
21+
aws --region us-east-1 cloudformation validate-template --template-body file://./foundational.cft.yaml
22+
aws --region us-east-1 cloudformation validate-template --template-body file://./log_ingestion.events.cft.yaml
23+
aws --region us-east-1 cloudformation validate-template --template-body file://./log_ingestion.s3.cft.yaml
24+
aws --region us-east-1 cloudformation validate-template --template-body file://./volume_access.cft.yaml
25+
aws --region us-east-1 cloudformation validate-template --template-body file://./vm_workload_scanning.cft.yaml
26+
27+
lint:
28+
cfn-lint *.cft.yaml
29+
yq '.Resources.OrganizationStackSet.Properties.TemplateBody' foundational.cft.yaml | cfn-lint -
30+
yq '.Resources.EventBridgeRuleStackSet.Properties.TemplateBody' log_ingestion.events.cft.yaml | cfn-lint -
31+
yq '.Resources.OrganizationRoleStackSet.Properties.TemplateBody' log_ingestion.events.cft.yaml | cfn-lint -
32+
yq '.Resources.OrganizationRuleStackSet.Properties.TemplateBody' log_ingestion.events.cft.yaml | cfn-lint -
33+
yq '.Resources.AccountStackSet.Properties.TemplateBody' volume_access.cft.yaml | cfn-lint -
34+
yq '.Resources.OrganizationStackSet.Properties.TemplateBody' volume_access.cft.yaml | cfn-lint -
35+
yq '.Resources.ScanningOrgStackSet.Properties.TemplateBody' vm_workload_scanning.cft.yaml | cfn-lint -
36+
37+
publish:
38+
aws s3 cp foundational.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/foundational.cft.yaml
39+
aws s3 cp log_ingestion.s3.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/log_ingestion.s3.cft.yaml
40+
aws s3 cp log_ingestion.events.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/log_ingestion.events.cft.yaml
41+
aws s3 cp volume_access.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/volume_access.cft.yaml
42+
aws s3 cp vm_workload_scanning.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/vm_workload_scanning.cft.yaml
43+
44+
deploy:
45+
aws cloudformation deploy \
46+
--stack-name $(STACK_NAME)-Foundational-$(PARAM_NAME_SUFFIX) \
47+
--template-file foundational.cft.yaml \
48+
--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
49+
--parameter-overrides \
50+
"NameSuffix=$(PARAM_NAME_SUFFIX)" \
51+
"ExternalID=$(PARAM_EXTERNAL_ID)" \
52+
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
53+
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
54+
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
55+
"Partition=${PARAM_PARTITION}" \
56+
"RootOUID=$(PARAM_ROOT_OU_ID)" \
57+
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
58+
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
59+
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"
60+
aws cloudformation deploy \
61+
--stack-name $(STACK_NAME)-LogIngestion-EventBridge-$(PARAM_NAME_SUFFIX) \
62+
--template-file log_ingestion.events.cft.yaml \
63+
--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
64+
--parameter-overrides \
65+
"NameSuffix=$(PARAM_NAME_SUFFIX)" \
66+
"ExternalID=$(PARAM_EXTERNAL_ID)" \
67+
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
68+
"Regions=$(PARAM_REGIONS)" \
69+
"ApiKey=$(PARAM_API_KEY)" \
70+
"IngestionUrl=$(PARAM_INGESTION_URL)" \
71+
"RateLimit=$(PARAM_RATE_LIMIT)" \
72+
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
73+
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
74+
"Partition=${PARAM_PARTITION}" \
75+
"RootOUID=$(PARAM_ROOT_OU_ID)" \
76+
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
77+
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
78+
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"
79+
aws cloudformation deploy \
80+
--stack-name $(STACK_NAME)-LogIngestion-S3-$(PARAM_NAME_SUFFIX) \
81+
--template-file log_ingestion.s3.cft.yaml \
82+
--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
83+
--parameter-overrides \
84+
"NameSuffix=$(PARAM_NAME_SUFFIX)" \
85+
"ExternalID=$(PARAM_EXTERNAL_ID)" \
86+
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
87+
"BucketARN=$(PARAM_BUCKET_ARN)" \
88+
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
89+
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
90+
"RootOUID=$(PARAM_ROOT_OU_ID)" \
91+
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
92+
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
93+
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"
94+
aws cloudformation deploy \
95+
--stack-name $(STACK_NAME)-VolumeAccess-$(PARAM_NAME_SUFFIX) \
96+
--template-file volume_access.cft.yaml \
97+
--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
98+
--parameter-overrides \
99+
"NameSuffix=$(PARAM_NAME_SUFFIX)" \
100+
"ExternalID=$(PARAM_EXTERNAL_ID)" \
101+
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
102+
"Regions=$(PARAM_REGIONS)" \
103+
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
104+
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
105+
"RootOUID=$(PARAM_ROOT_OU_ID)" \
106+
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
107+
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
108+
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"
109+
110+
aws cloudformation deploy \
111+
--stack-name $(STACK_NAME)-VMWorkloadScanning-$(PARAM_NAME_SUFFIX) \
112+
--template-file vm_workload_scanning.cft.yaml \
113+
--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
114+
--parameter-overrides \
115+
"NameSuffix=$(PARAM_NAME_SUFFIX)" \
116+
"ExternalID=$(PARAM_EXTERNAL_ID)" \
117+
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
118+
"LambdaScanningEnabled"=$(PARAM_LAMBDA_SCANNING_ENABLED) \
119+
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
120+
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
121+
"RootOUID=$(PARAM_ROOT_OU_ID)" \
122+
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
123+
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
124+
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"
125+
126+
clean:
127+
aws cloudformation delete-stack --stack-name $(STACK_NAME)-Foundational-$(PARAM_NAME_SUFFIX)
128+
aws cloudformation delete-stack --stack-name $(STACK_NAME)-LogIngestion-EventBridge-$(PARAM_NAME_SUFFIX)
129+
aws cloudformation delete-stack --stack-name $(STACK_NAME)-LogIngestion-S3-$(PARAM_NAME_SUFFIX)
130+
aws cloudformation delete-stack --stack-name $(STACK_NAME)-VolumeAccess-$(PARAM_NAME_SUFFIX)
131+
aws cloudformation delete-stack --stack-name $(STACK_NAME)-VMWorkloadScanning-$(PARAM_NAME_SUFFIX)

‎modules/README.md‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# Sysdig Secure - Modular Templates
2+
3+
Modular templates support cross sections of Sysdig Secure feature sets. Each template is intended to be installable alongside one another, and amongst multiple instances.
4+
5+
## Common parameters
6+
7+
* `NameSuffix` - a unique string suffix given to named resources where applicable.
8+
* `TrustedIdentity` - a Sysdig owned identity trusted to assume a permission limited customer installed role
9+
* `ExternalID` - a Sysdig assigned value
10+
11+
## Organizations
12+
13+
Organizations are supported by setting the following template parameters
14+
* `IsOrganizational=true`
15+
* `OrganizationalUnitIDs=ou-...` (to be deprecated soon, please read below)
16+
17+
### Organizational Install Configurations
18+
19+
Following are the new parameters to configure organizational deployments on the cloud for Sysdig Secure for Cloud :-
20+
1. `RootOUID` - Root Organization Unit ID
21+
2. `IncludeOUIDs` - List of AWS Organizational Unit IDs to deploy the Sysdig Secure for Cloud resources in.
22+
3. `IncludeAccounts` - List of AWS Accounts to deploy the Sysdig Secure for Cloud resources in.
23+
4. `ExcludeAccounts` - List of AWS Accounts to exclude deploying the Sysdig Secure for Cloud resources in.
24+
25+
**WARNING**: module template parameter `OrganizationalUnitIDs` will be DEPRECATED soon going forward. Please work with Sysdig to migrate your CFT based installs to use `IncludeOUIDs` instead to achieve the same deployment outcome.

0 commit comments

Comments
 (0)