|
| 1 | +# ORG-S3-K8S-FILTERED |
| 2 | + |
| 3 | +## Use-Case explanation |
| 4 | + |
| 5 | +**Current User Setup** |
| 6 | +- [X] organizational setup |
| 7 | + - [ ] organizational cloudtrail |
| 8 | + - [X] centralized S3 bucket with cloudtrail-events |
| 9 | + - [ ] member account usage - all required resources (s3/sns/sqs, sysdig workload) in same account |
| 10 | + - [X] member account usage - all required resources are in scattered |
| 11 | +- [X] pre-existing k8s cluster we want to use to deploy Sysdig for Cloud workload |
| 12 | + |
| 13 | +**Sysdig Secure For Cloud Requirements** |
| 14 | +- [X] account-specific threat-detection |
| 15 | +- [ ] account-specific/organizational? image scanning (WIP) |
| 16 | +- [ ] account-specific/organizational? benchmark (WIP) |
| 17 | +- [X] pre-existing kubernetes management vía service account (WIP) |
| 18 | +<br/>this has not been tested yet, we rely on an `accessKey` created specifically for Sysdig-For-Cloud. |
| 19 | +<!-- |
| 20 | +Skip step 4 and remove `aws_access_key_id` and `aws_secret_access_key` parameters from `org_k8s_threat_reuse_cloudtrail` module |
| 21 | +--> |
| 22 | + |
| 23 | +## Suggested building-blocks |
| 24 | + |
| 25 | +1. Define different **AWS providers** |
| 26 | + 1. Populate `_REGION_` and `_S3_REGION_` |
| 27 | + 2. Because we are going to provision resources on multiple accounts, we're gonna need several AWS providers |
| 28 | + |
| 29 | + 2. `s3` for s3-sns-sqs resources to be deployed. IAM user-credentials, to be used for k8s must also be in S3 account |
| 30 | + 3. `sfc` for secure-for-cloud utilitary resources to be deployed |
| 31 | + |
| 32 | + |
| 33 | +```terraform |
| 34 | +provider "aws" { |
| 35 | + alias = "s3" |
| 36 | + region = "_S3_REGION_" |
| 37 | + ... |
| 38 | +} |
| 39 | +
|
| 40 | +provider "aws" { |
| 41 | + alias = "sfc" |
| 42 | + region = "_REGION_" |
| 43 | + ... |
| 44 | +} |
| 45 | +
|
| 46 | +``` |
| 47 | + |
| 48 | +2. **Helm provider** definition |
| 49 | + |
| 50 | +Sysdig workload will be deployed through its official **Helm** [cloud-connector chart](https://charts.sysdig.com/charts/cloud-connector/). |
| 51 | +<br/>Note: Configure [**Helm** Provider](https://registry.terraform.io/providers/hashicorp/helm/latest/docs) for **Kubernetes** cluster |
| 52 | +<br/>ex:. |
| 53 | +```terraform |
| 54 | +provider "helm" { |
| 55 | + kubernetes { |
| 56 | + config_path = "~/.kube/config" |
| 57 | + } |
| 58 | +} |
| 59 | +
|
| 60 | +``` |
| 61 | + |
| 62 | +3. **Cloudtrail-S3-SNS-SQS** |
| 63 | + |
| 64 | + 1. Populate `_CLOUDTRAIL_S3_NAME_` |
| 65 | + <br/>ex.: |
| 66 | + ```text |
| 67 | + cloudtrail_s3_name=cloudtrail-logging-237944556329 |
| 68 | + ``` |
| 69 | + 2. Populate `_CLOUDTRAIL_S3_FILTER_PREFIX_` in order to ingest a specific-account. Otherwise just remove its assignation |
| 70 | + <br/>ex.: |
| 71 | + ```text |
| 72 | + s3_event_notification_filter_prefix=cloudtrail/AWSLogs/237944556329 |
| 73 | + ``` |
| 74 | + |
| 75 | +```terraform |
| 76 | +module "cloudtrail_s3_sns_sqs" { |
| 77 | + providers = { |
| 78 | + aws = aws.s3 |
| 79 | + } |
| 80 | + source = "sysdiglabs/secure-for-cloud/aws//modules/infrastructure/cloudtrail_s3-sns-sqs" |
| 81 | + cloudtrail_s3_name = _CLOUDTRAIL_S3_NAME_ |
| 82 | + s3_event_notification_filter_prefix=_CLOUDTRAIL_S3_FILTER_PREFIX_ |
| 83 | +} |
| 84 | +``` |
| 85 | + |
| 86 | + |
| 87 | +4. Kubernetes Organizational **User Permissions** to be able to handle S3/SQS operations |
| 88 | +<br/>Because Helm Cloud-Connector chart require specific AWS credentials to be passed by parameter, a new user + access key will be created within account. See [`modules/infrastructure/permissions/iam-user`](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/blob/master/modules/infrastructure/permissions/iam-user) |
| 89 | + |
| 90 | +```terraform |
| 91 | +module "org_user" { |
| 92 | + providers = { |
| 93 | + aws = aws.s3 |
| 94 | + } |
| 95 | + source = "sysdiglabs/secure-for-cloud/aws//modules/infrastructure/permissions/iam-user" |
| 96 | + deploy_image_scanning = false |
| 97 | + cloudtrail_s3_bucket_arn = module.cloudtrail_s3_sns_sqs.cloudtrail_s3_arn |
| 98 | + cloudtrail_subscribed_sqs_arn = module.cloudtrail_s3_sns_sqs.cloudtrail_subscribed_sqs_arn |
| 99 | +} |
| 100 | +``` |
| 101 | + |
| 102 | +5. **Sysdig workload deployment on K8s** |
| 103 | + |
| 104 | + * Populate `_SYSDIG_SECURE_ENDPOINT_` and `_SYSDID_SECURE_API_TOKEN_` |
| 105 | + |
| 106 | +```terraform |
| 107 | +# force some waiting for org_user creation (eventual consistency) |
| 108 | +resource "time_sleep" "wait" { |
| 109 | + depends_on = [module.org_user] |
| 110 | + create_duration = "5s" |
| 111 | +} |
| 112 | +
|
| 113 | +module "org_k8s_threat_reuse_cloudtrail" { |
| 114 | + providers = { |
| 115 | + aws = aws.sfc |
| 116 | + } |
| 117 | + source = "sysdiglabs/secure-for-cloud/aws//examples-internal/organizational-k8s-threat-reuse_cloudtrail" |
| 118 | + name = "test-orgk8s" |
| 119 | +
|
| 120 | + sysdig_secure_endpoint = _SYSDIG_SECURE_ENDPOINT_ |
| 121 | + sysdig_secure_api_token = _SYSDID_SECURE_API_TOKEN_ |
| 122 | + cloudtrail_s3_sns_sqs_url = module.cloudtrail_s3_sns_sqs.cloudtrail_subscribed_sqs_url |
| 123 | +
|
| 124 | + aws_access_key_id = module.org_user.sfc_user_access_key_id |
| 125 | + aws_secret_access_key = module.org_user.sfc_user_secret_access_key |
| 126 | +
|
| 127 | + depends_on = [module.org_user.sfc_user_arn, time_sleep.wait] |
| 128 | +} |
| 129 | +``` |
0 commit comments