Skip to content

Commit 020e50f

Browse files
miguelpaismiguelpais
authored
[SSPROD-48724] AWS Modular Onboarding for VM Workload Scanning (#25)
* First version of VM Workload Scanning component for AWS * Small fixes to examples * With lambda included * Some fixes * Some changes * Workload scanning for AWS without EKS * Corrections from testing onboarding * Examples fix * Comments from chris geers
1 parent ad5a762 commit 020e50f

File tree

13 files changed

+540
-0
lines changed

13 files changed

+540
-0
lines changed

‎modules/config-posture/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,9 @@ No modules.
6363

6464
| Name | Description |
6565
|------|-------------|
66+
| <a name="output_config_posture_component_id"></a> [config_posture_component_id](#output_config_posture_component_id) | Component identifier of trusted identity created in Sysdig Backend for Config Posture |
67+
| <a name="output_cspm_role_arn"></a> [cspm_role_arn](#output_cspm_role_arn) | The ARN of the CSPM role |
68+
| <a name="output_sysdig_secure_account_id"></a> [sysdig_secure_account_id](#output_sysdig_secure_account_id) | ID of the Sysdig Cloud Account to enable Config Posture for (in case of organization, ID of the Sysdig management account) |
6669
| <a name="output_config_posture_component_id"></a> [config\_posture\_component\_id](#output\_config\_posture\_component\_id) | The component id of the config posture trusted identity |
6770
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
6871

‎modules/config-posture/outputs.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,15 @@ output "config_posture_component_id" {
22
value = "${sysdig_secure_cloud_auth_account_component.config_posture_role.type}/${sysdig_secure_cloud_auth_account_component.config_posture_role.instance}"
33
description = "Component identifier of trusted identity created in Sysdig Backend for Config Posture"
44
depends_on = [sysdig_secure_cloud_auth_account_component.config_posture_role]
5+
}
6+
7+
output "cspm_role_arn" {
8+
value = aws_iam_role.cspm_role.arn
9+
description = "The ARN of the CSPM role"
10+
depends_on = [aws_iam_role.cspm_role]
11+
}
12+
13+
output "sysdig_secure_account_id" {
14+
value = var.sysdig_secure_account_id
15+
description = "ID of the Sysdig Cloud Account to enable Config Posture for (incase of organization, ID of the Sysdig management account)"
516
}

‎modules/vm-workload-scanning/README.md‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# AWS VM Workload Scanning Module
2+
3+
This Module creates the resources required to perform agentless workload scanning operations.
4+
By default, it will create a role with permissions necessary to access and pull ECR images in the account where it is deployed.
5+
Combined with the base onboarding, this allows for scanning ECS Services and Tasks pointing to ECR images.
6+
Also public docker images and private repos are supported, as long as private repository permissions are granted to Sysdig using the Registry Credentials UI.
7+
8+
Optional, if AWS Lambda is enabled, we will have visibility on a set of Lambda functions in the account and be able to scan its resources.
9+
10+
The following resources will be created in each instrumented account:
11+
- An IAM Role and associated policies that allows Sysdig to perform tasks necessary for vm agentless workload scanning, i.e.
12+
pull images from ECR, optionally obtain lambda function code and details.
13+
14+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
15+
## Requirements
16+
17+
| Name | Version |
18+
|---------------------------------------------------------------------------|-----------|
19+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | ~> 1.7 |
20+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.60.0 |
21+
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | ~> 1.37 |
22+
23+
## Providers
24+
25+
| Name | Version |
26+
|------------------------------------------------------------|----------|
27+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.60.0 |
28+
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | ~> 1.37 |
29+
30+
## Modules
31+
32+
No modules.
33+
34+
## Resources
35+
36+
| Name | Type |
37+
|------|------|
38+
| [sysdig_secure_tenant_external_id.external_id](https://registry.terraform.io/providers/sysdig/sysdig/latest/docs/data-sources/tenant_external_id) | data source |
39+
| [aws_iam_policy.ecr_scanning](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
40+
| [aws_iam_role.scanning](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
41+
| [aws_iam_policy_attachment.scanning](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy_attachment) | resource |
42+
| [sysdig_secure_cloud_auth_account_component.vm_workload_scanning_account_component](https://registry.terraform.io/providers/sysdig/sysdig/latest/docs/resources/cloud_auth_account_component) | resource |
43+
| [aws_cloudformation_stack_set.scanning_role_stackset](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudformation_stack_set) | resource |
44+
| [aws_cloudformation_stack_set_instance.scanning_role_stackset_instance](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudformation_stack_set_instance) | resource |
45+
| [aws_organizations_organization.org](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/organizations_organization) | data source |
46+
47+
48+
## Inputs
49+
50+
## Inputs
51+
52+
| Name | Description | Type | Default | Required |
53+
|------|-------------|------|---------|:--------:|
54+
| <a name="input_tags"></a> [tags](#input_tags) | sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning | `map(string)` | <pre>{<br>"product": "sysdig-secure-for-cloud"<br>}</pre> | no |
55+
| <a name="input_is_organizational"></a> [is_organizational](#input_is_organizational) | Set this field to 'true' to deploy Agentless Workload Scanning to an AWS Organization (Or specific OUs) | `bool` | `false` | no |
56+
| <a name="input_organizational_units_ids"></a> [organizational_units_ids](#input_org_units) | List of Organization Unit IDs in which to setup Agentless Workload Scanning. By default, Agentless Workload Scanning will be setup in all accounts within the Organization. This field is ignored if `is_organizational = false` | `set(string)` | `[]` | no |
57+
| <a name="input_timeout"></a> [timeout](#input_timeout) | Default timeout values for create, update, and delete operations | `string` | `"30m"` | no |
58+
| <a name="input_failure_tolerance_percentage"></a> [failure_tolerance_percentage](#input_failure_tolerance_percentage) | The percentage of accounts, per Region, for which stack operations can fail before AWS CloudFormation stops the operation in that Region | `number` | `90` | no |
59+
| <a name="input_lambda_scanning_enabled"></a> [lambda_scanning_enabled](#input_lambda_scanning_enabled) | Set this field to 'true' to deploy Agentless Workload Scanning for Lambda functions | `bool` | `false` | no |
60+
| <a name="input_sysdig_secure_account_id"></a> [sysdig_secure_account_id](#input_sysdig_secure_account_id) | ID of the Sysdig Cloud Account to enable Config Posture for (in case of organization, ID of the Sysdig management account) | `string` | n/a | yes |
61+
62+
## Outputs
63+
64+
| Name | Description |
65+
|------|-------------|
66+
| <a name="output_role_arn"></a> [role_arn](#output_role_arn) | Role used by Sysdig Platform for Agentless Workload Scanning |
67+
| <a name="output_vm_workload_scanning_component_id"></a> [vm_workload_scanning_component_id](#output_vm_workload_scanning_component_id) | Component identifier of trusted identity created in Sysdig Backend for VM Workload Scanning |
68+
69+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
70+
71+
## Authors
72+
73+
Module is maintained by [Sysdig](https://sysdig.com).
74+
75+
## License
76+
77+
Apache 2 Licensed. See LICENSE for full details.

‎modules/vm-workload-scanning/locals.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
// generate a random suffix for the config-posture role name
2+
3+
resource "random_id" "suffix" {
4+
byte_length = 3
5+
}
6+
7+
locals {
8+
ecr_role_name = "sysdig-vm-workload-scanning-${random_id.suffix.hex}"
9+
}

‎modules/vm-workload-scanning/main.tf‎

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
data "sysdig_secure_tenant_external_id" "cloud_auth_external_id" {}
2+
3+
data "sysdig_secure_trusted_cloud_identity" "trusted_identity" {
4+
cloud_provider = "aws"
5+
}
6+
7+
###########################################
8+
# Workload Controller IAM roles and stuff #
9+
###########################################
10+
11+
#-----------------------------------------------------------------------------------------------------------------------
12+
# Determine if this is an Organizational install, or a single account install. For Single Account installs, resources
13+
# are created directly using the AWS Terraform Provider (This is the default behaviour). For Organizational installs,
14+
# see organizational.tf, and the resources in this file are used to instrument the management account (StackSets do not
15+
# include the management account they are created in, even if this account is within the target Organization).
16+
#-----------------------------------------------------------------------------------------------------------------------
17+
18+
#-----------------------------------------------------------------------------------------------------------------------
19+
# These resources create an Agentless Workload Scanning IAM Role and IAM Policy in the account.
20+
#-----------------------------------------------------------------------------------------------------------------------
21+
22+
data "aws_iam_policy_document" "scanning" {
23+
# General ECR read permission, necessary for the fetching artifacts.
24+
statement {
25+
sid = "EcrReadPermissions"
26+
27+
effect = "Allow"
28+
29+
actions = [
30+
"ecr:GetDownloadUrlForLayer",
31+
"ecr:BatchGetImage",
32+
"ecr:BatchCheckLayerAvailability",
33+
"ecr:ListImages",
34+
"ecr:GetAuthorizationToken",
35+
]
36+
37+
resources = [
38+
"*",
39+
]
40+
}
41+
}
42+
43+
data "aws_iam_policy_document" "functions" {
44+
count = var.lambda_scanning_enabled ? 1 : 0
45+
46+
statement {
47+
sid = "SysdigWorkloadFunctionsScanning"
48+
49+
effect = "Allow"
50+
51+
actions = [
52+
"lambda:GetFunction",
53+
"lambda:GetFunctionConfiguration",
54+
"lambda:GetRuntimeManagementConfig",
55+
"lambda:ListFunctions",
56+
"lambda:ListTagsForResource",
57+
"lambda:GetLayerVersionByArn",
58+
"lambda:GetLayerVersion",
59+
"lambda:ListLayers",
60+
"lambda:ListLayerVersions"
61+
]
62+
63+
resources = [
64+
"*",
65+
]
66+
}
67+
}
68+
69+
resource "aws_iam_policy" "ecr_scanning" {
70+
count = var.is_organizational ? 0 : 1
71+
72+
name = "${local.ecr_role_name}-ecr"
73+
description = "Grants Sysdig Secure access to ECR images"
74+
policy = data.aws_iam_policy_document.scanning.json
75+
tags = var.tags
76+
}
77+
78+
resource "aws_iam_policy" "functions_scanning" {
79+
count = var.lambda_scanning_enabled && !var.is_organizational? 1 : 0
80+
81+
name = "${local.ecr_role_name}-functions"
82+
description = "Grants Sysdig Secure access to AWS Lambda"
83+
policy = data.aws_iam_policy_document.functions[0].json
84+
tags = var.tags
85+
}
86+
87+
data "aws_iam_policy_document" "scanning_assume_role_policy" {
88+
statement {
89+
sid = "SysdigWorkloadScanning"
90+
91+
actions = [
92+
"sts:AssumeRole"
93+
]
94+
95+
principals {
96+
type = "AWS"
97+
identifiers = [
98+
data.sysdig_secure_trusted_cloud_identity.trusted_identity.identity
99+
]
100+
}
101+
102+
condition {
103+
test = "StringEquals"
104+
variable = "sts:ExternalId"
105+
values = [data.sysdig_secure_tenant_external_id.cloud_auth_external_id.external_id]
106+
}
107+
}
108+
}
109+
110+
resource "aws_iam_role" "scanning" {
111+
count = var.is_organizational ? 0 : 1
112+
113+
name = local.ecr_role_name
114+
tags = var.tags
115+
assume_role_policy = data.aws_iam_policy_document.scanning_assume_role_policy.json
116+
}
117+
118+
resource "aws_iam_policy_attachment" "scanning" {
119+
count = var.is_organizational ? 0 : 1
120+
121+
name = local.ecr_role_name
122+
roles = [aws_iam_role.scanning[0].name]
123+
policy_arn = aws_iam_policy.ecr_scanning[0].arn
124+
}
125+
126+
resource "aws_iam_policy_attachment" "functions" {
127+
count = var.lambda_scanning_enabled && !var.is_organizational ? 1 : 0
128+
129+
name = local.ecr_role_name
130+
roles = [aws_iam_role.scanning[0].name]
131+
policy_arn = aws_iam_policy.functions_scanning[0].arn
132+
}
133+
134+
#--------------------------------------------------------------------------------------------------------------
135+
# Call Sysdig Backend to add the trusted role for Config Posture to the Sysdig Cloud Account
136+
#
137+
# Note (optional): To ensure this gets called after all cloud resources are created, add
138+
# explicit dependency using depends_on
139+
#--------------------------------------------------------------------------------------------------------------
140+
resource "sysdig_secure_cloud_auth_account_component" "vm_workload_scanning_account_component" {
141+
account_id = var.sysdig_secure_account_id
142+
143+
type = "COMPONENT_TRUSTED_ROLE"
144+
instance = "secure-vm-workload-scanning"
145+
version = "v0.1.0"
146+
trusted_role_metadata = jsonencode({
147+
aws = {
148+
role_name = aws_iam_role.scanning[0].name
149+
}
150+
})
151+
152+
depends_on = [
153+
aws_iam_policy.ecr_scanning,
154+
aws_iam_role.scanning,
155+
aws_iam_policy_attachment.scanning,
156+
aws_cloudformation_stack_set.scanning_role_stackset,
157+
aws_cloudformation_stack_set_instance.scanning_role_stackset_instance,
158+
aws_iam_policy.functions_scanning,
159+
aws_iam_policy_attachment.functions,
160+
]
161+
}

0 commit comments

Comments
 (0)