Skip to content

Commit 1253701

Browse files
ravinadhruve10ravinadhruve10
authored
Cleanup partial support for delegated_admin (#14)
Fix summary: ------------- Fixing the partial support for delegated_admin in all modules, since this support does not fully onboard an org via delegated admin account today. Note: the full, complete and well tested support for delegated admin will be added later separately.
1 parent a6ca4e8 commit 1253701

File tree

16 files changed

+17
-117
lines changed

16 files changed

+17
-117
lines changed

‎modules/agentless-scanning/README.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ The following resources will be created in each instrumented account through Clo
66
- An `IAM Role` and associated `policies` that allows Sysdig to perform tasks necessary for agentless scanning.
77
- A `KMS key` used to transcript volume snapshots in the each region. `Alias` for this key in each region.
88

9-
When run in Organizational mode, this module will be deployed via CloudFormation StackSets that should be created in the management account. They will create the above resources in each account in the organization, and automatically in any member accounts that are later added to the organization. If a delegated admin account is used, only SERVICE_MANAGED stacksets will be created in the delegated admin account, responsible for creating the above resources in each account in the organization.
9+
When run in Organizational mode, this module will be deployed via CloudFormation StackSets that should be created in the management account. They will create the above resources in each account in the organization, and automatically in any member accounts that are later added to the organization.
1010

1111
This module will also deploy a Trusted Role Component and a Crypto Key Component in Sysdig Backend for onboarded Sysdig Cloud Account.
1212

@@ -74,7 +74,6 @@ No modules.
7474
| <a name="auto_create_stackset_roles"></a> [auto\_create\_stackset\_roles](#input\_auto\_create\_stackset\_roles) | Whether to auto create the custom stackset roles to run SELF_MANAGED stackset | `bool` | `true` | no |
7575
| <a name="input_tags"></a> [tags](#input\_tags) | sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning | `map(string)` | <pre>{<br> "product": "sysdig-secure-for-cloud"<br>}</pre> | no |
7676
| <a name="input_timeout"></a> [timeout](#input\_timeout) | Default timeout values for create, update, and delete operations | `string` | `"30m"` | no |
77-
| <a name="delegated_admin"></a> [delegated_admin](#input\_delegated\_admin) | Whether to create the resources using an delegated admin account | `bool` | `false` | no |
7877
| <a name="input_sysdig_secure_account_id"></a> [sysdig\_secure\_account\_id](#input\_sysdig\_secure\_account\_id) | ID of the Sysdig Cloud Account to enable Agentless Scanning for (incase of organization, ID of the Sysdig management account) | `string` | n/a | yes |
7978

8079
## Outputs

‎modules/agentless-scanning/main.tf‎

Lines changed: 10 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,10 @@
77
# For Organizational installs, see organizational.tf.
88
#
99
# For single installs, the resources in this file are used to instrument the singleton account, whether it is a management account or a
10-
# member account. (delegated admin account is a noop here for single installs)
10+
# member account.
1111
#
1212
# For organizational installs, resources in this file get created for management account only. (because service-managed stacksets do not
1313
# include the management account they are created in, even if this account is within the target Organization).
14-
# If a delegated admin account is used instead (determined via delegated_admin flag), resources will skip creation. This is because we
15-
# don't want to create these stacksets if user provides a delegated admin account instead of management account. (because service-managed
16-
# stacksets include the delegated admin account already)
1714
#-----------------------------------------------------------------------------------------------------------------------------------------
1815

1916
#-----------------------------------------------------------------------------------------
@@ -69,8 +66,7 @@ resource "random_id" "suffix" {
6966

7067
# IAM Policy Document used by Stackset roles for the KMS operations policy
7168
data "aws_iam_policy_document" "kms_operations" {
72-
# skip in org case if delegated_admin is used
73-
count = (var.is_organizational && var.delegated_admin) || !var.auto_create_stackset_roles ? 0 : 1
69+
count = !var.auto_create_stackset_roles ? 0 : 1
7470

7571
statement {
7672
sid = "KmsOperationsAccess"
@@ -85,8 +81,7 @@ data "aws_iam_policy_document" "kms_operations" {
8581
}
8682

8783
resource "aws_iam_role" "scanning_stackset_admin_role" {
88-
# skip resource creation in org case if delegated_admin is used
89-
count = (var.is_organizational && var.delegated_admin) || !var.auto_create_stackset_roles ? 0 : 1
84+
count = !var.auto_create_stackset_roles ? 0 : 1
9085

9186
name = "AWSCloudFormationStackSetAdministrationRoleForScanning"
9287
tags = var.tags
@@ -121,8 +116,7 @@ EOF
121116
#-----------------------------------------------------------------------------------------------------------------------------------------
122117

123118
resource "aws_iam_role" "scanning_stackset_execution_role" {
124-
# skip resource creation in org case if delegated_admin is used
125-
count = (var.is_organizational && var.delegated_admin) || !var.auto_create_stackset_roles ? 0 : 1
119+
count = !var.auto_create_stackset_roles ? 0 : 1
126120

127121
name = "AWSCloudFormationStackSetExecutionRoleForScanning"
128122
tags = var.tags
@@ -157,9 +151,6 @@ EOF
157151
#-----------------------------------------------------------------------------------------------------------------------------------------
158152

159153
data "aws_iam_policy_document" "scanning" {
160-
# skip in org case if delegated_admin is used
161-
count = var.is_organizational && var.delegated_admin ? 0 : 1
162-
163154
# General read permission, necessary for the discovery phase.
164155
statement {
165156
sid = "Read"
@@ -322,12 +313,9 @@ data "aws_iam_policy_document" "scanning" {
322313
}
323314

324315
resource "aws_iam_policy" "scanning_policy" {
325-
# skip resource creation in org case if delegated_admin is used
326-
count = var.is_organizational && var.delegated_admin ? 0 : 1
327-
328316
name = local.scanning_resource_name
329317
description = "Grants Sysdig Secure access to volumes and snapshots"
330-
policy = data.aws_iam_policy_document.scanning[0].json
318+
policy = data.aws_iam_policy_document.scanning.json
331319
tags = var.tags
332320
}
333321

@@ -336,9 +324,6 @@ resource "aws_iam_policy" "scanning_policy" {
336324
#-----------------------------------------------------------------------------------------------------------------------------------------
337325

338326
data "aws_iam_policy_document" "scanning_assume_role_policy" {
339-
# skip resource creation in org case if delegated_admin is used
340-
count = var.is_organizational && var.delegated_admin ? 0 : 1
341-
342327
statement {
343328
sid = "SysdigSecureScanning"
344329

@@ -367,21 +352,15 @@ data "aws_iam_policy_document" "scanning_assume_role_policy" {
367352
#-----------------------------------------------------------------------------------------------------------------------------------------
368353

369354
resource "aws_iam_role" "scanning_role" {
370-
# skip resource creation in org case if delegated_admin is used
371-
count = var.is_organizational && var.delegated_admin ? 0 : 1
372-
373355
name = local.scanning_resource_name
374356
tags = var.tags
375-
assume_role_policy = data.aws_iam_policy_document.scanning_assume_role_policy[0].json
357+
assume_role_policy = data.aws_iam_policy_document.scanning_assume_role_policy.json
376358
}
377359

378360
resource "aws_iam_policy_attachment" "scanning_policy_attachment" {
379-
# skip resource creation in org case if delegated_admin is used
380-
count = var.is_organizational && var.delegated_admin ? 0 : 1
381-
382361
name = local.scanning_resource_name
383-
roles = [aws_iam_role.scanning_role[0].name]
384-
policy_arn = aws_iam_policy.scanning_policy[0].arn
362+
roles = [aws_iam_role.scanning_role.name]
363+
policy_arn = aws_iam_policy.scanning_policy.arn
385364
}
386365

387366
#-----------------------------------------------------------------------------------------------------------------------------------------
@@ -393,9 +372,6 @@ resource "aws_iam_policy_attachment" "scanning_policy_attachment" {
393372
#-----------------------------------------------------------------------------------------------------------------------------------------
394373

395374
resource "aws_cloudformation_stack_set" "primary_acc_stackset" {
396-
# skip self managed stacksets in org case if delegated_admin is used
397-
count = var.is_organizational && var.delegated_admin ? 0 : 1
398-
399375
name = join("-", [local.scanning_resource_name, "ScanningKmsPrimaryAcc"])
400376
tags = var.tags
401377
permission_model = "SELF_MANAGED"
@@ -458,11 +434,10 @@ TEMPLATE
458434

459435
# stackset instance to deploy resources for agentless scanning, in all regions of given account
460436
resource "aws_cloudformation_stack_set_instance" "primary_acc_stackset_instance" {
461-
# skip self managed stackset instances in org case if delegated_admin is used
462-
for_each = var.is_organizational && var.delegated_admin ? toset([]) : local.region_set
437+
for_each = local.region_set
463438
region = each.key
464439

465-
stack_set_name = aws_cloudformation_stack_set.primary_acc_stackset[0].name
440+
stack_set_name = aws_cloudformation_stack_set.primary_acc_stackset.name
466441
operation_preferences {
467442
max_concurrent_percentage = 100
468443
failure_tolerance_percentage = var.failure_tolerance_percentage

‎modules/agentless-scanning/organizational.tf‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,6 @@
55
# Non-global / Regional resources:
66
# - a KMS Primary key is created, in each region of region list,
77
# - an Alias by the same name for the respective key, in each region of region list.
8-
#
9-
# If a delegated admin account is used (determined via delegated_admin flag), service-managed stacksets will be created
10-
# acting as delegated_admin to deploy resources in all acocunts within AWS Organization.
118
#-----------------------------------------------------------------------------------------------------------------------
129

1310
data "aws_organizations_organization" "org" {
@@ -44,8 +41,6 @@ resource "aws_cloudformation_stack_set" "scanning_role_stackset" {
4441
ignore_changes = [administration_role_arn]
4542
}
4643

47-
call_as = var.delegated_admin ? "DELEGATED_ADMIN" : "SELF"
48-
4944
template_body = <<TEMPLATE
5045
Resources:
5146
AgentlessScanningRole:
@@ -143,8 +138,6 @@ resource "aws_cloudformation_stack_set_instance" "scanning_role_stackset_instanc
143138
# Roles are not regional and hence do not need regional parallelism
144139
}
145140

146-
call_as = var.delegated_admin ? "DELEGATED_ADMIN" : "SELF"
147-
148141
timeouts {
149142
create = var.timeout
150143
update = var.timeout
@@ -180,8 +173,6 @@ resource "aws_cloudformation_stack_set" "ou_resources_stackset" {
180173
ignore_changes = [administration_role_arn]
181174
}
182175

183-
call_as = var.delegated_admin ? "DELEGATED_ADMIN" : "SELF"
184-
185176
template_body = <<TEMPLATE
186177
Resources:
187178
AgentlessScanningKmsPrimaryKey:
@@ -239,8 +230,6 @@ resource "aws_cloudformation_stack_set_instance" "ou_stackset_instance" {
239230
region_concurrency_type = "PARALLEL"
240231
}
241232

242-
call_as = var.delegated_admin ? "DELEGATED_ADMIN" : "SELF"
243-
244233
timeouts {
245234
create = var.timeout
246235
update = var.timeout

‎modules/agentless-scanning/variables.tf‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -78,12 +78,6 @@ variable "failure_tolerance_percentage" {
7878
default = 90
7979
}
8080

81-
variable "delegated_admin" {
82-
description = "Whether a delegated admin account will be used"
83-
type = bool
84-
default = false
85-
}
86-
8781
variable "sysdig_secure_account_id" {
8882
type = string
8983
description = "ID of the Sysdig Cloud Account to enable Agentless Scanning for (incase of organization, ID of the Sysdig management account)"

‎modules/config-posture/README.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,6 @@ No modules.
5151
| <a name="input_role_name"></a> [role\_name](#input\_role\_name) | The name of the IAM Role that will be created. | `string` | `"sysdig-secure"` | no |
5252
| <a name="input_tags"></a> [tags](#input\_tags) | sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning | `map(string)` | <pre>{<br> "product": "sysdig-secure-for-cloud"<br>}</pre> | no |
5353
| <a name="input_timeout"></a> [timeout](#input\_timeout) | Default timeout values for create, update, and delete operations | `string` | `"30m"` | no |
54-
| <a name="delegated_admin"></a> [delegated_admin](#input\_delegated\_admin) | Whether to create the resources using an delegated admin account | `bool` | `false` | no |
5554

5655
## Outputs
5756

‎modules/config-posture/main.tf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ data "sysdig_secure_tenant_external_id" "external_id" {}
1818
# Since this is not an Organizational deploy, create role/polices directly
1919
#----------------------------------------------------------
2020
resource "aws_iam_role" "cspm_role" {
21-
count = var.delegated_admin ? 0 : 1
2221
name = local.config_posture_role_name
2322
tags = var.tags
2423
assume_role_policy = <<EOF

‎modules/config-posture/organizational.tf‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,6 @@ resource "aws_cloudformation_stack_set" "stackset" {
3535
ignore_changes = [administration_role_arn]
3636
}
3737

38-
call_as = var.delegated_admin ? "DELEGATED_ADMIN" : "SELF"
39-
4038
template_body = <<TEMPLATE
4139
Resources:
4240
SysdigCSPMRole:
@@ -104,8 +102,6 @@ resource "aws_cloudformation_stack_set_instance" "stackset_instance" {
104102
# Roles are not regional and hence do not need regional parallelism
105103
}
106104

107-
call_as = var.delegated_admin ? "DELEGATED_ADMIN" : "SELF"
108-
109105
timeouts {
110106
create = var.timeout
111107
update = var.timeout

‎modules/config-posture/variables.tf‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -41,13 +41,6 @@ variable "failure_tolerance_percentage" {
4141
default = 90
4242
}
4343

44-
45-
variable "delegated_admin" {
46-
description = "Whether a delegated admin account will be used"
47-
type = bool
48-
default = false
49-
}
50-
5144
variable "sysdig_secure_account_id" {
5245
type = string
5346
description = "ID of the Sysdig Cloud Account to enable Config Posture for (incase of organization, ID of the Sysdig management account)"

‎modules/integrations/event-bridge/README.md‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,7 @@ The following resources will be created in each instrumented account through Clo
77
- An `EventBridge Target` that sends these events to an EventBridge Bus is Sysdig's AWS Account
88
- An `IAM Role` and associated policies that gives the EventBridge Bus in the source account permission to call PutEvent on the EventBridge Bus in Sysdig's Account.
99

10-
When run in Organizational mode, this module will be deployed via CloudFormation StackSets that should be created in the management account. They will create the above resources in each account in the organization, and automatically in any member accounts that are later added to the organization. If a delegated admin account is used, only
11-
SERVICE_MANAGED stacksets will be created in the delegated admin account, responsible for creating the above resources in each account in the organization.
10+
When run in Organizational mode, this module will be deployed via CloudFormation StackSets that should be created in the management account. They will create the above resources in each account in the organization, and automatically in any member accounts that are later added to the organization.
1211

1312
This module will also deploy an Event Bridge Component in Sysdig Backend for onboarded Sysdig Cloud Account.
1413

@@ -72,7 +71,6 @@ No modules.
7271
| <a name="auto_create_stackset_roles"></a> [auto\_create\_stackset\_roles](#input\_auto\_create\_stackset\_roles) | Whether to auto create the custom stackset roles to run SELF_MANAGED stackset | `bool` | `true` | no |
7372
| <a name="input_tags"></a> [tags](#input\_tags) | (Optional) Tags to be attached to all Sysdig resources. | `map(string)` | <pre>{<br> "product": "sysdig-secure-for-cloud"<br>}</pre> | no |
7473
| <a name="input_timeout"></a> [timeout](#input\_timeout) | Default timeout values for create, update, and delete operations | `string` | `"30m"` | no |
75-
| <a name="delegated_admin"></a> [delegated_admin](#input\_delegated\_admin) | Whether to create the resources using an delegated admin account | `bool` | `false` | no |
7674
| <a name="input_sysdig_secure_account_id"></a> [sysdig\_secure\_account\_id](#input\_sysdig\_secure\_account\_id) | ID of the Sysdig Cloud Account to enable Event Bridge integration for (incase of organization, ID of the Sysdig management account) | `string` | n/a | yes |
7775

7876
## Outputs

‎modules/integrations/event-bridge/main.tf‎

Lines changed: 5 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,10 @@
33
# For Organizational installs, see organizational.tf.
44
#
55
# For single installs, the resources in this file are used to instrument the singleton account, whether it is a management account or a
6-
# member account. (delegated admin account is a noop here for single installs)
6+
# member account.
77
#
88
# For organizational installs, resources in this file get created for management account only. (because service-managed stacksets do not
99
# include the management account they are created in, even if this account is within the target Organization).
10-
# If a delegated admin account is used instead (determined via delegated_admin flag), resources will skip creation. This is because we
11-
# don't want to create these stacksets if user provides a delegated admin account instead of management account. (because service-managed
12-
# stacksets include the delegated admin account already)
1310
#-----------------------------------------------------------------------------------------------------------------------------------------
1411

1512
#-----------------------------------------------------------------------------------------
@@ -57,8 +54,7 @@ resource "random_id" "suffix" {
5754
#-----------------------------------------------------------------------------------------------------------------------------------------
5855

5956
resource "aws_iam_role" "event_bus_stackset_admin_role" {
60-
# skip resource creation in org case if delegated_admin is used
61-
count = (var.is_organizational && var.delegated_admin) || !var.auto_create_stackset_roles ? 0 : 1
57+
count = !var.auto_create_stackset_roles ? 0 : 1
6258

6359
name = "AWSCloudFormationStackSetAdministrationRoleForEB"
6460
tags = var.tags
@@ -89,8 +85,7 @@ EOF
8985
#-----------------------------------------------------------------------------------------------------------------------------------------
9086

9187
resource "aws_iam_role" "event_bus_stackset_execution_role" {
92-
# skip resource creation in org case if delegated_admin is used
93-
count = (var.is_organizational && var.delegated_admin) || !var.auto_create_stackset_roles ? 0 : 1
88+
count = !var.auto_create_stackset_roles ? 0 : 1
9489

9590
name = "AWSCloudFormationStackSetExecutionRoleForEB"
9691
tags = var.tags
@@ -125,9 +120,6 @@ EOF
125120
#-----------------------------------------------------------------------------------------------------------------------------------------
126121

127122
resource "aws_iam_role" "event_bus_invoke_remote_event_bus" {
128-
# skip resource creation in org case if delegated_admin is used
129-
count = var.is_organizational && var.delegated_admin ? 0 : 1
130-
131123
name = local.eb_resource_name
132124
tags = var.tags
133125

@@ -208,9 +200,6 @@ data "aws_iam_policy_document" "cloud_trail_events" {
208200
#-----------------------------------------------------------------------------------------------------------------------------------------
209201

210202
resource "aws_cloudformation_stack_set" "primary-acc-stackset" {
211-
# skip self managed stacksets in org case if delegated_admin is used
212-
count = var.is_organizational && var.delegated_admin ? 0 : 1
213-
214203
# for single installs, primary account is the singleton account provided. for org installs, it is the mgmt account
215204
name = join("-", [local.eb_resource_name, "EBRulePrimaryAcc"])
216205
tags = var.tags
@@ -243,10 +232,9 @@ resource "aws_cloudformation_stack_set" "primary-acc-stackset" {
243232

244233
// stackset instance to deploy rule in all regions of given account
245234
resource "aws_cloudformation_stack_set_instance" "primary_acc_stackset_instance" {
246-
# skip self managed stackset instances in org case if delegated_admin is used
247-
for_each = var.is_organizational && var.delegated_admin ? toset([]) : local.region_set
235+
for_each = local.region_set
248236
region = each.key
249-
stack_set_name = aws_cloudformation_stack_set.primary-acc-stackset[0].name
237+
stack_set_name = aws_cloudformation_stack_set.primary-acc-stackset.name
250238

251239
operation_preferences {
252240
max_concurrent_percentage = 100

0 commit comments

Comments
 (0)