Skip to content

Commit 3b46ed5

Browse files
ravinadhruve10ravinadhruve10
authored
Add migration support for Orgs and bump sysdig versions (#46)
* Add migration support for Orgs and bump sysdig versions Change summary: ---------------- - To keep things backwards compatible for supporting migration from old variable to new variables for org onboarding, adding the necessary support. - Also, bumping up sysdig provider revisions across all modules to 1.51 * Fixes after testing Fix summary: ------------ 1. Updated error and warnings for deprecated 2. Polished the messages 3. Downgraded the sysdig provider version back to 1.48 4. Added provision to not recreate stacksets 5. If old param is present (ONLY or with include/exclude), we throw DEPRECATED warning & indicate we give preference to old param to maintain backwards compatibility. * Fix test samples * Fix event-bridge README * Set include/exclude fields only when org_unit_ids is not present
1 parent 90b6472 commit 3b46ed5

File tree

18 files changed

+386
-146
lines changed

18 files changed

+386
-146
lines changed

‎modules/agentless-scanning/locals.tf‎

Lines changed: 70 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,41 @@ data "aws_organizations_organization" "org" {
77
}
88

99
locals {
10+
# check if both old and new org parameters are provided, we fail early
11+
both_org_configuration_params = var.is_organizational && length(var.org_units) > 0 && (
12+
length(var.include_ouids) > 0 ||
13+
length(var.exclude_ouids) > 0 ||
14+
length(var.include_accounts) > 0 ||
15+
length(var.exclude_accounts) > 0
16+
)
17+
18+
# check if old org_units parameter is provided, for backwards compatibility we will always give preference to it
19+
check_old_ouid_param = var.is_organizational && length(var.org_units) > 0
20+
1021
# fetch the AWS Root OU under org
1122
# As per https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html#organization-structure, there can be only one root
1223
root_org_unit = var.is_organizational ? [for root in data.aws_organizations_organization.org[0].roots : root.id] : []
1324
}
1425

26+
check "validate_org_configuration_params" {
27+
assert {
28+
condition = length(var.org_units) == 0 # if this condition is false we throw warning
29+
error_message = <<-EOT
30+
WARNING: TO BE DEPRECATED 'org_units': Please work with Sysdig to migrate your Terraform installs to use 'include_ouids' instead.
31+
EOT
32+
}
33+
34+
assert {
35+
condition = !local.both_org_configuration_params # if this condition is false we throw error
36+
error_message = <<-EOT
37+
ERROR: If both org_units and include_ouids/exclude_ouids/include_accounts/exclude_accounts variables are populated,
38+
ONLY org_units will be considered. Please use only one of the two methods.
39+
40+
Note: org_units is going to be DEPRECATED soon, please work with Sysdig to migrate your Terraform installs.
41+
EOT
42+
}
43+
}
44+
1545
# *****************************************************************************************************************************************************
1646
# INCLUDE/EXCLUDE CONFIGURATION SUPPORT
1747
#
@@ -37,29 +67,37 @@ locals {
3767
locals {
3868
# OU CONFIGURATION (determine user provided org configuration)
3969
org_configuration = (
40-
# case1 - if no include/exclude ous provided, include entire org
41-
var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) == 0 ? (
42-
"entire_org"
70+
# case1 - if old method is used where ONLY org_units is provided, use those
71+
local.check_old_ouid_param ? (
72+
"old_ouid_param"
4373
) : (
44-
# case2 - if only included ouids provided, include those ous only
45-
var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) == 0 ? (
46-
"included_ous_only"
74+
# case2 - if no include/exclude ous provided, include entire org
75+
var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) == 0 ? (
76+
"entire_org"
4777
) : (
48-
# case3 - if only excluded ouids provided, exclude their accounts from rest of org
49-
var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) > 0 ? (
50-
"excluded_ous_only"
78+
# case3 - if only included ouids provided, include those ous only
79+
var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) == 0 ? (
80+
"included_ous_only"
5181
) : (
52-
# case4 - if both include and exclude ouids are provided, includes override excludes
53-
var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) > 0 ? (
54-
"mixed_ous"
55-
) : ""
82+
# case4 - if only excluded ouids provided, exclude their accounts from rest of org
83+
var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) > 0 ? (
84+
"excluded_ous_only"
85+
) : (
86+
# case5 - if both include and exclude ouids are provided, includes override excludes
87+
var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) > 0 ? (
88+
"mixed_ous"
89+
) : ""
90+
)
5691
)
5792
)
5893
)
5994
)
6095

6196
# switch cases for various user provided org configuration to be onboarded
6297
deployment_options = {
98+
old_ouid_param = {
99+
org_units_to_deploy = var.org_units
100+
}
63101
entire_org = {
64102
org_units_to_deploy = local.root_org_unit
65103
}
@@ -96,18 +134,23 @@ data "aws_organizations_organizational_unit_descendant_accounts" "ou_accounts_to
96134
locals {
97135
# ACCOUNTS CONFIGURATION (determine user provided accounts configuration)
98136
accounts_configuration = (
99-
# case1 - if only included accounts provided, include those accts as well
100-
var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) == 0 ? (
101-
"UNION"
137+
# case1 - if old method is used where ONLY org_units is provided, this configuration is a noop
138+
local.check_old_ouid_param ? (
139+
"NONE"
102140
) : (
103-
# case2 - if only excluded accounts or only excluded ouids provided, exclude those accounts
104-
var.is_organizational && length(var.include_accounts) == 0 && ( length(var.exclude_accounts) > 0 || local.org_configuration == "excluded_ous_only" ) ? (
105-
"DIFFERENCE"
141+
# case2 - if only included accounts provided, include those accts as well
142+
var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) == 0 ? (
143+
"UNION"
106144
) : (
107-
# case3 - if both include and exclude accounts are provided, includes override excludes
108-
var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) > 0 ? (
109-
"MIXED"
110-
) : ""
145+
# case3 - if only excluded accounts or only excluded ouids provided, exclude those accounts
146+
var.is_organizational && length(var.include_accounts) == 0 && ( length(var.exclude_accounts) > 0 || local.org_configuration == "excluded_ous_only" ) ? (
147+
"DIFFERENCE"
148+
) : (
149+
# case4 - if both include and exclude accounts are provided, includes override excludes
150+
var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) > 0 ? (
151+
"MIXED"
152+
) : ""
153+
)
111154
)
112155
)
113156
)
@@ -117,6 +160,10 @@ locals {
117160

118161
# switch cases for various user provided accounts configuration to be onboarded
119162
deployment_account_options = {
163+
NONE = {
164+
accounts_to_deploy = []
165+
account_filter_type = "NONE"
166+
}
120167
UNION = {
121168
accounts_to_deploy = var.include_accounts
122169
account_filter_type = "UNION"

‎modules/agentless-scanning/organizational.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -189,8 +189,8 @@ resource "aws_cloudformation_stack_set_instance" "ou_stackset_instance" {
189189
stack_set_name = aws_cloudformation_stack_set.ou_resources_stackset[0].name
190190
deployment_targets {
191191
organizational_unit_ids = local.deployment_targets_org_units
192-
accounts = local.deployment_targets_accounts_filter == "NONE" ? null : local.deployment_targets_accounts.accounts_to_deploy
193-
account_filter_type = local.deployment_targets_accounts_filter
192+
accounts = local.check_old_ouid_param ? null : (local.deployment_targets_accounts_filter == "NONE" ? null : local.deployment_targets_accounts.accounts_to_deploy)
193+
account_filter_type = local.check_old_ouid_param ? null : local.deployment_targets_accounts_filter
194194
}
195195
operation_preferences {
196196
max_concurrent_percentage = 100

‎modules/agentless-scanning/variables.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,9 @@ variable "is_organizational" {
3232

3333
variable "org_units" {
3434
description = <<-EOF
35-
DEPRECATED: Defaults to `[]`, use `include_ouids` instead.
36-
When set, list of Organization Unit IDs to setup Agentless Scanning. By default, Agentless Scanning will be setup in all accounts within the Organization."
35+
TO BE DEPRECATED: Please migrate to using `include_ouids` instead.
36+
When set, list of Organization Unit IDs to setup Agentless Scanning. By default, Agentless Scanning will be setup in all accounts within the Organization.
37+
This field is ignored if `is_organizational = false`
3738
EOF
3839
type = set(string)
3940
default = []

‎modules/config-posture/locals.tf‎

Lines changed: 70 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,41 @@ data "aws_organizations_organization" "org" {
77
}
88

99
locals {
10+
# check if both old and new org parameters are provided, we fail early
11+
both_org_configuration_params = var.is_organizational && length(var.org_units) > 0 && (
12+
length(var.include_ouids) > 0 ||
13+
length(var.exclude_ouids) > 0 ||
14+
length(var.include_accounts) > 0 ||
15+
length(var.exclude_accounts) > 0
16+
)
17+
18+
# check if old org_units parameter is provided, for backwards compatibility we will always give preference to it
19+
check_old_ouid_param = var.is_organizational && length(var.org_units) > 0
20+
1021
# fetch the AWS Root OU under org
1122
# As per https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html#organization-structure, there can be only one root
1223
root_org_unit = var.is_organizational ? [for root in data.aws_organizations_organization.org[0].roots : root.id] : []
1324
}
1425

26+
check "validate_org_configuration_params" {
27+
assert {
28+
condition = length(var.org_units) == 0 # if this condition is false we throw warning
29+
error_message = <<-EOT
30+
WARNING: TO BE DEPRECATED 'org_units': Please work with Sysdig to migrate your Terraform installs to use 'include_ouids' instead.
31+
EOT
32+
}
33+
34+
assert {
35+
condition = !local.both_org_configuration_params # if this condition is false we throw error
36+
error_message = <<-EOT
37+
ERROR: If both org_units and include_ouids/exclude_ouids/include_accounts/exclude_accounts variables are populated,
38+
ONLY org_units will be considered. Please use only one of the two methods.
39+
40+
Note: org_units is going to be DEPRECATED soon, please work with Sysdig to migrate your Terraform installs.
41+
EOT
42+
}
43+
}
44+
1545
# *****************************************************************************************************************************************************
1646
# INCLUDE/EXCLUDE CONFIGURATION SUPPORT
1747
#
@@ -37,29 +67,37 @@ locals {
3767
locals {
3868
# OU CONFIGURATION (determine user provided org configuration)
3969
org_configuration = (
40-
# case1 - if no include/exclude ous provided, include entire org
41-
var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) == 0 ? (
42-
"entire_org"
70+
# case1 - if old method is used where ONLY org_units is provided, use those
71+
local.check_old_ouid_param ? (
72+
"old_ouid_param"
4373
) : (
44-
# case2 - if only included ouids provided, include those ous only
45-
var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) == 0 ? (
46-
"included_ous_only"
74+
# case2 - if no include/exclude ous provided, include entire org
75+
var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) == 0 ? (
76+
"entire_org"
4777
) : (
48-
# case3 - if only excluded ouids provided, exclude their accounts from rest of org
49-
var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) > 0 ? (
50-
"excluded_ous_only"
78+
# case3 - if only included ouids provided, include those ous only
79+
var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) == 0 ? (
80+
"included_ous_only"
5181
) : (
52-
# case4 - if both include and exclude ouids are provided, includes override excludes
53-
var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) > 0 ? (
54-
"mixed_ous"
55-
) : ""
82+
# case4 - if only excluded ouids provided, exclude their accounts from rest of org
83+
var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) > 0 ? (
84+
"excluded_ous_only"
85+
) : (
86+
# case5 - if both include and exclude ouids are provided, includes override excludes
87+
var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) > 0 ? (
88+
"mixed_ous"
89+
) : ""
90+
)
5691
)
5792
)
5893
)
5994
)
6095

6196
# switch cases for various user provided org configuration to be onboarded
6297
deployment_options = {
98+
old_ouid_param = {
99+
org_units_to_deploy = var.org_units
100+
}
63101
entire_org = {
64102
org_units_to_deploy = local.root_org_unit
65103
}
@@ -96,18 +134,23 @@ data "aws_organizations_organizational_unit_descendant_accounts" "ou_accounts_to
96134
locals {
97135
# ACCOUNTS CONFIGURATION (determine user provided accounts configuration)
98136
accounts_configuration = (
99-
# case1 - if only included accounts provided, include those accts as well
100-
var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) == 0 ? (
101-
"UNION"
137+
# case1 - if old method is used where ONLY org_units is provided, this configuration is a noop
138+
local.check_old_ouid_param ? (
139+
"NONE"
102140
) : (
103-
# case2 - if only excluded accounts or only excluded ouids provided, exclude those accounts
104-
var.is_organizational && length(var.include_accounts) == 0 && ( length(var.exclude_accounts) > 0 || local.org_configuration == "excluded_ous_only" ) ? (
105-
"DIFFERENCE"
141+
# case2 - if only included accounts provided, include those accts as well
142+
var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) == 0 ? (
143+
"UNION"
106144
) : (
107-
# case3 - if both include and exclude accounts are provided, includes override excludes
108-
var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) > 0 ? (
109-
"MIXED"
110-
) : ""
145+
# case3 - if only excluded accounts or only excluded ouids provided, exclude those accounts
146+
var.is_organizational && length(var.include_accounts) == 0 && ( length(var.exclude_accounts) > 0 || local.org_configuration == "excluded_ous_only" ) ? (
147+
"DIFFERENCE"
148+
) : (
149+
# case4 - if both include and exclude accounts are provided, includes override excludes
150+
var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) > 0 ? (
151+
"MIXED"
152+
) : ""
153+
)
111154
)
112155
)
113156
)
@@ -117,6 +160,10 @@ locals {
117160

118161
# switch cases for various user provided accounts configuration to be onboarded
119162
deployment_account_options = {
163+
NONE = {
164+
accounts_to_deploy = []
165+
account_filter_type = "NONE"
166+
}
120167
UNION = {
121168
accounts_to_deploy = var.include_accounts
122169
account_filter_type = "UNION"

‎modules/config-posture/organizational.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,8 +82,8 @@ resource "aws_cloudformation_stack_set_instance" "stackset_instance" {
8282
stack_set_name = aws_cloudformation_stack_set.stackset[0].name
8383
deployment_targets {
8484
organizational_unit_ids = local.deployment_targets_org_units
85-
accounts = local.deployment_targets_accounts_filter == "NONE" ? null : local.deployment_targets_accounts.accounts_to_deploy
86-
account_filter_type = local.deployment_targets_accounts_filter
85+
accounts = local.check_old_ouid_param ? null : (local.deployment_targets_accounts_filter == "NONE" ? null : local.deployment_targets_accounts.accounts_to_deploy)
86+
account_filter_type = local.check_old_ouid_param ? null : local.deployment_targets_accounts_filter
8787
}
8888
operation_preferences {
8989
max_concurrent_percentage = 100

‎modules/config-posture/variables.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,8 @@ variable "is_organizational" {
1010

1111
variable "org_units" {
1212
description = <<-EOF
13-
DEPRECATED: Defaults to `[]`, use `include_ouids` instead.
14-
When set, org units to install cspm."
13+
TO BE DEPRECATED: Please migrate to using `include_ouids` instead.
14+
When set, org units to install cspm.
1515
EOF
1616
type = set(string)
1717
default = []

‎modules/integrations/event-bridge/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,15 +21,15 @@ If instrumenting an AWS Gov account/organization, IAM policies and event bridge
2121
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
2222
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.60.0 |
2323
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 3.1 |
24-
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | ~> 1.39 |
24+
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | ~> 1.48 |
2525

2626
## Providers
2727

2828
| Name | Version |
2929
|------|---------|
3030
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.60.0 |
3131
| <a name="provider_random"></a> [random](#provider\_random) | >= 3.1 |
32-
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | ~> 1.39 |
32+
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | ~> 1.48 |
3333

3434
## Modules
3535

0 commit comments

Comments
 (0)