Skip to content

Commit 138a764

Browse files
ravinadhruve10ravinadhruve10
committed
Remove unnecessary WorkloadIdentity role from CSPM Org member
Change summary: ---------------- 1. Removing the WI role used for WIF under org membership. We already add it directly at the SA membership level. 2. Updated the README with Modular Onboarding details and legacy notes. Test summary: -------------- Validated this change on a live foundational onboarding.
1 parent 69a16db commit 138a764

File tree

2 files changed

+91
-5
lines changed

2 files changed

+91
-5
lines changed

‎README.md‎

Lines changed: 90 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,99 @@
22

33
Terraform module that deploys the Sysdig Secure for Cloud stack in GCP.
44

5+
With Modular Onboarding, introducing the following design and install structure for `terraform-google-secure`:
6+
7+
* **[Onboarding]**: It onboards a GCP Project or Organization for the first time to Sysdig Secure for Cloud, and collects
8+
inventory and organizational hierarchy in the given GCP Organization. Managed through `onboarding` module. <br/>
9+
510
Provides unified threat-detection, compliance, forensics and analysis through these major components:
611

7-
* **[CSPM](https://docs.sysdig.com/en/docs/sysdig-secure/posture/)**: It evaluates periodically your cloud configuration, using Cloud Custodian, against some benchmarks and returns the results and remediation you need to fix. Managed through `service-principal` module. <br/>
12+
* **[CSPM](https://docs.sysdig.com/en/docs/sysdig-secure/posture/)**: It evaluates periodically your cloud configuration, using Cloud Custodian, against some benchmarks and returns the results and remediation you need to fix. Managed through `config-posture` module. <br/>
13+
14+
* **[CIEM](https://docs.sysdig.com/en/docs/sysdig-secure/posture/identity-and-access/)**: Permissions and Entitlements management. Managed through `config-posture` module. <br/>
15+
16+
* **[CDR (Cloud Detection and Response)]((https://docs.sysdig.com/en/docs/sysdig-secure/threats/activity/events-feed/))**: It sends periodically the Audit Logs collected from a GCP project/organization to Sysdig's systems, this by collecting them in a PubSub topic through a Sink and then sending them through a `PUSH` integration. Managed through `pub-sub` integrations module. <br/>
17+
18+
For other Cloud providers check: [AWS](https://github.com/sysdiglabs/terraform-aws-secure)
19+
20+
<br/>
21+
22+
## Modules
23+
24+
### Feature modules
25+
26+
These are independent feature modules which deploy and manage all the required Cloud resources and Sysdig resources
27+
for the respective Sysdig features. They manage both, onboarding a single GCP Project or a GCP Organization to Sysdig Secure for Cloud.
28+
29+
`onboarding`, `config-posture`, `agentless-scan` and `vm-workload-scanning` are independent feature modules.
30+
31+
### Integrations
32+
33+
The modules under `integrations` are feature agnostic modules which deploy and manage all the required Cloud resources and Sysdig resources for shared Sysdig integrations. That is to say, one or more Sysdig features can be enabled by installing an integration.
34+
35+
These modules manage both, onboarding a single GCP Project or a GCP Organization to Sysdig Secure for Cloud.
36+
37+
`pub-sub` is an integration module.
38+
39+
## Examples and usage
40+
41+
The modules in this repository can be installed on a single GCP project, or on an entire GCP Organization, or organizational folders within the org.
42+
43+
The `test` directory has sample `examples` for all these module deployments i.e under `modular_single_project`, or `modular_organization` sub-folders.
44+
45+
For example, to onboard a single GCP project, with CSPM and Basic CIEM enabled, with modular installation :-
46+
1. Run the terraform snippet under `test/examples/modular_single_project/onboarding_with_posture.tf` with
47+
the appropriate attribute values populated.
48+
2. This will install the `onboarding` module, which will also create a Cloud Account on Sysdig side.
49+
3. It will also install the `config-posture` module, which will also install cloud resources as well as Sysdig resources
50+
for successfully running CSPM and Basic Identity scans.
51+
4. On Sysdig side, you will be able to see the Cloud account onboarded with required components, and CSPM & Basic CIEM features installed and enabled.
52+
53+
To run this example you need have your GCP auth login via gcloud CLI and execute:
54+
```terraform
55+
$ terraform init
56+
$ terraform plan
57+
$ terraform apply
58+
```
59+
60+
Notice that:
61+
* This example will create resources that cost money.<br/>Run `terraform destroy` when you don't need them anymore
62+
* All created resources will be created within the tags `product:sysdig-secure-for-cloud`, within the resource-group `sysdig-secure-for-cloud`
63+
64+
<br/>
65+
66+
## Organizational Install Configurations
67+
68+
There are four new parameters to configure organizational deployments on the cloud for Sysdig Secure for Cloud :-
69+
1. `include_folders` - List of GCP Organizational Folders to deploy the Sysdig Secure for Cloud resources in.
70+
2. `exclude_folders` - List of GCP Organizational Folders to exclude deploying the Sysdig Secure for Cloud resources in.
71+
3. `include_projects` - List of GCP Projects to deploy the Sysdig Secure for Cloud resources in.
72+
4. `exclude_projects` - List of GCP Projects to exclude deploying the Sysdig Secure for Cloud resources in.
73+
74+
**WARNING**: module variable `management_group_ids` will be DEPRECATED on 30th November, 2025. Please work with Sysdig to migrate your Terraform installs to use `include_folders` instead to achieve the same deployment outcome.
75+
76+
**Note**: The modules under `modules/services/` folder are legacy installs and soon to be deprecated. Those modules are no longer used for Onboarding. Please use the corresponding feature modules as mentioned in `## Modules` section above for Modular Onboarding. It is the recommended form of Onboarding.
77+
78+
<br/>
79+
80+
## Best practices
81+
82+
For contributing to existing modules or adding new modules, below are some of the best practices recommended :-
83+
* Module names referred and used in deployment snippets should be consistent with those in their source path.
84+
* A module can fall into one of two categories - feature module or an integrations module.
85+
* Every user-facing deployment snippet will,
86+
- at the top level first call the feature module or integrations module from this repo. These modules deploy corresponding cloud resources and Sysdig component resources.
87+
- the corresponding feature resource will be added as the last block and enabled from the module installed component resource reference.
88+
See sample deployment snippets in `test/examples` for more.
89+
* integrations modules are shared and could enable multiple features. Hence, one should be careful with changes to them.
90+
* Module naming follows the pattern with "-" , resource and variable naming follows the pattern with "_".
91+
92+
## Authors
93+
94+
Module is maintained and supported by [Sysdig](https://sysdig.com).
895

9-
* **[CIEM](https://docs.sysdig.com/en/docs/sysdig-secure/posture/identity-and-access/)**: Permissions and Entitlements management. Managed through `service-principal` module. <br/>
96+
## License
1097

11-
* **[CDR (Cloud Detection and Response)]((https://docs.sysdig.com/en/docs/sysdig-secure/threats/activity/events-feed/))**: It sends periodically the Audit Logs collected from a GCP project/organization to Sysdig's systems, this by collecting them in a PubSub topic through a Sink and then sending them through a `PUSH` integration. Managed through `webhook-datasource` module. <br/>
98+
Apache 2 Licensed. See LICENSE for full details.
1299

13-
For other Cloud providers check: [AWS](https://github.com/draios/terraform-aws-secure-for-cloud)
14100

‎modules/config-posture/organizational.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ data "google_organization" "org" {
1616
#---------------------------------------------------------------------------------------------
1717
resource "google_organization_iam_member" "cspm" {
1818
# adding ciem role with permissions to the service account alongside cspm roles
19-
for_each = var.is_organizational ? toset(["roles/cloudasset.viewer", "roles/iam.workloadIdentityUser", "roles/logging.viewer", "roles/cloudfunctions.viewer", "roles/cloudbuild.builds.viewer", "roles/orgpolicy.policyViewer", "roles/recommender.viewer", "roles/iam.serviceAccountViewer", "roles/iam.organizationRoleViewer", "roles/container.clusterViewer", "roles/compute.viewer"]) : []
19+
for_each = var.is_organizational ? toset(["roles/cloudasset.viewer", "roles/logging.viewer", "roles/cloudfunctions.viewer", "roles/cloudbuild.builds.viewer", "roles/orgpolicy.policyViewer", "roles/recommender.viewer", "roles/iam.serviceAccountViewer", "roles/iam.organizationRoleViewer", "roles/container.clusterViewer", "roles/compute.viewer"]) : []
2020

2121
org_id = data.google_organization.org[0].org_id
2222
role = each.key

0 commit comments

Comments
 (0)