Skip to content

Commit 1a26d8f

Browse files
Merge branch 'master' into feat/modular/cdr-ciem
2 parents 634ce2a + 15672c7 commit 1a26d8f

File tree

6 files changed

+60
-118
lines changed

6 files changed

+60
-118
lines changed

modules/config-posture/README.md

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -16,16 +16,16 @@ If instrumenting an Organziation, the following resources will be created:
1616
- A cloud account component in the Sysdig Backend, associated with the GCP project and with the required component to serve the config posture functions.
1717

1818
Note:
19-
- The outputs from the foundational module, such as `sysdig_secure_project_id` are needed as inputs to the other features/integrations modules for subsequent modular installs.
19+
- The outputs from the foundational module, such as `sysdig_secure_account_id` are needed as inputs to the other features/integrations modules for subsequent modular installs.
2020

2121
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
2222
## Requirements
2323

24-
| Name | Version |
25-
|------|---------|
26-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
24+
| Name | Version |
25+
|------|-----------|
26+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
2727
| <a name="requirement_google"></a> [google](#requirement\_google) | >= 4.21.0 |
28-
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | >= 1.23.1 |
28+
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | >= 1.34.0 |
2929

3030
## Providers
3131

@@ -41,18 +41,17 @@ No modules.
4141
## Resources
4242

4343
| [google_service_account.posture_auth](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account) | resource |
44-
| [google_service_account_iam_binding.posture_auth_binding](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account_iam_binding) | resource |
4544
| [google_organization.org](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/organization) | data source |
4645
| [sysdig_secure_trusted_cloud_identity.trusted_identity](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_trusted_cloud_identity) | data source |
4746
| [google_project.project](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/project) | data source |
47+
| [sysdig_secure_tenant_external_id](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_tenant_external_id) | data source |
4848
| [random_id.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
4949
| [google_iam_workload_identity_pool.posture_auth_pool](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/iam_workload_identity_pool) | resource |
5050
| [google_iam_workload_identity_pool_provider.posture_auth_pool_provider](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/iam_workload_identity_pool_provider) | resource |
51-
| [google_project_iam_custom_role.custom_posture_auth_role](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam_custom_role) | resource |
52-
| [google_project_iam_member.custom](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam#google_project_iam_member) | resource |
53-
| [google_service_account_iam_member.custom_auth](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_service_account_iam#google_service_account_iam_member) | resource |
54-
| [google_organization_iam_custom_role.custom_posture_auth_role](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_organization_iam_custom_role) | resource |
55-
| [google_organization_iam_member.custom](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_organization_iam#google_organization_iam_member) | resource |
51+
| [google_project_iam_member.cspm](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam#google_project_iam_member) | resource |
52+
| [google_service_account_iam_member.custom_posture_auth](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_service_account_iam#google_service_account_iam_member) | resource |
53+
| [google_organization_iam_member.cspm](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_organization_iam#google_organization_iam_member) | resource |
54+
| [sysdig_secure_cloud_auth_account_component.google_service_principal](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/resources/secure_cloud_auth_account_component) | resource |
5655

5756
## Inputs
5857

@@ -63,7 +62,6 @@ No modules.
6362
| <a name="input_project_id"></a> [project\_id](#input\_project\_id) | (Required) Target Project identifier provided by the customer | `string` | n/a | yes |
6463
| <a name="input_suffix"></a> [suffix](#input\_suffix) | (Optional) Suffix to uniquely identify resources during multiple installs. If not provided, random value is autogenerated | `string` | `null` | no |
6564
| <a name="input_sysdig_secure_account_id"></a> [sysdig\_secure\_account\_id](#input\_sysdig\_secure\_account\_id) | (Required) The GUID of the management project or single project per sysdig representation | `string` | n/a | yes |
66-
| <a name="input_management_group_ids"></a> [management\_group\_ids](#input\_management\_group\_ids) | (Optional) Management group ids to onboard sub ogs or folders like 'organizations/sysdig.com' or 'folders/test-1' | `string` | n/a | no |
6765

6866
## Outputs
6967

modules/config-posture/main.tf

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -29,15 +29,6 @@ resource "google_service_account" "posture_auth" {
2929
project = var.project_id
3030
}
3131

32-
resource "google_service_account_iam_binding" "posture_auth_binding" {
33-
service_account_id = google_service_account.posture_auth.name
34-
role = "roles/iam.workloadIdentityUser"
35-
36-
members = [
37-
"serviceAccount:${google_service_account.posture_auth.email}",
38-
]
39-
}
40-
4132
#------------------------------------------------------------#
4233
# Configure Workload Identity Federation for auth #
4334
# See https://cloud.google.com/iam/docs/access-resources-aws #
@@ -53,7 +44,7 @@ resource "google_iam_workload_identity_pool_provider" "posture_auth_pool_provide
5344
workload_identity_pool_id = google_iam_workload_identity_pool.posture_auth_pool.workload_identity_pool_id
5445
workload_identity_pool_provider_id = "sysdig-posture-${local.suffix}"
5546
display_name = "Sysdigcloud config posture auth"
56-
description = "AWS identity pool provider for Sysdig Secure Data Config Posture resources"
47+
description = "AWS based pool provider for Sysdig Secure Data Config Posture resources"
5748
disabled = false
5849

5950
attribute_condition = "attribute.aws_role==\"arn:aws:sts::${data.sysdig_secure_trusted_cloud_identity.trusted_identity.aws_account_id}:assumed-role/${data.sysdig_secure_trusted_cloud_identity.trusted_identity.aws_role_name}/${data.sysdig_secure_tenant_external_id.external_id.external_id}\""
@@ -104,5 +95,11 @@ resource "sysdig_secure_cloud_auth_account_component" "google_service_principal"
10495
email = google_service_account.posture_auth.email
10596
}
10697
})
107-
depends_on = [google_service_account_iam_member.custom_posture_auth]
98+
depends_on = [
99+
google_service_account.posture_auth,
100+
google_iam_workload_identity_pool.posture_auth_pool,
101+
google_iam_workload_identity_pool_provider.posture_auth_pool_provider,
102+
google_project_iam_member.cspm,
103+
google_service_account_iam_member.custom_posture_auth
104+
]
108105
}

modules/onboarding/README.md

Lines changed: 22 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -7,26 +7,26 @@ The Foundational Onboarding module serves the following functions:
77

88
If instrumenting a project, the following resources will be created:
99
- All the necessary `Service Accounts` and `Policies` to enable the Onboarding operation at the project level
10-
- A `Workload Identity Pool`, `Provider` and added custom role permissions to the `Service Account`, to allow Sysdig to authenticate to GCP on your behalf to validate resources.
10+
- A `Service Account key` and added role permissions to the `Service Account`, to allow Sysdig to authenticate to GCP on your behalf to validate resources.
1111
- A cloud account in the Sysdig Backend, associated with the GCP project and with the required component to serve the foundational functions.
1212

1313
If instrumenting an Organziation, the following resources will be created:
1414
- All the necessary `Service Accounts` and `Policies` to enable the Onboarding operation at the organization level
15-
- A `Workload Identity Pool`, `Provider` and added custom role permissions to the `Service Account`, to allow Sysdig to authenticate to GCP on your behalf to validate resources.
15+
- A `Service Account key` and added role permissions to the `Service Account`, to allow Sysdig to authenticate to GCP on your behalf to validate resources.
1616
- A cloud account in the Sysdig Backend, associated with the management project and with the required component to serve the foundational functions.
1717
- A cloud organization in the Sysdig Backend, associated with the GCP Organization to fetch the organization structure to install Sysdig Secure for Cloud on.
1818

1919
Note:
20-
- The outputs from the foundational module, such as `sysdig_secure_project_id` are needed as inputs to the other features/integrations modules for subsequent modular installs.
20+
- The outputs from the foundational module, such as `sysdig_secure_account_id` are needed as inputs to the other features/integrations modules for subsequent modular installs.
2121

2222
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
2323
## Requirements
2424

25-
| Name | Version |
26-
|------|---------|
27-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
25+
| Name | Version |
26+
|------|-----------|
27+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
2828
| <a name="requirement_google"></a> [google](#requirement\_google) | >= 4.21.0 |
29-
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | >= 1.23.1 |
29+
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | >= 1.34.0 |
3030

3131
## Providers
3232

@@ -42,33 +42,32 @@ No modules.
4242
## Resources
4343

4444
| [google_service_account.onboarding_auth](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account) | resource |
45-
| [google_service_account_iam_binding.onboarding_auth_binding](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account_iam_binding) | resource |
4645
| [google_organization.org](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/organization) | data source |
47-
| [sysdig_secure_trusted_cloud_identity.trusted_identity](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_trusted_cloud_identity) | data source |
4846
| [google_project.project](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/project) | data source |
4947
| [random_id.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
50-
| [google_iam_workload_identity_pool.onboarding_auth_pool](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/iam_workload_identity_pool) | resource |
51-
| [google_iam_workload_identity_pool_provider.onboarding_auth_pool_provider](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/iam_workload_identity_pool_provider) | resource |
52-
| [google_project_iam_custom_role.custom_onboarding_auth_role](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam_custom_role) | resource |
53-
| [google_project_iam_member.custom](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam#google_project_iam_member) | resource |
54-
| [google_service_account_iam_member.custom_auth](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_service_account_iam#google_service_account_iam_member) | resource |
55-
| [google_organization_iam_custom_role.custom_onboarding_auth_role](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_organization_iam_custom_role) | resource |
56-
| [google_organization_iam_member.custom](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_organization_iam#google_organization_iam_member) | resource |
48+
| [google_project_iam_member.browser](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam#google_project_iam_member) | resource |
49+
| [google_organization_iam_member.browser](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_organization_iam#google_organization_iam_member) | resource |
50+
| [google_service_account_key.onboarding_service_account_key](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account_key) | resource |
51+
| [sysdig_secure_cloud_auth_account.google_account](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/resources/secure_cloud_auth_account) | resource |
52+
| [sysdig_secure_organization.google_organization](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/resources/secure_organization) | resource |
5753

5854
## Inputs
5955

60-
| Name | Description | Type | Default | Required |
61-
|------|-------------|------|---------|:--------:|
62-
| <a name="input_is_organizational"></a> [is\_organizational](#input\_is\_organizational) | (Optional) Set this field to 'true' to deploy secure-for-cloud to a GCP Organization. | `bool` | `false` | no |
63-
| <a name="input_organization_domain"></a> [organization\_domain](#input\_organization\_domain) | Organization domain. e.g. sysdig.com | `string` | `""` | no |
64-
| <a name="input_project_id"></a> [project\_id](#input\_project\_id) | (Required) Target Project identifier provided by the customer | `string` | n/a | yes |
65-
| <a name="input_suffix"></a> [suffix](#input\_suffix) | (Optional) Suffix to uniquely identify resources during multiple installs. If not provided, random value is autogenerated | `string` | `null` | no |
56+
| Name | Description | Type | Default | Required |
57+
|-----------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|------|---------|:--------:|
58+
| <a name="input_is_organizational"></a> [is\_organizational](#input\_is\_organizational) | (Optional) Set this field to 'true' to deploy secure-for-cloud to a GCP Organization. | `bool` | `false` | no |
59+
| <a name="input_organization_domain"></a> [organization\_domain](#input\_organization\_domain) | Organization domain. e.g. sysdig.com | `string` | `""` | no |
60+
| <a name="input_project_id"></a> [project\_id](#input\_project\_id) | (Required) Target Project identifier provided by the customer | `string` | n/a | yes |
61+
| <a name="input_suffix"></a> [suffix](#input\_suffix) | (Optional) Suffix to uniquely identify resources during multiple installs. If not provided, random value is autogenerated | `string` | `null` | no |
62+
| <a name="input_management_group_ids"></a> [suffix](#input\_management\_group\_ids) | (Optional) List of management group ids w.r.t an org install. If not provided, set to empty by default | `string` | `null` | no |
63+
64+
6665

6766
## Outputs
6867

6968
| Name | Description |
7069
|--------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------|
71-
| <a name="output_sysdig_secure_account_id"></a> [sysdig\_secure\_project\_id](#output\_sysdig\_secure\_account\_id) | ID of the Sysdig Cloud Account created |
70+
| <a name="output_sysdig_secure_account_id"></a> [sysdig\_secure\_account\_id](#output\_sysdig\_secure\_account\_id) | ID of the Sysdig Cloud Account created |
7271
| <a name="output_is_organizational"></a> [is\_organizational](#output\_is\_organizational) | Boolean value to indicate if secure-for-cloud is deployed to an entire GCP organization or not |
7372
| <a name="output_organization_domain"></a> [organization\_domain](#output\_organization\_domain) | Organization domain of the GCP org being onboarded |
7473
| <a name="output_project_id"></a> [project\_id](#output\_project\_id) | The management project id chosen during install, where global resources are deployed |

0 commit comments

Comments
 (0)