Skip to content

Commit 1b1836a

Browse files
ravinadhruve10ravinadhruve10
committed
fix(vm-scanning): Fix conditionals for modular
1 parent 03359e9 commit 1b1836a

File tree

3 files changed

+15
-22
lines changed

3 files changed

+15
-22
lines changed

‎modules/agentless-scan/README.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,6 @@ No modules.
7676
| <a name="input_project_id"></a> [project\_id](#input\_project\_id) | GCP Project ID | `string` | n/a | yes |
7777
| <a name="input_is_organizational"></a> [is\_organizational](#input\_is\_organizational) | Optional. Determines whether module must scope whole organization. Otherwise single project will be scoped | `bool` | `false` | no |
7878
| <a name="input_organization_domain"></a> [organization\_domain](#input\_organization\_domain) | Optional. If `is_organizational=true` is set, its mandatory to specify this value, with the GCP Organization domain. e.g. sysdig.com | `string` | `null` | no |
79-
| <a name="input_sysdig_account_id"></a> [sysdig\_account\_id](#input\_sysdig\_account\_id) | Sysdig provided GCP Account designated for the host scan.<br/>One of `sysdig_backend` or `sysdig_account_id`must be provided | `string` | `null` | no |
8079
| <a name="input_sysdig_secure_account_id"></a> [sysdig\_secure\_account\_id](#input\_sysdig\_secure\_account\_id) | ID of the Sysdig Cloud Account to enable Agentless Scanning integration for (in case of organization, ID of the Sysdig management account) | `string` | `null` | no |
8180
| <a name="input_suffix"></a> [suffix](#input\_suffix) | Optional. Suffix word to enable multiple deployments with different naming<br/>(Workload Identity Pool and Providers have a soft deletion on Google Platform that will disallow name re-utilization)<br/>By default a random value will be autogenerated. | `string` | `null` | no |
8281

‎modules/agentless-scan/main.tf‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -56,12 +56,12 @@ resource "google_iam_workload_identity_pool" "agentless" {
5656
}
5757

5858
resource "google_iam_workload_identity_pool_provider" "agentless" {
59-
count = data.sysdig_secure_agentless_scanning_assets.assets.backend.cloud_id != null ? 1 : 0
59+
count = data.sysdig_secure_agentless_scanning_assets.assets.backend.cloud_type == "aws" ? 1 : 0
6060

6161
lifecycle {
6262
precondition {
63-
condition = (data.sysdig_secure_agentless_scanning_assets.assets.backend.cloud_id != null && var.sysdig_account_id == null)
64-
error_message = "Cannot provide both sysdig_backend or sysdig_account_id"
63+
condition = (data.sysdig_secure_agentless_scanning_assets.assets.backend.cloud_id != null)
64+
error_message = "Cannot provide empty sysdig backend cloud_id"
6565
}
6666
}
6767

@@ -86,12 +86,12 @@ resource "google_iam_workload_identity_pool_provider" "agentless" {
8686
}
8787

8888
resource "google_service_account_iam_member" "controller_custom" {
89-
count = data.sysdig_secure_agentless_scanning_assets.assets.backend.cloud_id != null ? 1 : 0
89+
count = data.sysdig_secure_agentless_scanning_assets.assets.backend.cloud_type == "aws" ? 1 : 0
9090

9191
lifecycle {
9292
precondition {
93-
condition = (data.sysdig_secure_agentless_scanning_assets.assets.backend.cloud_id != null && var.sysdig_account_id == null)
94-
error_message = "Cannot provide both sysdig_backend or sysdig_account_id"
93+
condition = (data.sysdig_secure_agentless_scanning_assets.assets.backend.cloud_id != null)
94+
error_message = "Cannot provide empty sysdig backend cloud_id"
9595
}
9696
}
9797

@@ -101,12 +101,12 @@ resource "google_service_account_iam_member" "controller_custom" {
101101
}
102102

103103
resource "google_iam_workload_identity_pool_provider" "agentless_gcp" {
104-
count = var.sysdig_account_id != null ? 1 : 0
104+
count = data.sysdig_secure_agentless_scanning_assets.assets.backend.cloud_type == "gcp" ? 1 : 0
105105

106106
lifecycle {
107107
precondition {
108-
condition = (data.sysdig_secure_agentless_scanning_assets.assets.backend.cloud_id == null && var.sysdig_account_id != null)
109-
error_message = "Cannot provide both sysdig_backend or sysdig_account_id"
108+
condition = (data.sysdig_secure_agentless_scanning_assets.assets.backend.cloud_id != null)
109+
error_message = "Cannot provide empty sysdig backend cloud_id"
110110
}
111111
}
112112

@@ -116,7 +116,7 @@ resource "google_iam_workload_identity_pool_provider" "agentless_gcp" {
116116
description = "GCP identity pool provider for Sysdig Secure Agentless Host Scanning"
117117
disabled = false
118118

119-
attribute_condition = "google.subject == \"${var.sysdig_account_id}\""
119+
attribute_condition = "google.subject == \"${data.sysdig_secure_agentless_scanning_assets.assets.backend.cloud_id}\""
120120

121121
attribute_mapping = {
122122
"google.subject" = "assertion.sub"
@@ -129,18 +129,18 @@ resource "google_iam_workload_identity_pool_provider" "agentless_gcp" {
129129
}
130130

131131
resource "google_service_account_iam_member" "controller_custom_gcp" {
132-
count = var.sysdig_account_id != null ? 1 : 0
132+
count = data.sysdig_secure_agentless_scanning_assets.assets.backend.cloud_type == "gcp" ? 1 : 0
133133

134134
lifecycle {
135135
precondition {
136-
condition = (data.sysdig_secure_agentless_scanning_assets.assets.backend.cloud_id == null && var.sysdig_account_id != null)
137-
error_message = "Cannot provide both sysdig_backend or sysdig_account_id"
136+
condition = (data.sysdig_secure_agentless_scanning_assets.assets.backend.cloud_id != null)
137+
error_message = "Cannot provide empty sysdig backend cloud_id"
138138
}
139139
}
140140

141141
service_account_id = google_service_account.controller.name
142142
role = "roles/iam.workloadIdentityUser"
143-
member = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.agentless.name}/attribute.sa_id/${var.sysdig_account_id}"
143+
member = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.agentless.name}/attribute.sa_id/${data.sysdig_secure_agentless_scanning_assets.assets.backend.cloud_id}"
144144
}
145145

146146
#-----------------------------------------------------------------------------------------
@@ -200,7 +200,7 @@ resource "sysdig_secure_cloud_auth_account_component" "gcp_agentless_scan" {
200200
service_principal_metadata = jsonencode({
201201
gcp = {
202202
workload_identity_federation = {
203-
pool_provider_id = data.sysdig_secure_agentless_scanning_assets.assets.gcp.worker_identity != null ? google_iam_workload_identity_pool_provider.agentless[0].name : var.sysdig_account_id != null ? google_iam_workload_identity_pool_provider.agentless_gcp[0].name : null
203+
pool_provider_id = data.sysdig_secure_agentless_scanning_assets.assets.backend.cloud_type == "aws" ? google_iam_workload_identity_pool_provider.agentless[0].name : data.sysdig_secure_agentless_scanning_assets.assets.backend.cloud_type == "gcp" ? google_iam_workload_identity_pool_provider.agentless_gcp[0].name : null
204204
}
205205
email = google_service_account.controller.email
206206
}

‎modules/agentless-scan/variables.tf‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,6 @@ variable "organization_domain" {
1515
default = ""
1616
}
1717

18-
variable "sysdig_account_id" {
19-
type = string
20-
description = "Sysdig provided GCP Account designated for the host scan. One of sysdig_backend or sysdig_account_id must be provided"
21-
default = null
22-
}
23-
2418
variable "sysdig_secure_account_id" {
2519
type = string
2620
description = "ID of the Sysdig Cloud Account to enable Agentless Scanning integration for (in case of organization, ID of the Sysdig management account)"

0 commit comments

Comments
 (0)