Skip to content

Commit 30d4786

Browse files
jose-pablo-camachojose-pablo-camacho
committed
feat(modular): address feedback for modular support for cdr/ciem, rebase and cleanup
1 parent c0ede5f commit 30d4786

File tree

7 files changed

+20
-26
lines changed

7 files changed

+20
-26
lines changed

‎modules/integrations/pub-sub/README.md‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ No modules.
6161
| [google_project_iam_member.identity_mgmt](https://registry.terraform.io/providers/hashicorp/google/3.22.0/docs/resources/google_project_iam#google_project_iam_member) | resource |
6262
| [google_service_account_iam_member.custom_auth](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_service_account_iam#google_service_account_iam_member) | resource |
6363
| [sysdig_secure_trusted_cloud_identity.trusted_identity](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_trusted_cloud_identity) | data source |
64-
| [sysdig_secure_cloud_auth_account_component.gcp_webhook_datasource](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/resources/secure_cloud_auth_account_component) | resource |
64+
| [sysdig_secure_cloud_auth_account_component.gcp_pubsub_datasource](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/resources/secure_cloud_auth_account_component) | resource |
6565
| [sysdig_secure_tenant_external_id](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_tenant_external_id) | data source |
6666
| [sysdig_secure_cloud_ingestion_assets](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_cloud_ingestion_assets) | data source |
6767
| [google_project.project](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/project) | data source |
@@ -85,7 +85,6 @@ No modules.
8585
| <a name="input_minimum_backoff"></a> [minimum\_backoff](#input\_minimum\_backoff) | (Optional) Minimum backoff time for exponential backoff of the push subscription retry policy | `string` | `"10s"` | no |
8686
| <a name="input_organization_domain"></a> [organization\_domain](#input\_organization\_domain) | Organization domain. e.g. sysdig.com | `string` | `""` | no |
8787
| <a name="input_project_id"></a> [project\_id](#input\_project\_id) | (Required) Target Project identifier provided by the customer | `string` | n/a | yes |
88-
| <a name="input_role_name"></a> [role\_name](#input\_role\_name) | (Optional) Role name for custom role binding to the service account, with read permissions for data ingestion resources | `string` | `"SysdigIngestionAuthRole"` | no |
8988
| <a name="input_suffix"></a> [suffix](#input\_suffix) | (Optional) Suffix to uniquely identify resources during multiple installs. If not provided, random value is autogenerated | `string` | `null` | no |
9089
| <a name="input_audit_log_config"></a> [audit\_log\_config](#input\_audit\_log\_config) | List of services and their audit log configurations to be ingested. Default is to ingest all logs. | <pre>list(object({<br> service = string,<br> log_config = list(object({<br> log_type = string,<br> exempted_members = optional(list(string))<br> }))<br> }))</pre> | <pre>[<br> {<br> "log_config": [<br> {<br> "log_type": "ADMIN_READ"<br> },<br> {<br> "log_type": "DATA_READ"<br> },<br> {<br> "log_type": "DATA_WRITE"<br> }<br> ],<br> "service": "allServices"<br> }<br>]</pre> | no |
9190
| <a name="ingestion_sink_filter"></a> [ingestion\_sink\_filter](#input\_ingestion\_sink\_filter) | Filter the Sink is set up with. Ingests AuditLogs by default. | `string` | `protoPayload.@type = "type.googleapis.com/google.cloud.audit.AuditLog"` | no |
@@ -94,9 +93,9 @@ No modules.
9493

9594
## Outputs
9695

97-
| Name | Description |
98-
|---------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------|
99-
| <a name="output_webhook_datasource_component_id"></a> [webhook\_datasource\_component\_id](#webhook\_datasource\_component\_id) | Component identifier of Webhook Datasource integration created in Sysdig Backend for Log Ingestion |
96+
| Name | Description |
97+
|------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------|
98+
| <a name="output_pubsub_datasource_component_id"></a> [pubsub\_datasource\_component\_id](#pubsub\_datasource\_component\_id) | Component identifier of Pub Sub integration created in Sysdig Backend for Log Ingestion |
10099

101100
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
102101

‎modules/integrations/pub-sub/main.tf‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,13 @@ data "sysdig_secure_cloud_ingestion_assets" "assets" {}
2929
#-----------------------------------------------------------------------------------------
3030
locals {
3131
suffix = var.suffix == null ? random_id.suffix[0].hex : var.suffix
32+
role_name = "SysdigIngestionAuthRole"
3233
}
3334

3435

3536
#-----------------------------------------------------------------------------------------------------------------------
36-
# A random resource is used to generate unique Webhook Datasource name suffix for resources.
37-
# This prevents conflicts when recreating an Webhook Datasource resources with the same name.
37+
# A random resource is used to generate unique Pub Sub name suffix for resources.
38+
# This prevents conflicts when recreating a Pub Sub resources with the same name.
3839
#-----------------------------------------------------------------------------------------------------------------------
3940
resource "random_id" "suffix" {
4041
count = var.suffix == null ? 1 : 0
@@ -201,7 +202,7 @@ resource "google_project_iam_custom_role" "custom_ingestion_auth_role" {
201202
count = var.is_organizational ? 0 : 1
202203

203204
project = var.project_id
204-
role_id = "${var.role_name}${local.suffix}"
205+
role_id = "${local.role_name}${local.suffix}"
205206
title = "Sysdigcloud Ingestion Auth Role"
206207
description = "A Role providing the required permissions for Sysdig Backend to read cloud resources created for data ingestion"
207208
permissions = [
@@ -246,7 +247,7 @@ resource "google_project_iam_member" "identity_mgmt" {
246247
# explicit dependency using depends_on
247248
#-----------------------------------------------------------------------------------------------------------------------------------------
248249

249-
resource "sysdig_secure_cloud_auth_account_component" "gcp_webhook_datasource" {
250+
resource "sysdig_secure_cloud_auth_account_component" "gcp_pubsub_datasource" {
250251
account_id = var.sysdig_secure_account_id
251252
type = "COMPONENT_WEBHOOK_DATASOURCE"
252253
instance = "secure-runtime"
@@ -258,7 +259,7 @@ resource "sysdig_secure_cloud_auth_account_component" "gcp_webhook_datasource" {
258259
sink_name = var.is_organizational ? google_logging_organization_sink.ingestion_sink[0].name : google_logging_project_sink.ingestion_sink[0].name
259260
push_subscription_name = google_pubsub_subscription.ingestion_topic_push_subscription.name
260261
push_endpoint = google_pubsub_subscription.ingestion_topic_push_subscription.push_config[0].push_endpoint
261-
routing_key = "1f6d4677-84ec-4356-bd73-c79c8a96f96a"
262+
routing_key = data.sysdig_secure_cloud_ingestion_assets.assets.gcp_routing_key
262263
}
263264
service_principal = {
264265
workload_identity_federation = {

‎modules/integrations/pub-sub/organizational.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,8 +63,8 @@ resource "google_organization_iam_custom_role" "custom_ingestion_auth_role" {
6363
count = var.is_organizational ? 1 : 0
6464

6565
org_id = data.google_organization.org[0].org_id
66-
role_id = "${var.role_name}Org${local.suffix}"
67-
title = "Sysdigcloud Ingestion Auth Role"
66+
role_id = "${local.role_name}Org${local.suffix}"
67+
title = "Sysdigcloud Ingestion Org Auth Role"
6868
description = "A Role providing the required permissions for Sysdig Backend to read cloud resources created for data ingestion"
6969
permissions = [
7070
"pubsub.topics.get",

‎modules/integrations/pub-sub/outputs.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
output "webhook_datasource_component_id" {
2-
value = "${sysdig_secure_cloud_auth_account_component.gcp_webhook_datasource.type}/${sysdig_secure_cloud_auth_account_component.gcp_webhook_datasource.instance}"
1+
output "pubsub_datasource_component_id" {
2+
value = "${sysdig_secure_cloud_auth_account_component.gcp_pubsub_datasource.type}/${sysdig_secure_cloud_auth_account_component.gcp_pubsub_datasource.instance}"
33
description = "Component identifier of Webhook Datasource integration created in Sysdig Backend for Log Ingestion"
4-
depends_on = [sysdig_secure_cloud_auth_account_component.gcp_webhook_datasource]
4+
depends_on = [sysdig_secure_cloud_auth_account_component.gcp_pubsub_datasource]
55
}

‎modules/integrations/pub-sub/variables.tf‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -53,12 +53,6 @@ variable "organization_domain" {
5353
default = ""
5454
}
5555

56-
variable "role_name" {
57-
type = string
58-
description = "Name for the Ingestion auth Role on the Customer infrastructure"
59-
default = "SysdigIngestionAuthRole"
60-
}
61-
6256
variable "suffix" {
6357
type = string
6458
description = "Suffix to uniquely identify resources during multiple installs. If not provided, random value is autogenerated"
@@ -105,5 +99,5 @@ variable "ingestion_sink_filter" {
10599

106100
variable "sysdig_secure_account_id" {
107101
type = string
108-
description = "ID of the Sysdig Cloud Account to enable to enable Webhook Datasource integration for (incase of organization, ID of the Sysdig management account)"
102+
description = "ID of the Sysdig Cloud Account to enable to enable Pub Sub integration for (incase of organization, ID of the Sysdig management account)"
109103
}

‎test/examples/modular_organization/pub-sub.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,14 @@ resource "sysdig_secure_cloud_auth_account_feature" "threat_detection" {
1515
account_id = module.onboarding.sysdig_secure_account_id
1616
type = "FEATURE_SECURE_THREAT_DETECTION"
1717
enabled = true
18-
components = [ module.pub-sub.webhook_datasource_component_id ]
18+
components = [ module.pub-sub.pubsub_datasource_component_id ]
1919
depends_on = [ module.pub-sub ]
2020
}
2121

2222
resource "sysdig_secure_cloud_auth_account_feature" "identity_entitlement" {
2323
account_id = module.onboarding.sysdig_secure_account_id
2424
type = "FEATURE_SECURE_IDENTITY_ENTITLEMENT"
2525
enabled = true
26-
components = [module.pub-sub.webhook_datasource_component_id]
26+
components = [module.pub-sub.pubsub_datasource_component_id]
2727
depends_on = [sysdig_secure_cloud_auth_account_feature.config_posture, module.pub-sub]
2828
}

‎test/examples/modular_single_project/pub-sub.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,14 @@ resource "sysdig_secure_cloud_auth_account_feature" "threat_detection" {
1313
account_id = module.onboarding.sysdig_secure_account_id
1414
type = "FEATURE_SECURE_THREAT_DETECTION"
1515
enabled = true
16-
components = [ module.pub-sub.webhook_datasource_component_id ]
16+
components = [ module.pub-sub.pubsub_datasource_component_id ]
1717
depends_on = [ module.pub-sub ]
1818
}
1919

2020
resource "sysdig_secure_cloud_auth_account_feature" "identity_entitlement" {
2121
account_id = module.onboarding.sysdig_secure_account_id
2222
type = "FEATURE_SECURE_IDENTITY_ENTITLEMENT"
2323
enabled = true
24-
components = [module.pub-sub.webhook_datasource_component_id]
24+
components = [module.pub-sub.pubsub_datasource_component_id]
2525
depends_on = [sysdig_secure_cloud_auth_account_feature.config_posture, module.pub-sub]
2626
}

0 commit comments

Comments
 (0)