Skip to content

Commit 5581c6a

Browse files
haresh-sureshjose-pablo-camacho
haresh-suresh
authored and
jose-pablo-camacho
committed
updating README
1 parent 7a07625 commit 5581c6a

File tree

4 files changed

+100
-14
lines changed

4 files changed

+100
-14
lines changed

‎modules/config-posture/README.md‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
# GCP Config Posture Module
2+
3+
This module will deploy Config Posture resources in GCP for a single project, or for a GCP Organization.
4+
The Config Posture module serves the following functions:
5+
- retrieving inventory for single project, or for all projects within an Organization.
6+
- retrieving organization metadata in the case of organizational onboarding within GCP Organization.
7+
8+
If instrumenting a project, the following resources will be created:
9+
- All the necessary `Service Accounts` and `Policies` to enable the Config posture operation at the project level
10+
- A `Workload Identity Pool`, `Provider` and added custom role permissions to the `Service Account`, to allow Sysdig to authenticate to GCP on your behalf to validate resources.
11+
- A cloud account component in the Sysdig Backend, associated with the GCP project and with the required component to serve the config posture functions.
12+
13+
If instrumenting an Organziation, the following resources will be created:
14+
- All the necessary `Service Accounts` and `Policies` to enable the Config Posture operation at the organization level
15+
- A `Workload Identity Pool`, `Provider` and added custom role permissions to the `Service Account`, to allow Sysdig to authenticate to GCP on your behalf to validate resources.
16+
- A cloud account component in the Sysdig Backend, associated with the GCP project and with the required component to serve the config posture functions.
17+
18+
Note:
19+
- The outputs from the foundational module, such as `sysdig_secure_project_id` are needed as inputs to the other features/integrations modules for subsequent modular installs.
20+
21+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
22+
## Requirements
23+
24+
| Name | Version |
25+
|------|---------|
26+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
27+
| <a name="requirement_google"></a> [google](#requirement\_google) | >= 4.21.0 |
28+
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | >= 1.23.1 |
29+
30+
## Providers
31+
32+
| Name | Version |
33+
|------|---------|
34+
| <a name="provider_google"></a> [google](#provider\_google) | 5.0.0 |
35+
| <a name="provider_random"></a> [random](#provider\_random) | >= 3.1 |
36+
37+
## Modules
38+
39+
No modules.
40+
41+
## Resources
42+
43+
| [google_service_account.posture_auth](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account) | resource |
44+
| [google_service_account_iam_binding.posture_auth_binding](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account_iam_binding) | resource |
45+
| [google_organization.org](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/organization) | data source |
46+
| [sysdig_secure_trusted_cloud_identity.trusted_identity](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_trusted_cloud_identity) | data source |
47+
| [google_project.project](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/project) | data source |
48+
| [random_id.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
49+
| [google_iam_workload_identity_pool.posture_auth_pool](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/iam_workload_identity_pool) | resource |
50+
| [google_iam_workload_identity_pool_provider.posture_auth_pool_provider](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/iam_workload_identity_pool_provider) | resource |
51+
| [google_project_iam_custom_role.custom_posture_auth_role](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam_custom_role) | resource |
52+
| [google_project_iam_member.custom](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam#google_project_iam_member) | resource |
53+
| [google_service_account_iam_member.custom_auth](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_service_account_iam#google_service_account_iam_member) | resource |
54+
| [google_organization_iam_custom_role.custom_posture_auth_role](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_organization_iam_custom_role) | resource |
55+
| [google_organization_iam_member.custom](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_organization_iam#google_organization_iam_member) | resource |
56+
57+
## Inputs
58+
59+
| Name | Description | Type | Default | Required |
60+
|------|---------------------------------------------------------------------------------------------------------------------------|------|-----------------------------------------------|:--------:|
61+
| <a name="input_is_organizational"></a> [is\_organizational](#input\_is\_organizational) | (Optional) Set this field to 'true' to deploy secure-for-cloud to a GCP Organization. | `bool` | `false` | no |
62+
| <a name="input_labels"></a> [labels](#input\_labels) | (Optional) Labels to be associated with Sysdig-originated resources | `map(string)` | <pre>{<br> "originator": "sysdig"<br>}</pre> | no |
63+
| <a name="input_organization_domain"></a> [organization\_domain](#input\_organization\_domain) | Organization domain. e.g. sysdig.com | `string` | `""` | no |
64+
| <a name="input_project_id"></a> [project\_id](#input\_project\_id) | (Required) Target Project identifier provided by the customer | `string` | n/a | yes |
65+
| <a name="input_role_name"></a> [role\_name](#input\_role\_name) | (Optional) Role name for custom role binding to the service account, with read permissions for posture resources | `string` | `"SysdigPostureAuthRole-{random_id}"` | no |
66+
| <a name="input_external_id"></a> [external\_id](#input\_external\_id) | (Required) Random string generated unique to a customer | `string` | n/a | yes |
67+
| <a name="input_suffix"></a> [suffix](#input\_suffix) | (Optional) Suffix to uniquely identify resources during multiple installs. If not provided, random value is autogenerated | `string` | `null` | no |
68+
69+
## Outputs
70+
71+
| Name | Description |
72+
|------|----------------------------------------------------------------------------------------------------|
73+
| <a name="output_workload_identity_pool_id"></a> [workload\_identity\_pool\_id](#output\_workload\_identity\_pool\_id) | Id of Workload Identity Pool for authenticating to GCP to access config posture resources |
74+
| <a name="output_workload_identity_pool_provider_id"></a> [workload\_identity\_pool\_provider\_id](#output\_workload\_identity\_pool\_provider\_id) | Id of Workload Identity Pool Provider for authenticating to GCP to access config posture resources |
75+
| <a name="output_workload_identity_project_number"></a> [workload\_identity\_project\_number](#output\_workload\_identity\_project\_number) | GCP project number |
76+
| <a name="output_service_account_email"></a> [service\_account\_email](#output\_service\_account\_email) | email of the Service Account created |
77+
| <a name="output_sysdig_secure_project_id"></a> [sysdig\_secure\_project\_id](#output\_sysdig\_secure\_project\_id) | ID of the Sysdig Cloud Account created |
78+
| <a name="output_is_organizational"></a> [is\_organizational](#output\_is\_organizational) | Boolean value to indicate if secure-for-cloud is deployed to an entire GCP organization or not |
79+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
80+
81+
## Authors
82+
83+
Module is maintained by [Sysdig](https://sysdig.com).
84+
85+
## License
86+
87+
Apache 2 Licensed. See LICENSE for full details.

‎modules/config-posture/main.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ locals {
2121
}
2222

2323
resource "google_service_account" "posture_auth" {
24-
account_id = "sysdig-posture-${local.suffix}"
24+
account_id = "sysdig-secure-posture-${local.suffix}"
2525
display_name = "Sysdig Config Posture Auth Service Account"
2626
project = var.project_id
2727
}
@@ -42,13 +42,13 @@ resource "google_service_account_iam_binding" "posture_auth_binding" {
4242

4343
resource "google_iam_workload_identity_pool" "posture_auth_pool" {
4444
project = var.project_id
45-
workload_identity_pool_id = "sysdig-posture-${local.suffix}"
45+
workload_identity_pool_id = "sysdig-secure-posture-${local.suffix}"
4646
}
4747

4848
resource "google_iam_workload_identity_pool_provider" "posture_auth_pool_provider" {
4949
project = var.project_id
5050
workload_identity_pool_id = google_iam_workload_identity_pool.posture_auth_pool.workload_identity_pool_id
51-
workload_identity_pool_provider_id = "sysdig-posture-${local.suffix}"
51+
workload_identity_pool_provider_id = "sysdig-secure-posture-${local.suffix}"
5252
display_name = "Sysdigcloud config posture auth"
5353
description = "AWS identity pool provider for Sysdig Secure Data Config Posture resources"
5454
disabled = false

‎modules/onboarding/README.md‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -63,19 +63,18 @@ No modules.
6363
| <a name="input_labels"></a> [labels](#input\_labels) | (Optional) Labels to be associated with Sysdig-originated resources | `map(string)` | <pre>{<br> "originator": "sysdig"<br>}</pre> | no |
6464
| <a name="input_organization_domain"></a> [organization\_domain](#input\_organization\_domain) | Organization domain. e.g. sysdig.com | `string` | `""` | no |
6565
| <a name="input_project_id"></a> [project\_id](#input\_project\_id) | (Required) Target Project identifier provided by the customer | `string` | n/a | yes |
66-
| <a name="input_role_name"></a> [role\_name](#input\_role\_name) | (Optional) Role name for custom role binding to the service account, with read permissions for data onboarding resources | `string` | `"SysdigOnboardingAuthRole-{random_id}"` | no |
6766
| <a name="input_external_id"></a> [external\_id](#input\_external\_id) | (Required) Random string generated unique to a customer | `string` | n/a | yes |
6867
| <a name="input_suffix"></a> [suffix](#input\_suffix) | (Optional) Suffix to uniquely identify resources during multiple installs. If not provided, random value is autogenerated | `string` | `null` | no |
6968

7069
## Outputs
7170

72-
| Name | Description |
73-
|------|-------------|
74-
| <a name="output_workload_identity_pool_id"></a> [workload\_identity\_pool\_id](#output\_workload\_identity\_pool\_id) | Id of Workload Identity Pool for authenticating to GCP to access data ingestion resources |
75-
| <a name="output_workload_identity_pool_provider_id"></a> [workload\_identity\_pool\_provider\_id](#output\_workload\_identity\_pool\_provider\_id) | Id of Workload Identity Pool Provider for authenticating to GCP to access data ingestion resources |
76-
| <a name="output_workload_identity_project_number"></a> [workload\_identity\_project\_number](#output\_workload\_identity\_project\_number) | GCP project number |
77-
| <a name="output_service_account_email"></a> [service\_account\_email](#output\_service\_account\_email) | email of the Service Account created |
78-
| <a name="output_sysdig_secure_project_id"></a> [sysdig\_secure\_project\_id](#output\_sysdig\_secure\_project\_id) | ID of the Sysdig Cloud Account created |
71+
| Name | Description |
72+
|------|------------------------------------------------------------------------------------------------|
73+
| <a name="output_workload_identity_pool_id"></a> [workload\_identity\_pool\_id](#output\_workload\_identity\_pool\_id) | Id of Workload Identity Pool for authenticating to GCP to access onboarding resources |
74+
| <a name="output_workload_identity_pool_provider_id"></a> [workload\_identity\_pool\_provider\_id](#output\_workload\_identity\_pool\_provider\_id) | Id of Workload Identity Pool Provider for authenticating to GCP to access onboarding resources |
75+
| <a name="output_workload_identity_project_number"></a> [workload\_identity\_project\_number](#output\_workload\_identity\_project\_number) | GCP project number |
76+
| <a name="output_service_account_email"></a> [service\_account\_email](#output\_service\_account\_email) | email of the Service Account created |
77+
| <a name="output_sysdig_secure_project_id"></a> [sysdig\_secure\_project\_id](#output\_sysdig\_secure\_project\_id) | ID of the Sysdig Cloud Account created |
7978
| <a name="output_is_organizational"></a> [is\_organizational](#output\_is\_organizational) | Boolean value to indicate if secure-for-cloud is deployed to an entire GCP organization or not |
8079
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
8180

‎modules/onboarding/main.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ locals {
2121
}
2222

2323
resource "google_service_account" "onboarding_auth" {
24-
account_id = "sysdig-onboarding-${local.suffix}"
24+
account_id = "sysdig-secure-onboarding-${local.suffix}"
2525
display_name = "Sysdig Onboarding Auth Service Account"
2626
project = var.project_id
2727
}
@@ -42,13 +42,13 @@ resource "google_service_account_iam_binding" "onboarding_auth_binding" {
4242

4343
resource "google_iam_workload_identity_pool" "onboarding_auth_pool" {
4444
project = var.project_id
45-
workload_identity_pool_id = "sysdig-onboarding-${local.suffix}"
45+
workload_identity_pool_id = "sysdig-secure-onboarding-${local.suffix}"
4646
}
4747

4848
resource "google_iam_workload_identity_pool_provider" "onboarding_auth_pool_provider" {
4949
project = var.project_id
5050
workload_identity_pool_id = google_iam_workload_identity_pool.onboarding_auth_pool.workload_identity_pool_id
51-
workload_identity_pool_provider_id = "sysdig-onboarding-${local.suffix}"
51+
workload_identity_pool_provider_id = "sysdig-secure-onboarding-${local.suffix}"
5252
display_name = "Sysdigcloud onboarding auth"
5353
description = "AWS identity pool provider for Sysdig Secure Data Onboarding resources"
5454
disabled = false

0 commit comments

Comments
 (0)