SSPROD-56865 - add dynamic org support (#66)

jose-pablo-camacho · web-flow · commit 5e85d6a5c250 · 2025-05-13T15:31:03.000-06:00
diff --git a/modules/onboarding/README.md b/modules/onboarding/README.md
@@ -72,17 +72,18 @@ resource |
 
 ## Inputs
 
-| Name                                                                                          | Description                                                                                                                                                                                                    | Type          | Default | Required |
-|-----------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|---------|:--------:|
-| <a name="input_is_organizational"></a> [is\_organizational](#input\_is\_organizational)       | (Optional) Set this field to 'true' to deploy secure-for-cloud to a GCP Organization.                                                                                                                          | `bool`        | `false` |    no    |
-| <a name="input_organization_domain"></a> [organization\_domain](#input\_organization\_domain) | Organization domain. e.g. sysdig.com                                                                                                                                                                           | `string`      | `""`    |    no    |
-| <a name="input_project_id"></a> [project\_id](#input\_project\_id)                            | (Required) Target Project identifier provided by the customer                                                                                                                                                  | `string`      | n/a     |   yes    |
-| <a name="input_suffix"></a> [suffix](#input\_suffix)                                          | (Optional) Suffix to uniquely identify resources during multiple installs. If not provided, random value is autogenerated                                                                                      | `string`      | `null`  |    no    |
-| <a name="input_management_group_ids"></a> [suffix](#input\_management\_group\_ids)            | TO BE DEPRECATED on 30th November, 2025: Please work with Sysdig to migrate to using `include_folders` instead.<br>List of management group ids w.r.t an org install. If not provided, set to empty by default | `set(string)` | `[]`    |    no    |
-| <a name="input_include_folders"></a> [suffix](#input\_include\_folders)                       | folders to include for organization in the format 'folders/{folder_id}'. i.e: folders/123456789012                                                                                                             | `set(string)` | `[]`    |    no    |
-| <a name="input_exclude_folders"></a> [suffix](#input\_exclude\_folders)                       | folders to exclude for organization in the format 'folders/{folder_id}'. i.e: folders/123456789012                                                                                                             | `set(string)` | `[]`    |    no    |
-| <a name="input_include_projects"></a> [suffix](#input\_include\_projects)                     | projects to include for organization. i.e: my-project-id                                                                                                                                                       | `set(string)` | `[]`    |    no    |
-| <a name="input_exclude_projects"></a> [suffix](#input\_exclude\_projects)                     | projects to exclude for organization. i.e: my-project-id                                                                                                                                                       | `set(string)` | `[]`    |    no    |
+| Name                                                                                                                    | Description                                                                                                                                                                                                    | Type          | Default | Required |
+|-------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|---------|:--------:|
+| <a name="input_is_organizational"></a> [is\_organizational](#input\_is\_organizational)                                 | (Optional) Set this field to 'true' to deploy secure-for-cloud to a GCP Organization.                                                                                                                          | `bool`        | `false` |    no    |
+| <a name="input_organization_domain"></a> [organization\_domain](#input\_organization\_domain)                           | Organization domain. e.g. sysdig.com                                                                                                                                                                           | `string`      | `""`    |    no    |
+| <a name="input_project_id"></a> [project\_id](#input\_project\_id)                                                      | (Required) Target Project identifier provided by the customer                                                                                                                                                  | `string`      | n/a     |   yes    |
+| <a name="input_suffix"></a> [suffix](#input\_suffix)                                                                    | (Optional) Suffix to uniquely identify resources during multiple installs. If not provided, random value is autogenerated                                                                                      | `string`      | `null`  |    no    |
+| <a name="input_management_group_ids"></a> [suffix](#input\_management\_group\_ids)                                      | TO BE DEPRECATED on 30th November, 2025: Please work with Sysdig to migrate to using `include_folders` instead.<br>List of management group ids w.r.t an org install. If not provided, set to empty by default | `set(string)` | `[]`    |    no    |
+| <a name="input_include_folders"></a> [suffix](#input\_include\_folders)                                                 | folders to include for organization in the format 'folders/{folder_id}'. i.e: folders/123456789012                                                                                                             | `set(string)` | `[]`    |    no    |
+| <a name="input_exclude_folders"></a> [suffix](#input\_exclude\_folders)                                                 | folders to exclude for organization in the format 'folders/{folder_id}'. i.e: folders/123456789012                                                                                                             | `set(string)` | `[]`    |    no    |
+| <a name="input_include_projects"></a> [suffix](#input\_include\_projects)                                               | projects to include for organization. i.e: my-project-id                                                                                                                                                       | `set(string)` | `[]`    |    no    |
+| <a name="input_exclude_projects"></a> [suffix](#input\_exclude\_projects)                                               | projects to exclude for organization. i.e: my-project-id                                                                                                                                                       | `set(string)` | `[]`    |    no    |
+| <a name="input_enable_automatic_onboarding"></a> [enable\_automatic\_onboarding](#input\_enable\_automatic\_onboarding) | true/false whether whether Sysdig should automatically discover latest set of accounts in onboarded organization or not                                                                                        | `bool`        | `false` |    no    |
 
 ## Outputs
 
diff --git a/modules/onboarding/organizational.tf b/modules/onboarding/organizational.tf
@@ -36,8 +36,12 @@ resource "sysdig_secure_organization" "google_organization" {
   excluded_organizational_groups = local.check_old_management_group_ids_param ? [] : local.prefixed_exclude_folders
   included_cloud_accounts        = local.check_old_management_group_ids_param ? [] : var.include_projects
   excluded_cloud_accounts        = local.check_old_management_group_ids_param ? [] : var.exclude_projects
+  automatic_onboarding           = var.enable_automatic_onboarding
   depends_on = [
     google_organization_iam_member.browser,
     sysdig_secure_cloud_auth_account.google_account
   ]
+  lifecycle {
+    ignore_changes = [automatic_onboarding]
+  }
 }
diff --git a/modules/onboarding/variables.tf b/modules/onboarding/variables.tf
@@ -53,4 +53,10 @@ variable "exclude_projects" {
   description = "(Optional) projects id to exclude for organization i.e: my-project-id"
   type        = set(string)
   default     = []
-}
+}
+
+variable "enable_automatic_onboarding" {
+  type        = bool
+  default     = false
+  description = "true/false whether Sysdig should automatically discover latest set of accounts in onboarded organization or not"
+}
diff --git a/test/examples/modular_organization/onboarding_with_posture.tf b/test/examples/modular_organization/onboarding_with_posture.tf
@@ -31,6 +31,9 @@ module "onboarding" {
   exclude_folders = []
   include_projects = ["<project-id-1>", "<project-id-2>"]
   exclude_projects = ["<project-id-3>", "<project-id-4>"]
+
+  # optionally pass automatic onboarding for orgs (defaults to false)
+  enable_automatic_onboarding = false
 }
 
 module "config-posture" {

Original file line number	Diff line number	Diff line change
`@@ -36,8 +36,12 @@ resource "sysdig_secure_organization" "google_organization" {`
`36`	`36`	`excluded_organizational_groups = local.check_old_management_group_ids_param ? [] : local.prefixed_exclude_folders`
`37`	`37`	`included_cloud_accounts = local.check_old_management_group_ids_param ? [] : var.include_projects`
`38`	`38`	`excluded_cloud_accounts = local.check_old_management_group_ids_param ? [] : var.exclude_projects`
	`39`	`+ automatic_onboarding = var.enable_automatic_onboarding`
`39`	`40`	`depends_on = [`
`40`	`41`	`google_organization_iam_member.browser,`
`41`	`42`	`sysdig_secure_cloud_auth_account.google_account`
`42`	`43`	`]`
	`44`	`+ lifecycle {`
	`45`	`+ ignore_changes = [automatic_onboarding]`
	`46`	`+ }`
`43`	`47`	`}`
Original file line number	Diff line number	Diff line change
`@@ -31,6 +31,9 @@ module "onboarding" {`
`31`	`31`	`exclude_folders = []`
`32`	`32`	`include_projects = ["<project-id-1>", "<project-id-2>"]`
`33`	`33`	`exclude_projects = ["<project-id-3>", "<project-id-4>"]`
	`34`	`+`
	`35`	`+ # optionally pass automatic onboarding for orgs (defaults to false)`
	`36`	`+ enable_automatic_onboarding = false`
`34`	`37`	`}`
`35`	`38`
`36`	`39`	`module "config-posture" {`