Skip to content

Commit 7a07625

Browse files
haresh-sureshjose-pablo-camacho
haresh-suresh
authored and
jose-pablo-camacho
committed
adding config posture module for modular onboarding
1 parent 6795442 commit 7a07625

File tree

8 files changed

+194
-9
lines changed

8 files changed

+194
-9
lines changed

‎modules/config-posture/README.md‎

Whitespace-only changes.

‎modules/config-posture/main.tf‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
#------------------------------------------------------------------#
2+
# Fetch and compute required data for Workload Identity Federation #
3+
#------------------------------------------------------------------#
4+
5+
data "sysdig_secure_trusted_cloud_identity" "trusted_identity" {
6+
cloud_provider = "gcp"
7+
}
8+
9+
data "google_project" "project" {
10+
project_id = var.project_id
11+
}
12+
13+
// suffix to uniquely identify WIF pool and provider during multiple installs. If suffix value is not provided, this will generate a random value.
14+
resource "random_id" "suffix" {
15+
count = var.suffix == null ? 1 : 0
16+
byte_length = 3
17+
}
18+
19+
locals {
20+
suffix = var.suffix == null ? random_id.suffix[0].hex : var.suffix
21+
}
22+
23+
resource "google_service_account" "posture_auth" {
24+
account_id = "sysdig-posture-${local.suffix}"
25+
display_name = "Sysdig Config Posture Auth Service Account"
26+
project = var.project_id
27+
}
28+
29+
resource "google_service_account_iam_binding" "posture_auth_binding" {
30+
service_account_id = google_service_account.posture_auth.name
31+
role = "roles/iam.workloadIdentityUser"
32+
33+
members = [
34+
"serviceAccount:${google_service_account.posture_auth.email}",
35+
]
36+
}
37+
38+
#------------------------------------------------------------#
39+
# Configure Workload Identity Federation for auth #
40+
# See https://cloud.google.com/iam/docs/access-resources-aws #
41+
#------------------------------------------------------------#
42+
43+
resource "google_iam_workload_identity_pool" "posture_auth_pool" {
44+
project = var.project_id
45+
workload_identity_pool_id = "sysdig-posture-${local.suffix}"
46+
}
47+
48+
resource "google_iam_workload_identity_pool_provider" "posture_auth_pool_provider" {
49+
project = var.project_id
50+
workload_identity_pool_id = google_iam_workload_identity_pool.posture_auth_pool.workload_identity_pool_id
51+
workload_identity_pool_provider_id = "sysdig-posture-${local.suffix}"
52+
display_name = "Sysdigcloud config posture auth"
53+
description = "AWS identity pool provider for Sysdig Secure Data Config Posture resources"
54+
disabled = false
55+
56+
attribute_condition = "attribute.aws_role==\"arn:aws:sts::${data.sysdig_secure_trusted_cloud_identity.trusted_identity.aws_account_id}:assumed-role/${data.sysdig_secure_trusted_cloud_identity.trusted_identity.aws_role_name}/${var.external_id}\""
57+
58+
attribute_mapping = {
59+
"google.subject" = "assertion.arn",
60+
"attribute.aws_role" = "assertion.arn"
61+
}
62+
63+
aws {
64+
account_id = data.sysdig_secure_trusted_cloud_identity.trusted_identity.aws_account_id
65+
}
66+
}
67+
68+
#---------------------------------------------------------------------------------------------
69+
# role permissions for CSPM (GCP Predefined Roles for Sysdig Cloud Secure Posture Management)
70+
#---------------------------------------------------------------------------------------------
71+
resource "google_project_iam_member" "cspm" {
72+
for_each = var.is_organizational ? [] : toset(["roles/cloudasset.viewer", "roles/iam.workloadIdentityUser", "roles/logging.viewer", "roles/cloudfunctions.viewer", "roles/cloudbuild.builds.viewer", "roles/orgpolicy.policyViewer"])
73+
74+
project = var.project_id
75+
role = each.key
76+
member = "serviceAccount:${google_service_account.posture_auth.email}"
77+
}
78+
79+
# attaching WIF as a member to the service account for auth
80+
resource "google_service_account_iam_member" "custom_auth" {
81+
service_account_id = google_service_account.posture_auth.name
82+
role = "roles/iam.workloadIdentityUser"
83+
member = "principalSet://iam.googleapis.com/projects/${data.google_project.project.number}/locations/global/workloadIdentityPools/${google_iam_workload_identity_pool.posture_auth_pool.workload_identity_pool_id}/attribute.aws_role/arn:aws:sts::${data.sysdig_secure_trusted_cloud_identity.trusted_identity.aws_account_id}:assumed-role/${data.sysdig_secure_trusted_cloud_identity.trusted_identity.aws_role_name}/${var.external_id}"
84+
}
85+
86+
#--------------------------------------------------------------------------------------------------------------
87+
# Call Sysdig Backend to add the service-principal integration for Config Posture to the Sysdig Cloud Account
88+
#
89+
# Note (optional): To ensure this gets called after all cloud resources are created, add
90+
# explicit dependency using depends_on
91+
#--------------------------------------------------------------------------------------------------------------
92+
resource "sysdig_secure_cloud_auth_account_component" "google_service_principal" {
93+
account_id = var.sysdig_secure_account_id
94+
type = "COMPONENT_SERVICE_PRINCIPAL"
95+
instance = "secure-posture"
96+
verion = "v0.1.0"
97+
service_principal_metadata = jsonencode({
98+
gcp = {
99+
service_principal = {
100+
workload_identity_federation = {
101+
pool_id = google_iam_workload_identity_pool.posture_auth_pool.workload_identity_pool_id
102+
pool_provider_id = google_iam_workload_identity_pool_provider.posture_auth_pool_provider.workload_identity_pool_provider_id
103+
project_number = data.google_project.project.number
104+
}
105+
email = google_service_account.posture_auth.email
106+
}
107+
}
108+
})
109+
}

‎modules/config-posture/organizational.tf‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#--------------#
2+
# Organization #
3+
#--------------#
4+
5+
data "google_organization" "org" {
6+
count = var.is_organizational ? 1 : 0
7+
domain = var.organization_domain
8+
}
9+
10+
###################################################
11+
# Setup Service Account permissions
12+
###################################################
13+
14+
#---------------------------------------------------------------------------------------------
15+
# role permissions for CSPM (GCP Predefined Roles for Sysdig Cloud Secure Posture Management)
16+
#---------------------------------------------------------------------------------------------
17+
resource "google_organization_iam_member" "cspm" {
18+
for_each = var.is_organizational ? toset(["roles/cloudasset.viewer", "roles/iam.workloadIdentityUser", "roles/logging.viewer", "roles/cloudfunctions.viewer", "roles/cloudbuild.builds.viewer", "roles/orgpolicy.policyViewer"]) : []
19+
20+
org_id = data.google_organization.org[0].org_id
21+
role = each.key
22+
member = "serviceAccount:${google_service_account.posture_auth.email}"
23+
}

‎modules/config-posture/outputs.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
output "service_principal_component_id" {
2+
value = "${sysdig_secure_cloud_auth_account_component.google_service_principal.type}/${sysdig_secure_cloud_auth_account_component.google_service_principal.instance}"
3+
description = "Component identifier of Service Principal created in Sysdig Backend for Config Posture"
4+
depends_on = [sysdig_secure_cloud_auth_account_component.google_service_principal]
5+
}

‎modules/config-posture/variables.tf‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
variable "project_id" {
2+
type = string
3+
description = "(Required) Target Project identifier provided by the customer"
4+
}
5+
6+
variable "is_organizational" {
7+
description = "(Optional) Set this field to 'true' to deploy secure-for-cloud to a GCP Organization."
8+
type = bool
9+
default = false
10+
}
11+
12+
variable "organization_domain" {
13+
type = string
14+
description = "(Optional) Organization domain. e.g. sysdig.com"
15+
default = ""
16+
}
17+
18+
variable "management_group_ids" {
19+
type = set(string)
20+
description = "(Optional) Management group id to onboard. e.g. [organizations/123456789012], [folders/123456789012]"
21+
default = []
22+
}
23+
24+
variable "external_id" {
25+
type = string
26+
description = "(Required) Random string generated unique to a customer"
27+
}
28+
29+
variable "suffix" {
30+
type = string
31+
description = "Suffix to uniquely identify resources during multiple installs. If not provided, random value is autogenerated"
32+
default = null
33+
}
34+
35+
variable "sysdig_secure_account_id" {
36+
type = string
37+
description = "ID of the Sysdig Cloud Account to enable Config Posture for (in case of organization, ID of the Sysdig management account)"
38+
}

‎modules/config-posture/versions.tf‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
terraform {
2+
required_version = ">= 1.0.0"
3+
4+
required_providers {
5+
google = {
6+
source = "hashicorp/google"
7+
version = ">= 4.21.0"
8+
}
9+
sysdig = {
10+
source = "sysdiglabs/sysdig"
11+
version = ">= 1.29.2"
12+
}
13+
random = {
14+
source = "hashicorp/random"
15+
version = ">= 3.1"
16+
}
17+
}
18+
}

‎modules/onboarding/variables.tf‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,6 @@ variable "project_id" {
33
description = "(Required) Target Project identifier provided by the customer"
44
}
55

6-
variable "labels" {
7-
type = map(string)
8-
description = "(Optional) Labels to be associated with Sysdig-originated resources"
9-
default = {
10-
originator = "sysdig"
11-
}
12-
}
13-
146
variable "is_organizational" {
157
description = "(Optional) Set this field to 'true' to deploy secure-for-cloud to a GCP Organization."
168
type = bool

‎modules/onboarding/versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ terraform {
1212
}
1313
random = {
1414
source = "hashicorp/random"
15-
version = ">= 3.1, < 4.0"
15+
version = ">= 3.1"
1616
}
1717
}
1818
}

0 commit comments

Comments
 (0)