Skip to content

Commit 86f73ff

Browse files
haresh-sureshharesh-suresh
committed
fix var refns
1 parent b114965 commit 86f73ff

File tree

4 files changed

+72
-42
lines changed

4 files changed

+72
-42
lines changed

‎modules/onboarding/main.tf‎

Lines changed: 46 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ resource "google_service_account" "onboarding_auth" {
2727
}
2828

2929
resource "google_service_account_iam_binding" "onboarding_auth_binding" {
30-
service_account_id = google_service_account.push_auth.name
30+
service_account_id = google_service_account.onboarding_auth.name
3131
role = "roles/iam.workloadIdentityUser"
3232

3333
members = [
@@ -65,30 +65,14 @@ resource "google_iam_workload_identity_pool_provider" "onboarding_auth_pool_prov
6565
}
6666
}
6767

68-
# creating custom role with project-level permissions to access onboarding resources
69-
resource "google_project_iam_custom_role" "custom_onboarding_auth_role" {
70-
count = var.is_organizational ? 0 : 1
71-
72-
project = var.project_id
73-
role_id = var.role_name
74-
title = "Sysdigcloud Onboarding Auth Role"
75-
description = "A Role providing the required permissions for Sysdig Backend to read cloud resources created for onboarding"
76-
permissions = [
77-
"pubsub.topics.get",
78-
"pubsub.topics.list",
79-
"pubsub.subscriptions.get",
80-
"pubsub.subscriptions.list",
81-
"logging.sinks.get",
82-
"logging.sinks.list",
83-
]
84-
}
85-
86-
# adding custom role with project-level permissions to the service account for auth
87-
resource "google_project_iam_member" "custom" {
68+
#---------------------------------
69+
# role permissions for onboarding
70+
#---------------------------------
71+
resource "google_project_iam_member" "browser" {
8872
count = var.is_organizational ? 0 : 1
8973

9074
project = var.project_id
91-
role = google_project_iam_custom_role.custom_onboarding_auth_role[0].id
75+
role = "roles/browser"
9276
member = "serviceAccount:${google_service_account.onboarding_auth.email}"
9377
}
9478

@@ -97,4 +81,44 @@ resource "google_service_account_iam_member" "custom_auth" {
9781
service_account_id = google_service_account.onboarding_auth.name
9882
role = "roles/iam.workloadIdentityUser"
9983
member = "principalSet://iam.googleapis.com/projects/${data.google_project.project.number}/locations/global/workloadIdentityPools/${google_iam_workload_identity_pool.onboarding_auth_pool.workload_identity_pool_id}/attribute.aws_role/arn:aws:sts::${data.sysdig_secure_trusted_cloud_identity.trusted_identity.aws_account_id}:assumed-role/${data.sysdig_secure_trusted_cloud_identity.trusted_identity.aws_role_name}/${var.external_id}"
84+
}
85+
86+
#---------------------------------------------------------------------------------------------
87+
# Call Sysdig Backend to create account with foundational onboarding
88+
# (ensure it is called after all above cloud resources are created using explicit depends_on)
89+
#---------------------------------------------------------------------------------------------
90+
91+
resource "sysdig_secure_cloud_auth_account" "google_account" {
92+
enabled = true
93+
provider_id = var.project_id
94+
provider_type = "PROVIDER_GCP"
95+
provider_alias = data.google_project.project.name
96+
provider_tenant_id = var.organization_domain
97+
98+
component {
99+
type = "COMPONENT_SERVICE_PRINCIPAL"
100+
instance = "secure-onboarding"
101+
version = "v0.1.0"
102+
service_principal_metadata = jsonencode({
103+
gcp = {
104+
service_principal = {
105+
workload_identity_federation = {
106+
pool_id = google_iam_workload_identity_pool.onboarding_auth_pool.workload_identity_pool_id
107+
pool_provider_id = google_iam_workload_identity_pool_provider.onboarding_auth_pool_provider.workload_identity_pool_provider_id
108+
project_number = data.google_project.project.number
109+
}
110+
email = google_service_account.onboarding_auth.email
111+
}
112+
}
113+
})
114+
}
115+
116+
depends_on = [google_service_account_iam_member.custom_auth]
117+
118+
lifecycle {
119+
ignore_changes = [
120+
component,
121+
feature
122+
]
123+
}
100124
}

‎modules/onboarding/organizational.tf‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -7,29 +7,29 @@ data "google_organization" "org" {
77
domain = var.organization_domain
88
}
99

10-
# creating custom role with organization-level permissions to access onboarding resources
11-
resource "google_organization_iam_custom_role" "custom_onboarding_auth_role" {
10+
###################################################
11+
# Setup Service Account permissions
12+
###################################################
13+
14+
#---------------------------------
15+
# role permissions for onboarding
16+
#---------------------------------
17+
resource "google_organization_iam_member" "browser" {
1218
count = var.is_organizational ? 1 : 0
1319

14-
org_id = data.google_organization.org[0].org_id
15-
role_id = var.role_name
16-
title = "Sysdigcloud Onboarding Auth Role"
17-
description = "A Role providing the required permissions for Sysdig Backend to read cloud resources created for onboarding"
18-
permissions = [
19-
"pubsub.topics.get",
20-
"pubsub.topics.list",
21-
"pubsub.subscriptions.get",
22-
"pubsub.subscriptions.list",
23-
"logging.sinks.get",
24-
"logging.sinks.list",
25-
]
20+
org_id = data.google_organization.org[0].org_id
21+
role = "roles/browser"
22+
member = "serviceAccount:${google_service_account.onboarding_auth.email}"
2623
}
2724

28-
# adding custom role with organization-level permissions to the service account for auth
29-
resource "google_organization_iam_member" "custom" {
25+
#---------------------------------------------------------------------------------------------
26+
# Call Sysdig Backend to create organization with foundational onboarding
27+
# (ensure it is called after all above cloud resources are created)
28+
#---------------------------------------------------------------------------------------------
29+
resource "sysdig_secure_organization" "azure_organization" {
3030
count = var.is_organizational ? 1 : 0
3131

32-
org_id = data.google_organization.org[0].org_id
33-
role = google_organization_iam_custom_role.custom_onboarding_auth_role[0].id
34-
member = "serviceAccount:${google_service_account.onboarding_auth.email}"
32+
management_account_id = sysdig_secure_cloud_auth_account.google_account.id
33+
organizational_unit_ids = var.management_group_ids
34+
depends_on = [google_organization_iam_member.browser]
3535
}

‎modules/onboarding/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,12 @@ variable "organization_domain" {
2323
default = ""
2424
}
2525

26+
variable "management_group_ids" {
27+
type = set(string)
28+
description = "(Optional) Management group id to onboard. e.g. [organizations/123456789012], [folders/123456789012]"
29+
default = []
30+
}
31+
2632
variable "external_id" {
2733
type = string
2834
description = "(Required) Random string generated unique to a customer"

‎modules/onboarding/versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ terraform {
88
}
99
sysdig = {
1010
source = "sysdiglabs/sysdig"
11-
version = ">= 1.23.1"
11+
version = ">= 1.29.2"
1212
}
1313
random = {
1414
source = "hashicorp/random"

0 commit comments

Comments
 (0)