Skip to content

Commit af3f570

Browse files
jose-pablo-camachojose-pablo-camacho
committed
feat(modular): address feedback for modular support for cdr/ciem, rebase and cleanup
1 parent 99b4062 commit af3f570

File tree

7 files changed

+62
-166
lines changed

7 files changed

+62
-166
lines changed

‎modules/integrations/webhook-datasource/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -201,7 +201,7 @@ resource "google_project_iam_custom_role" "custom_ingestion_auth_role" {
201201
count = var.is_organizational ? 0 : 1
202202

203203
project = var.project_id
204-
role_id = "${var.role_name}-${local.suffix}"
204+
role_id = "${var.role_name}${local.suffix}"
205205
title = "Sysdigcloud Ingestion Auth Role"
206206
description = "A Role providing the required permissions for Sysdig Backend to read cloud resources created for data ingestion"
207207
permissions = [

‎modules/integrations/webhook-datasource/organizational.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ resource "google_organization_iam_custom_role" "custom_ingestion_auth_role" {
6363
count = var.is_organizational ? 1 : 0
6464

6565
org_id = data.google_organization.org[0].org_id
66-
role_id = "${var.role_name}-org-${local.suffix}"
66+
role_id = "${var.role_name}Org${local.suffix}"
6767
title = "Sysdigcloud Ingestion Auth Role"
6868
description = "A Role providing the required permissions for Sysdig Backend to read cloud resources created for data ingestion"
6969
permissions = [

‎test/examples/modular_organization/webhook_datasource.tf‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#---------------------------------------------------------------------------------------------
2+
# Ensure installation flow for foundational onboarding has been completed before
3+
# installing additional Sysdig features.
4+
#---------------------------------------------------------------------------------------------
5+
6+
module "webhook-datasource" {
7+
source = "../../../modules/integrations/webhook-datasource"
8+
project_id = module.onboarding.project_id
9+
is_organizational = module.onboarding.is_organizational
10+
organization_domain = module.onboarding.organization_domain
11+
sysdig_secure_account_id = module.onboarding.sysdig_secure_account_id
12+
}
13+
14+
resource "sysdig_secure_cloud_auth_account_feature" "threat_detection" {
15+
account_id = module.onboarding.sysdig_secure_account_id
16+
type = "FEATURE_SECURE_THREAT_DETECTION"
17+
enabled = true
18+
components = [ module.webhook-datasource.webhook_datasource_component_id ]
19+
depends_on = [ module.webhook-datasource ]
20+
}
21+
22+
resource "sysdig_secure_cloud_auth_account_feature" "identity_entitlement" {
23+
account_id = module.onboarding.sysdig_secure_account_id
24+
type = "FEATURE_SECURE_IDENTITY_ENTITLEMENT"
25+
enabled = true
26+
components = [module.webhook-datasource.webhook_datasource_component_id]
27+
depends_on = [sysdig_secure_cloud_auth_account_feature.config_posture, sysdig_secure_cloud_auth_account_feature.threat_detection]
28+
}

‎test/examples/modular_single_project/onboarding_with_posture.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
provider "google" {
2-
project = "org-child-project-3"
2+
project = "org-child-project-1"
33
region = "us-west1"
44
}
55

@@ -14,12 +14,12 @@ terraform {
1414

1515
provider "sysdig" {
1616
sysdig_secure_url = "https://secure-staging.sysdig.com"
17-
sysdig_secure_api_token = "API_TOKEN"
17+
sysdig_secure_api_token = "3aec5684-d355-4dd0-8e0e-4b87af8537f3"
1818
}
1919

2020
module "onboarding" {
2121
source = "../../../modules/onboarding"
22-
project_id = "org-child-project-3"
22+
project_id = "org-child-project-1"
2323
}
2424

2525
module "config-posture" {

‎test/examples/modular_single_project/webhook_datasource.tf‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#---------------------------------------------------------------------------------------------
2+
# Ensure installation flow for foundational onboarding has been completed before
3+
# installing additional Sysdig features.
4+
#---------------------------------------------------------------------------------------------
5+
6+
module "webhook-datasource" {
7+
source = "../../../modules/integrations/webhook-datasource"
8+
project_id = module.onboarding.project_id
9+
sysdig_secure_account_id = module.onboarding.sysdig_secure_account_id
10+
}
11+
12+
resource "sysdig_secure_cloud_auth_account_feature" "threat_detection" {
13+
account_id = module.onboarding.sysdig_secure_account_id
14+
type = "FEATURE_SECURE_THREAT_DETECTION"
15+
enabled = true
16+
components = [ module.webhook-datasource.webhook_datasource_component_id ]
17+
depends_on = [ module.webhook-datasource ]
18+
}
19+
20+
resource "sysdig_secure_cloud_auth_account_feature" "identity_entitlement" {
21+
account_id = module.onboarding.sysdig_secure_account_id
22+
type = "FEATURE_SECURE_IDENTITY_ENTITLEMENT"
23+
enabled = true
24+
components = [module.webhook-datasource.webhook_datasource_component_id]
25+
depends_on = [sysdig_secure_cloud_auth_account_feature.config_posture, sysdig_secure_cloud_auth_account_feature.threat_detection]
26+
}

‎test/examples/organization_cdr_test/webhook_datasource.tf‎

Lines changed: 1 addition & 92 deletions
Original file line numberDiff line numberDiff line change
@@ -3,48 +3,14 @@
33
# installing additional Sysdig features.
44
#---------------------------------------------------------------------------------------------
55

6-
# UNCOMMENT TO TEST: FROM HERE: THIS WILL BE PART OF THE ONBOARD MODULE
7-
# terraform {
8-
# required_providers {
9-
# sysdig = {
10-
# source = "sysdiglabs/sysdig"
11-
# version = "~> 1.34.0"
12-
# }
13-
# }
14-
# }
15-
#
16-
# provider "sysdig" {
17-
# sysdig_secure_url = "https://secure-staging.sysdig.com"
18-
# sysdig_secure_api_token = <SYSDIG_TOKEN>
19-
# }
20-
#
21-
# provider "google" {
22-
# project = "org-child-project-1"
23-
# region = "us-west1"
24-
# }
25-
# TO HERE
26-
276
module "webhook-datasource" {
287
source = "../../../modules/integrations/webhook-datasource"
298
project_id = module.onboarding.project_id
30-
# push_endpoint is no longer needed
31-
# push_endpoint = "https://app-staging.sysdigcloud.com/api/cloudingestion/gcp/v2/84f934c6-eb2d-47d9-804b-bcfe9e6ef0b9"
329
is_organizational = module.onboarding.is_organizational
3310
organization_domain = module.onboarding.organization_domain
3411
sysdig_secure_account_id = module.onboarding.sysdig_secure_account_id
3512
}
3613

37-
# UNCOMMENT TO TEST: THIS IS NOT GOING TO BE LONGER NEEDED, SINCE WILL BE PART OF FOUNDATIONAL
38-
# module "organization-posture" {
39-
# source = "sysdiglabs/secure/google//modules/services/service-principal"
40-
# project_id = "org-child-project-1"
41-
# service_account_name = "sysdig-secure-2u6g"
42-
# is_organizational = true
43-
# organization_domain = "draios.com"
44-
# }
45-
# TO HERE
46-
47-
# COMMENT TO TEST: THIS WILL BE PART OF THE SNIPPET
4814
resource "sysdig_secure_cloud_auth_account_feature" "threat_detection" {
4915
account_id = module.onboarding.sysdig_secure_account_id
5016
type = "FEATURE_SECURE_THREAT_DETECTION"
@@ -59,61 +25,4 @@ resource "sysdig_secure_cloud_auth_account_feature" "identity_entitlement" {
5925
enabled = true
6026
components = [module.webhook-datasource.webhook_datasource_component_id]
6127
depends_on = [sysdig_secure_cloud_auth_account_feature.config_posture, sysdig_secure_cloud_auth_account_feature.threat_detection]
62-
}
63-
# TO HERE
64-
65-
# UNCOMMENT TO TEST: THIS IS NOT GOING TO BE LONGER NEEDED, SINCE WILL BE PART OF FOUNDATIONAL
66-
# resource "sysdig_secure_cloud_auth_account" "gcp_project_org-child-project-1" {
67-
# enabled = true
68-
# provider_id = "org-child-project-1"
69-
# provider_type = "PROVIDER_GCP"
70-
#
71-
# feature {
72-
#
73-
# secure_threat_detection {
74-
# enabled = true
75-
# components = ["COMPONENT_WEBHOOK_DATASOURCE/secure-runtime"]
76-
# }
77-
# }
78-
# component {
79-
# type = "COMPONENT_WEBHOOK_DATASOURCE"
80-
# instance = "secure-runtime"
81-
# webhook_datasource_metadata = jsonencode({
82-
# gcp = {
83-
# webhook_datasource = {
84-
# pubsub_topic_name = module.webhook-datasource.ingestion_pubsub_topic_name
85-
# sink_name = module.webhook-datasource.ingestion_sink_name
86-
# push_subscription_name = module.webhook-datasource.ingestion_push_subscription_name
87-
# push_endpoint = module.webhook-datasource.push_endpoint
88-
# routing_key = "84f934c6-eb2d-47d9-804b-bcfe9e6ef0b9"
89-
# }
90-
# service_principal = {
91-
# workload_identity_federation = {
92-
# pool_id = module.webhook-datasource.workload_identity_pool_id
93-
# pool_provider_id = module.webhook-datasource.workload_identity_pool_provider_id
94-
# project_number = module.webhook-datasource.workload_identity_project_number
95-
# }
96-
# email = module.webhook-datasource.service_account_email
97-
# }
98-
# }
99-
# })
100-
# }
101-
#
102-
# component {
103-
# type = "COMPONENT_SERVICE_PRINCIPAL"
104-
# instance = "secure-onboarding"
105-
# service_principal_metadata = jsonencode({
106-
# gcp = {
107-
# key = module.organization-posture.service_account_key
108-
# }
109-
# })
110-
# }
111-
# depends_on = [module.organization-posture, module.webhook-datasource]
112-
# }
113-
#
114-
# resource "sysdig_secure_organization" "gcp_organization_org-child-project-1" {
115-
# organizational_unit_ids = []
116-
# management_account_id = sysdig_secure_cloud_auth_account.gcp_project_org-child-project-1.id
117-
# depends_on = [module.organization-posture, module.webhook-datasource]
118-
# }
119-
# TO HERE
28+
}

‎test/examples/single_account_cdr_test/webhook_datasource.tf‎

Lines changed: 2 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -3,38 +3,12 @@
33
# installing additional Sysdig features.
44
#---------------------------------------------------------------------------------------------
55

6-
# UNCOMMENT TO TEST: FROM HERE: THIS WILL BE PART OF THE ONBOARD MODULE
7-
# terraform {
8-
# required_providers {
9-
# sysdig = {
10-
# source = "sysdiglabs/sysdig"
11-
# version = "~> 1.34.0"
12-
# }
13-
# }
14-
# }
15-
#
16-
# provider "sysdig" {
17-
# sysdig_secure_url = "https://secure-staging.sysdig.com"
18-
# sysdig_secure_api_token = <SYSDIG_TOKEN>
19-
# }
20-
#
21-
# provider "google" {
22-
# project = "org-child-project-1"
23-
# region = "us-west1"
24-
# }
25-
# TO HERE
26-
276
module "webhook-datasource" {
287
source = "../../../modules/integrations/webhook-datasource"
29-
project_id = "org-child-project-1"
30-
# push_endpoint and external_id are no longer needed
31-
# push_endpoint = "https://app-staging.sysdigcloud.com/api/cloudingestion/gcp/v2/1f6d4677-84ec-4356-bd73-c79c8a96f96a"
32-
# external_id = "87e82bdu28323"
33-
# This will come from the onboarding module: module.onboarding.sysdig_secure_account_id
8+
project_id = module.onboarding.project_id
349
sysdig_secure_account_id = module.onboarding.sysdig_secure_account_id
3510
}
3611

37-
# COMMENT TO TEST: THIS WILL BE PART OF THE SNIPPET
3812
resource "sysdig_secure_cloud_auth_account_feature" "threat_detection" {
3913
account_id = module.onboarding.sysdig_secure_account_id
4014
type = "FEATURE_SECURE_THREAT_DETECTION"
@@ -49,45 +23,4 @@ resource "sysdig_secure_cloud_auth_account_feature" "identity_entitlement" {
4923
enabled = true
5024
components = [module.webhook-datasource.webhook_datasource_component_id]
5125
depends_on = [sysdig_secure_cloud_auth_account_feature.config_posture, sysdig_secure_cloud_auth_account_feature.threat_detection]
52-
}
53-
# TO HERE
54-
55-
# UNCOMMENT TO TEST: THIS IS NOT GOING TO BE LONGER NEEDED, SINCE WILL BE PART OF FOUNDATIONAL
56-
# resource "sysdig_secure_cloud_auth_account" "gcp_project_org-child-project-1" {
57-
# enabled = true
58-
# provider_id = "org-child-project-1"
59-
# provider_type = "PROVIDER_GCP"
60-
#
61-
# feature {
62-
#
63-
# secure_threat_detection {
64-
# enabled = true
65-
# components = ["COMPONENT_WEBHOOK_DATASOURCE/secure-runtime"]
66-
# }
67-
# }
68-
# component {
69-
# type = "COMPONENT_WEBHOOK_DATASOURCE"
70-
# instance = "secure-runtime"
71-
# webhook_datasource_metadata = jsonencode({
72-
# gcp = {
73-
# webhook_datasource = {
74-
# pubsub_topic_name = module.webhook-datasource.ingestion_pubsub_topic_name
75-
# sink_name = module.webhook-datasource.ingestion_sink_name
76-
# push_subscription_name = module.webhook-datasource.ingestion_push_subscription_name
77-
# push_endpoint = module.webhook-datasource.push_endpoint
78-
# routing_key = "1f6d4677-84ec-4356-bd73-c79c8a96f96a"
79-
# }
80-
# service_principal = {
81-
# workload_identity_federation = {
82-
# pool_id = module.webhook-datasource.workload_identity_pool_id
83-
# pool_provider_id = module.webhook-datasource.workload_identity_pool_provider_id
84-
# project_number = module.webhook-datasource.workload_identity_project_number
85-
# }
86-
# email = module.webhook-datasource.service_account_email
87-
# }
88-
# }
89-
# })
90-
# }
91-
# depends_on = [module.webhook-datasource]
92-
# }
93-
# TO HERE
26+
}

0 commit comments

Comments
 (0)