Skip to content

Commit b114965

Browse files
haresh-sureshharesh-suresh
committed
adding modular onboarding module
1 parent 61d4ccf commit b114965

File tree

6 files changed

+310
-0
lines changed

6 files changed

+310
-0
lines changed

‎modules/onboarding/README.md‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# GCP Onboarding Module
2+
3+
This module will deploy Foundational Onboarding resources in GCP for a single project, or for a GCP Organization.
4+
The Foundational Onboarding module serves the following functions:
5+
- retrieving inventory for single project, or for all projects within an Organization.
6+
- running organization scraping in the case of organizational onboarding within GCP Organization.
7+
8+
If instrumenting a project, the following resources will be created:
9+
- All the necessary `Service Accounts` and `Policies` to enable the Onboarding operation at the project level
10+
- A `Workload Identity Pool`, `Provider` and added custom role permissions to the `Service Account`, to allow Sysdig to authenticate to GCP on your behalf to validate resources.
11+
- A cloud account in the Sysdig Backend, associated with the GCP project and with the required component to serve the foundational functions.
12+
13+
If instrumenting an Organziation, the following resources will be created:
14+
- All the necessary `Service Accounts` and `Policies` to enable the Onboarding operation at the organization level
15+
- A `Workload Identity Pool`, `Provider` and added custom role permissions to the `Service Account`, to allow Sysdig to authenticate to GCP on your behalf to validate resources.
16+
- A cloud account in the Sysdig Backend, associated with the management project and with the required component to serve the foundational functions.
17+
- A cloud organization in the Sysdig Backend, associated with the GCP Organization to fetch the organization structure to install Sysdig Secure for Cloud on.
18+
19+
Note:
20+
- The outputs from the foundational module, such as `sysdig_secure_project_id` are needed as inputs to the other features/integrations modules for subsequent modular installs.
21+
22+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
23+
## Requirements
24+
25+
| Name | Version |
26+
|------|---------|
27+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
28+
| <a name="requirement_google"></a> [google](#requirement\_google) | >= 4.21.0 |
29+
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | >= 1.23.1 |
30+
31+
## Providers
32+
33+
| Name | Version |
34+
|------|---------|
35+
| <a name="provider_google"></a> [google](#provider\_google) | 5.0.0 |
36+
| <a name="provider_random"></a> [random](#provider\_random) | >= 3.1 |
37+
38+
## Modules
39+
40+
No modules.
41+
42+
## Resources
43+
44+
| [google_service_account.onboarding_auth](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account) | resource |
45+
| [google_service_account_iam_binding.onboarding_auth_binding](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account_iam_binding) | resource |
46+
| [google_organization.org](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/organization) | data source |
47+
| [sysdig_secure_trusted_cloud_identity.trusted_identity](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_trusted_cloud_identity) | data source |
48+
| [google_project.project](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/project) | data source |
49+
| [random_id.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
50+
| [google_iam_workload_identity_pool.onboarding_auth_pool](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/iam_workload_identity_pool) | resource |
51+
| [google_iam_workload_identity_pool_provider.onboarding_auth_pool_provider](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/iam_workload_identity_pool_provider) | resource |
52+
| [google_project_iam_custom_role.custom_onboarding_auth_role](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam_custom_role) | resource |
53+
| [google_project_iam_member.custom](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam#google_project_iam_member) | resource |
54+
| [google_service_account_iam_member.custom_auth](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_service_account_iam#google_service_account_iam_member) | resource |
55+
| [google_organization_iam_custom_role.custom_onboarding_auth_role](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_organization_iam_custom_role) | resource |
56+
| [google_organization_iam_member.custom](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_organization_iam#google_organization_iam_member) | resource |
57+
58+
## Inputs
59+
60+
| Name | Description | Type | Default | Required |
61+
|------|-------------|------|---------|:--------:|
62+
| <a name="input_is_organizational"></a> [is\_organizational](#input\_is\_organizational) | (Optional) Set this field to 'true' to deploy secure-for-cloud to a GCP Organization. | `bool` | `false` | no |
63+
| <a name="input_labels"></a> [labels](#input\_labels) | (Optional) Labels to be associated with Sysdig-originated resources | `map(string)` | <pre>{<br> "originator": "sysdig"<br>}</pre> | no |
64+
| <a name="input_organization_domain"></a> [organization\_domain](#input\_organization\_domain) | Organization domain. e.g. sysdig.com | `string` | `""` | no |
65+
| <a name="input_project_id"></a> [project\_id](#input\_project\_id) | (Required) Target Project identifier provided by the customer | `string` | n/a | yes |
66+
| <a name="input_role_name"></a> [role\_name](#input\_role\_name) | (Optional) Role name for custom role binding to the service account, with read permissions for data onboarding resources | `string` | `"SysdigOnboardingAuthRole-{random_id}"` | no |
67+
| <a name="input_external_id"></a> [external\_id](#input\_external\_id) | (Required) Random string generated unique to a customer | `string` | n/a | yes |
68+
| <a name="input_suffix"></a> [suffix](#input\_suffix) | (Optional) Suffix to uniquely identify resources during multiple installs. If not provided, random value is autogenerated | `string` | `null` | no |
69+
70+
## Outputs
71+
72+
| Name | Description |
73+
|------|-------------|
74+
| <a name="output_workload_identity_pool_id"></a> [workload\_identity\_pool\_id](#output\_workload\_identity\_pool\_id) | Id of Workload Identity Pool for authenticating to GCP to access data ingestion resources |
75+
| <a name="output_workload_identity_pool_provider_id"></a> [workload\_identity\_pool\_provider\_id](#output\_workload\_identity\_pool\_provider\_id) | Id of Workload Identity Pool Provider for authenticating to GCP to access data ingestion resources |
76+
| <a name="output_workload_identity_project_number"></a> [workload\_identity\_project\_number](#output\_workload\_identity\_project\_number) | GCP project number |
77+
| <a name="output_service_account_email"></a> [service\_account\_email](#output\_service\_account\_email) | email of the Service Account created |
78+
| <a name="output_sysdig_secure_project_id"></a> [sysdig\_secure\_project\_id](#output\_sysdig\_secure\_project\_id) | ID of the Sysdig Cloud Account created |
79+
| <a name="output_is_organizational"></a> [is\_organizational](#output\_is\_organizational) | Boolean value to indicate if secure-for-cloud is deployed to an entire GCP organization or not |
80+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
81+
82+
## Authors
83+
84+
Module is maintained by [Sysdig](https://sysdig.com).
85+
86+
## License
87+
88+
Apache 2 Licensed. See LICENSE for full details.

‎modules/onboarding/main.tf‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
#------------------------------------------------------------------#
2+
# Fetch and compute required data for Workload Identity Federation #
3+
#------------------------------------------------------------------#
4+
5+
data "sysdig_secure_trusted_cloud_identity" "trusted_identity" {
6+
cloud_provider = "gcp"
7+
}
8+
9+
data "google_project" "project" {
10+
project_id = var.project_id
11+
}
12+
13+
// suffix to uniquely identify WIF pool and provider during multiple installs. If suffix value is not provided, this will generate a random value.
14+
resource "random_id" "suffix" {
15+
count = var.suffix == null ? 1 : 0
16+
byte_length = 3
17+
}
18+
19+
locals {
20+
suffix = var.suffix == null ? random_id.suffix[0].hex : var.suffix
21+
}
22+
23+
resource "google_service_account" "onboarding_auth" {
24+
account_id = "sysdig-onboarding-${local.suffix}"
25+
display_name = "Sysdig Onboarding Auth Service Account"
26+
project = var.project_id
27+
}
28+
29+
resource "google_service_account_iam_binding" "onboarding_auth_binding" {
30+
service_account_id = google_service_account.push_auth.name
31+
role = "roles/iam.workloadIdentityUser"
32+
33+
members = [
34+
"serviceAccount:${google_service_account.onboarding_auth.email}",
35+
]
36+
}
37+
38+
#------------------------------------------------------------#
39+
# Configure Workload Identity Federation for auth #
40+
# See https://cloud.google.com/iam/docs/access-resources-aws #
41+
#------------------------------------------------------------#
42+
43+
resource "google_iam_workload_identity_pool" "onboarding_auth_pool" {
44+
project = var.project_id
45+
workload_identity_pool_id = "sysdig-onboarding-${local.suffix}"
46+
}
47+
48+
resource "google_iam_workload_identity_pool_provider" "onboarding_auth_pool_provider" {
49+
project = var.project_id
50+
workload_identity_pool_id = google_iam_workload_identity_pool.onboarding_auth_pool.workload_identity_pool_id
51+
workload_identity_pool_provider_id = "sysdig-onboarding-${local.suffix}"
52+
display_name = "Sysdigcloud onboarding auth"
53+
description = "AWS identity pool provider for Sysdig Secure Data Onboarding resources"
54+
disabled = false
55+
56+
attribute_condition = "attribute.aws_role==\"arn:aws:sts::${data.sysdig_secure_trusted_cloud_identity.trusted_identity.aws_account_id}:assumed-role/${data.sysdig_secure_trusted_cloud_identity.trusted_identity.aws_role_name}/${var.external_id}\""
57+
58+
attribute_mapping = {
59+
"google.subject" = "assertion.arn",
60+
"attribute.aws_role" = "assertion.arn"
61+
}
62+
63+
aws {
64+
account_id = data.sysdig_secure_trusted_cloud_identity.trusted_identity.aws_account_id
65+
}
66+
}
67+
68+
# creating custom role with project-level permissions to access onboarding resources
69+
resource "google_project_iam_custom_role" "custom_onboarding_auth_role" {
70+
count = var.is_organizational ? 0 : 1
71+
72+
project = var.project_id
73+
role_id = var.role_name
74+
title = "Sysdigcloud Onboarding Auth Role"
75+
description = "A Role providing the required permissions for Sysdig Backend to read cloud resources created for onboarding"
76+
permissions = [
77+
"pubsub.topics.get",
78+
"pubsub.topics.list",
79+
"pubsub.subscriptions.get",
80+
"pubsub.subscriptions.list",
81+
"logging.sinks.get",
82+
"logging.sinks.list",
83+
]
84+
}
85+
86+
# adding custom role with project-level permissions to the service account for auth
87+
resource "google_project_iam_member" "custom" {
88+
count = var.is_organizational ? 0 : 1
89+
90+
project = var.project_id
91+
role = google_project_iam_custom_role.custom_onboarding_auth_role[0].id
92+
member = "serviceAccount:${google_service_account.onboarding_auth.email}"
93+
}
94+
95+
# attaching WIF as a member to the service account for auth
96+
resource "google_service_account_iam_member" "custom_auth" {
97+
service_account_id = google_service_account.onboarding_auth.name
98+
role = "roles/iam.workloadIdentityUser"
99+
member = "principalSet://iam.googleapis.com/projects/${data.google_project.project.number}/locations/global/workloadIdentityPools/${google_iam_workload_identity_pool.onboarding_auth_pool.workload_identity_pool_id}/attribute.aws_role/arn:aws:sts::${data.sysdig_secure_trusted_cloud_identity.trusted_identity.aws_account_id}:assumed-role/${data.sysdig_secure_trusted_cloud_identity.trusted_identity.aws_role_name}/${var.external_id}"
100+
}

‎modules/onboarding/organizational.tf‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
#--------------#
2+
# Organization #
3+
#--------------#
4+
5+
data "google_organization" "org" {
6+
count = var.is_organizational ? 1 : 0
7+
domain = var.organization_domain
8+
}
9+
10+
# creating custom role with organization-level permissions to access onboarding resources
11+
resource "google_organization_iam_custom_role" "custom_onboarding_auth_role" {
12+
count = var.is_organizational ? 1 : 0
13+
14+
org_id = data.google_organization.org[0].org_id
15+
role_id = var.role_name
16+
title = "Sysdigcloud Onboarding Auth Role"
17+
description = "A Role providing the required permissions for Sysdig Backend to read cloud resources created for onboarding"
18+
permissions = [
19+
"pubsub.topics.get",
20+
"pubsub.topics.list",
21+
"pubsub.subscriptions.get",
22+
"pubsub.subscriptions.list",
23+
"logging.sinks.get",
24+
"logging.sinks.list",
25+
]
26+
}
27+
28+
# adding custom role with organization-level permissions to the service account for auth
29+
resource "google_organization_iam_member" "custom" {
30+
count = var.is_organizational ? 1 : 0
31+
32+
org_id = data.google_organization.org[0].org_id
33+
role = google_organization_iam_custom_role.custom_onboarding_auth_role[0].id
34+
member = "serviceAccount:${google_service_account.onboarding_auth.email}"
35+
}

‎modules/onboarding/outputs.tf‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
output "workload_identity_pool_id" {
2+
value = google_iam_workload_identity_pool.onboarding_auth_pool.workload_identity_pool_id
3+
description = "Id of Workload Identity Pool for authenticating to GCP to access data onboarding resources"
4+
}
5+
6+
output "workload_identity_pool_provider_id" {
7+
value = google_iam_workload_identity_pool_provider.onboarding_auth_pool_provider.workload_identity_pool_provider_id
8+
description = "Id of Workload Identity Pool Provider for authenticating to GCP to access data onboarding resources"
9+
}
10+
11+
output "workload_identity_project_number" {
12+
value = data.google_project.project.number
13+
description = "GCP project number"
14+
}
15+
16+
output "service_account_email" {
17+
value = google_service_account.onboarding_auth.email
18+
description = "email of the Service Account created"
19+
}
20+
21+
output "project_id" {
22+
value = var.project_id
23+
description = "Project ID in which secure-for-cloud onboarding resources are created. For organizational installs it is the Management Project ID selected during install"
24+
}
25+
26+
output "sysdig_secure_project_id" {
27+
value = sysdig_secure_cloud_auth_account.google_account.id
28+
description = "ID of the Sysdig Cloud Account created"
29+
}
30+
31+
output "is_organizational" {
32+
value = var.is_organizational
33+
description = "Boolean value to indicate if secure-for-cloud is deployed to an entire GCP organization or not"
34+
}

‎modules/onboarding/variables.tf‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
variable "project_id" {
2+
type = string
3+
description = "(Required) Target Project identifier provided by the customer"
4+
}
5+
6+
variable "labels" {
7+
type = map(string)
8+
description = "(Optional) Labels to be associated with Sysdig-originated resources"
9+
default = {
10+
originator = "sysdig"
11+
}
12+
}
13+
14+
variable "is_organizational" {
15+
description = "(Optional) Set this field to 'true' to deploy secure-for-cloud to a GCP Organization."
16+
type = bool
17+
default = false
18+
}
19+
20+
variable "organization_domain" {
21+
type = string
22+
description = "(Optional) Organization domain. e.g. sysdig.com"
23+
default = ""
24+
}
25+
26+
variable "external_id" {
27+
type = string
28+
description = "(Required) Random string generated unique to a customer"
29+
}
30+
31+
variable "suffix" {
32+
type = string
33+
description = "Suffix to uniquely identify resources during multiple installs. If not provided, random value is autogenerated"
34+
default = null
35+
}

‎modules/onboarding/versions.tf‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
terraform {
2+
required_version = ">= 1.0.0"
3+
4+
required_providers {
5+
google = {
6+
source = "hashicorp/google"
7+
version = ">= 4.21.0"
8+
}
9+
sysdig = {
10+
source = "sysdiglabs/sysdig"
11+
version = ">= 1.23.1"
12+
}
13+
random = {
14+
source = "hashicorp/random"
15+
version = ">= 3.1, < 4.0"
16+
}
17+
}
18+
}

0 commit comments

Comments
 (0)