Skip to content

Commit c368241

Browse files
legobricklegobrick
committed
fix(cdr) - support empty audit logs block
1 parent 981ea22 commit c368241

File tree

7 files changed

+204
-4
lines changed

7 files changed

+204
-4
lines changed

‎modules/integrations/pub-sub/main.tf‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,10 +54,12 @@ resource "random_uuid" "routing_key" {}
5454
#-----------------------------------------------------------------------------------------
5555
locals {
5656
# Data structure will be a map for each service, that can have multiple audit_log_config
57-
audit_log_config = { for audit in var.audit_log_config :
57+
audit_log_config = {
58+
for audit in var.audit_log_config :
5859
audit["service"] => {
5960
log_config = audit["log_config"]
6061
}
62+
if length(audit["log_config"]) > 0 # Include only if log_config is not empty
6163
}
6264
}
6365

@@ -266,4 +268,4 @@ resource "sysdig_secure_cloud_auth_account_component" "gcp_pubsub_datasource" {
266268
}
267269
}
268270
})
269-
}
271+
}

‎test/examples/modular_organization/pub-sub-admin-write-only1.tf‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
#---------------------------------------------------------------------------------------------
2+
# Ensure installation flow for foundational onboarding has been completed before
3+
# installing additional Sysdig features.
4+
#---------------------------------------------------------------------------------------------
5+
6+
module "pub-sub" {
7+
source = "../../../modules/integrations/pub-sub"
8+
project_id = module.onboarding.project_id
9+
is_organizational = module.onboarding.is_organizational
10+
organization_domain = module.onboarding.organization_domain
11+
sysdig_secure_account_id = module.onboarding.sysdig_secure_account_id
12+
ingestion_sink_filter = ""
13+
audit_log_config = [
14+
{
15+
service = "allServices"
16+
log_config = []
17+
}
18+
]
19+
exclude_logs_filter = []
20+
}
21+
22+
resource "sysdig_secure_cloud_auth_account_feature" "threat_detection" {
23+
account_id = module.onboarding.sysdig_secure_account_id
24+
type = "FEATURE_SECURE_THREAT_DETECTION"
25+
enabled = true
26+
components = [ module.pub-sub.pubsub_datasource_component_id ]
27+
depends_on = [ module.pub-sub ]
28+
}
29+
30+
resource "sysdig_secure_cloud_auth_account_feature" "identity_entitlement" {
31+
account_id = module.onboarding.sysdig_secure_account_id
32+
type = "FEATURE_SECURE_IDENTITY_ENTITLEMENT"
33+
enabled = true
34+
components = [module.pub-sub.pubsub_datasource_component_id]
35+
depends_on = [sysdig_secure_cloud_auth_account_feature.config_posture, module.pub-sub]
36+
}

‎test/examples/modular_organization/pub-sub-admin-write-only2.tf‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#---------------------------------------------------------------------------------------------
2+
# Ensure installation flow for foundational onboarding has been completed before
3+
# installing additional Sysdig features.
4+
#---------------------------------------------------------------------------------------------
5+
6+
module "pub-sub" {
7+
source = "../../../modules/integrations/pub-sub"
8+
project_id = module.onboarding.project_id
9+
is_organizational = module.onboarding.is_organizational
10+
organization_domain = module.onboarding.organization_domain
11+
sysdig_secure_account_id = module.onboarding.sysdig_secure_account_id
12+
ingestion_sink_filter = ""
13+
audit_log_config = []
14+
exclude_logs_filter = []
15+
}
16+
17+
resource "sysdig_secure_cloud_auth_account_feature" "threat_detection" {
18+
account_id = module.onboarding.sysdig_secure_account_id
19+
type = "FEATURE_SECURE_THREAT_DETECTION"
20+
enabled = true
21+
components = [ module.pub-sub.pubsub_datasource_component_id ]
22+
depends_on = [ module.pub-sub ]
23+
}
24+
25+
resource "sysdig_secure_cloud_auth_account_feature" "identity_entitlement" {
26+
account_id = module.onboarding.sysdig_secure_account_id
27+
type = "FEATURE_SECURE_IDENTITY_ENTITLEMENT"
28+
enabled = true
29+
components = [module.pub-sub.pubsub_datasource_component_id]
30+
depends_on = [sysdig_secure_cloud_auth_account_feature.config_posture, module.pub-sub]
31+
}

‎test/examples/modular_organization/pub-sub.tf‎

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,40 @@ module "pub-sub" {
99
is_organizational = module.onboarding.is_organizational
1010
organization_domain = module.onboarding.organization_domain
1111
sysdig_secure_account_id = module.onboarding.sysdig_secure_account_id
12+
ingestion_sink_filter = "protoPayload.@type = \"type.googleapis.com/google.cloud.audit.AuditLog\" (protoPayload.methodName!~ \"\\.(get|list)$\" OR protoPayload.serviceName != (\"k8s.io\" and \"storage.googleapis.com\"))"
13+
audit_log_config = [
14+
{
15+
service = "cloudsql.googleapis.com"
16+
log_config = [{ log_type = "DATA_READ",
17+
exempted_members = [
18+
"serviceAccount:[email protected]",
19+
]
20+
},
21+
{ log_type = "DATA_WRITE" }
22+
]
23+
},
24+
{
25+
service = "storage.googleapis.com"
26+
log_config = [{ log_type = "DATA_WRITE"
27+
}]
28+
},
29+
{
30+
service = "container.googleapis.com"
31+
log_config = [{ log_type = "DATA_READ" }]
32+
}
33+
]
34+
exclude_logs_filter = [
35+
{
36+
name = "nsexcllusion2"
37+
description = "Exclude logs from namespace-2 in k8s"
38+
filter = "resource.type = k8s_container resource.labels.namespace_name=\"namespace-2\" "
39+
},
40+
{
41+
name = "nsexcllusion1"
42+
description = "Exclude logs from namespace-1 in k8s"
43+
filter = "resource.type = k8s_container resource.labels.namespace_name=\"namespace-1\" "
44+
}
45+
]
1246
}
1347

1448
resource "sysdig_secure_cloud_auth_account_feature" "threat_detection" {
@@ -25,4 +59,4 @@ resource "sysdig_secure_cloud_auth_account_feature" "identity_entitlement" {
2559
enabled = true
2660
components = [module.pub-sub.pubsub_datasource_component_id]
2761
depends_on = [sysdig_secure_cloud_auth_account_feature.config_posture, module.pub-sub]
28-
}
62+
}

‎test/examples/modular_single_project/pub-sub-admin-write-only1.tf‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
#---------------------------------------------------------------------------------------------
2+
# Ensure installation flow for foundational onboarding has been completed before
3+
# installing additional Sysdig features.
4+
#---------------------------------------------------------------------------------------------
5+
6+
module "pub-sub" {
7+
source = "../../../modules/integrations/pub-sub"
8+
project_id = module.onboarding.project_id
9+
sysdig_secure_account_id = module.onboarding.sysdig_secure_account_id
10+
ingestion_sink_filter = ""
11+
audit_log_config = [
12+
{
13+
service = "allServices"
14+
log_config = []
15+
}
16+
]
17+
exclude_logs_filter = []
18+
}
19+
20+
resource "sysdig_secure_cloud_auth_account_feature" "threat_detection" {
21+
account_id = module.onboarding.sysdig_secure_account_id
22+
type = "FEATURE_SECURE_THREAT_DETECTION"
23+
enabled = true
24+
components = [ module.pub-sub.pubsub_datasource_component_id ]
25+
depends_on = [ module.pub-sub ]
26+
}
27+
28+
resource "sysdig_secure_cloud_auth_account_feature" "identity_entitlement" {
29+
account_id = module.onboarding.sysdig_secure_account_id
30+
type = "FEATURE_SECURE_IDENTITY_ENTITLEMENT"
31+
enabled = true
32+
components = [module.pub-sub.pubsub_datasource_component_id]
33+
depends_on = [sysdig_secure_cloud_auth_account_feature.config_posture, module.pub-sub]
34+
}

‎test/examples/modular_single_project/pub-sub-admin-write-only2.tf‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
#---------------------------------------------------------------------------------------------
2+
# Ensure installation flow for foundational onboarding has been completed before
3+
# installing additional Sysdig features.
4+
#---------------------------------------------------------------------------------------------
5+
6+
module "pub-sub" {
7+
source = "../../../modules/integrations/pub-sub"
8+
project_id = module.onboarding.project_id
9+
sysdig_secure_account_id = module.onboarding.sysdig_secure_account_id
10+
ingestion_sink_filter = ""
11+
audit_log_config = []
12+
exclude_logs_filter = []
13+
}
14+
15+
resource "sysdig_secure_cloud_auth_account_feature" "threat_detection" {
16+
account_id = module.onboarding.sysdig_secure_account_id
17+
type = "FEATURE_SECURE_THREAT_DETECTION"
18+
enabled = true
19+
components = [ module.pub-sub.pubsub_datasource_component_id ]
20+
depends_on = [ module.pub-sub ]
21+
}
22+
23+
resource "sysdig_secure_cloud_auth_account_feature" "identity_entitlement" {
24+
account_id = module.onboarding.sysdig_secure_account_id
25+
type = "FEATURE_SECURE_IDENTITY_ENTITLEMENT"
26+
enabled = true
27+
components = [module.pub-sub.pubsub_datasource_component_id]
28+
depends_on = [sysdig_secure_cloud_auth_account_feature.config_posture, module.pub-sub]
29+
}

‎test/examples/modular_single_project/pub-sub.tf‎

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,40 @@ module "pub-sub" {
77
source = "../../../modules/integrations/pub-sub"
88
project_id = module.onboarding.project_id
99
sysdig_secure_account_id = module.onboarding.sysdig_secure_account_id
10+
ingestion_sink_filter = "protoPayload.@type = \"type.googleapis.com/google.cloud.audit.AuditLog\" (protoPayload.methodName!~ \"\\.(get|list)$\" OR protoPayload.serviceName != (\"k8s.io\" and \"storage.googleapis.com\"))"
11+
audit_log_config = [
12+
{
13+
service = "cloudsql.googleapis.com"
14+
log_config = [{ log_type = "DATA_READ",
15+
exempted_members = [
16+
"serviceAccount:[email protected]",
17+
]
18+
},
19+
{ log_type = "DATA_WRITE" }
20+
]
21+
},
22+
{
23+
service = "storage.googleapis.com"
24+
log_config = [{ log_type = "DATA_WRITE"
25+
}]
26+
},
27+
{
28+
service = "container.googleapis.com"
29+
log_config = [{ log_type = "DATA_READ" }]
30+
}
31+
]
32+
exclude_logs_filter = [
33+
{
34+
name = "nsexcllusion2"
35+
description = "Exclude logs from namespace-2 in k8s"
36+
filter = "resource.type = k8s_container resource.labels.namespace_name=\"namespace-2\" "
37+
},
38+
{
39+
name = "nsexcllusion1"
40+
description = "Exclude logs from namespace-1 in k8s"
41+
filter = "resource.type = k8s_container resource.labels.namespace_name=\"namespace-1\" "
42+
}
43+
]
1044
}
1145

1246
resource "sysdig_secure_cloud_auth_account_feature" "threat_detection" {
@@ -23,4 +57,4 @@ resource "sysdig_secure_cloud_auth_account_feature" "identity_entitlement" {
2357
enabled = true
2458
components = [module.pub-sub.pubsub_datasource_component_id]
2559
depends_on = [sysdig_secure_cloud_auth_account_feature.config_posture, module.pub-sub]
26-
}
60+
}

0 commit comments

Comments
 (0)