Skip to content

Commit fb8a89b

Browse files
jose-pablo-camachojose-pablo-camacho
authored
SSPROD-54737 - enhance: support WIF onboarding (#70)
* SSPROD-54737 - enhance: support WIF onboarding * SSPROD-54737 - enhance: support WIF onboarding * SSPROD-54737 - wif support * SSPROD-54737 - wif support * SSPROD-54737 - wif support * SSPROD-54737 - wif support
1 parent 7850537 commit fb8a89b

File tree

4 files changed

+101
-31
lines changed

4 files changed

+101
-31
lines changed

‎modules/onboarding/README.md‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -9,16 +9,14 @@ The Foundational Onboarding module serves the following functions:
99
If instrumenting a project, the following resources will be created:
1010

1111
- All the necessary `Service Accounts` and `Policies` to enable the Onboarding operation at the project level
12-
- A `Service Account key` and added role permissions to the `Service Account`, to allow Sysdig to authenticate to GCP on
13-
your behalf to validate resources.
12+
- A `Workload Identity Pool`, `Provider` and added custom role permissions to the `Service Account`, to allow Sysdig to authenticate to GCP on your behalf to validate resources.
1413
- A cloud account in the Sysdig Backend, associated with the GCP project and with the required component to serve the
1514
foundational functions.
1615

17-
If instrumenting an Organziation, the following resources will be created:
16+
If instrumenting an Organization, the following resources will be created:
1817

1918
- All the necessary `Service Accounts` and `Policies` to enable the Onboarding operation at the organization level
20-
- A `Service Account key` and added role permissions to the `Service Account`, to allow Sysdig to authenticate to GCP on
21-
your behalf to validate resources.
19+
- A `Workload Identity Pool`, `Provider` and added custom role permissions to the `Service Account`, to allow Sysdig to authenticate to GCP on your behalf to validate resources.
2220
- A cloud account in the Sysdig Backend, associated with the management project and with the required component to serve
2321
the foundational functions.
2422
- A cloud organization in the Sysdig Backend, associated with the GCP Organization to fetch the organization structure
@@ -27,7 +25,7 @@ If instrumenting an Organziation, the following resources will be created:
2725
Note:
2826

2927
- The outputs from the foundational module, such as `sysdig_secure_account_id` are needed as inputs to the other
30-
features/integrations modules for subsequent modular installs.
28+
features/integrations modules for subsequent modular installations.
3129

3230
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
3331

@@ -45,6 +43,8 @@ Note:
4543
|------------------------------------------------------------|---------|
4644
| <a name="provider_google"></a> [google](#provider\_google) | 5.0.0 |
4745
| <a name="provider_random"></a> [random](#provider\_random) | >= 3.1 |
46+
| <a name="provider_time"></a> [time](#provider\_time) | 0.13.1 |
47+
4848

4949
## Modules
5050

@@ -56,15 +56,18 @@ No modules.
5656
resource |
5757
| [google_organization.org](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/organization) |
5858
data source |
59+
| [sysdig_secure_trusted_cloud_identity.trusted_identity](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_trusted_cloud_identity) | data source |
60+
| [sysdig_secure_tenant_external_id](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_tenant_external_id) | data source |
5961
| [google_project.project](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/project) |
6062
data source |
6163
| [random_id.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
64+
| [google_iam_workload_identity_pool.onboarding_auth_pool](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/iam_workload_identity_pool) | resource |
65+
| [google_iam_workload_identity_pool_provider.onboarding_auth_pool_provider](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/iam_workload_identity_pool_provider) | resource |
6266
| [google_project_iam_member.browser](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam#google_project_iam_member) |
6367
resource |
6468
| [google_organization_iam_member.browser](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_organization_iam#google_organization_iam_member) |
6569
resource |
66-
| [google_service_account_key.onboarding_service_account_key](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account_key) |
67-
resource |
70+
| [google_service_account_iam_member.custom_onboarding_auth](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_service_account_iam#google_service_account_iam_member) | resource |
6871
| [sysdig_secure_cloud_auth_account.google_account](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/resources/secure_cloud_auth_account) |
6972
resource |
7073
| [sysdig_secure_organization.google_organization](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/resources/secure_organization) |

‎modules/onboarding/main.tf‎

Lines changed: 84 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,13 @@
11
#------------------------------------------------------------------#
2-
# Fetch and compute required data for Service Account Key #
2+
# Fetch and compute required data for Workload Identity Federation #
33
#------------------------------------------------------------------#
44

5+
data "sysdig_secure_trusted_cloud_identity" "trusted_identity" {
6+
cloud_provider = "gcp"
7+
}
8+
9+
data "sysdig_secure_tenant_external_id" "external_id" {}
10+
511
data "google_project" "project" {
612
project_id = var.project_id
713
}
@@ -23,9 +29,39 @@ resource "google_service_account" "onboarding_auth" {
2329
project = var.project_id
2430
}
2531

26-
#---------------------------------
27-
# role permissions for onboarding
28-
#---------------------------------
32+
#------------------------------------------------------------#
33+
# Configure Workload Identity Federation for auth #
34+
# See https://cloud.google.com/iam/docs/access-resources-aws #
35+
#------------------------------------------------------------#
36+
37+
resource "google_iam_workload_identity_pool" "onboarding_auth_pool" {
38+
project = var.project_id
39+
workload_identity_pool_id = "sysdig-secure-onboarding-${local.suffix}"
40+
}
41+
42+
resource "google_iam_workload_identity_pool_provider" "onboarding_auth_pool_provider" {
43+
project = var.project_id
44+
workload_identity_pool_id = google_iam_workload_identity_pool.onboarding_auth_pool.workload_identity_pool_id
45+
workload_identity_pool_provider_id = "sysdig-onboarding-${local.suffix}"
46+
display_name = "Sysdigcloud onboarding auth"
47+
description = "AWS based pool provider for Sysdig Secure Data Onboarding resources"
48+
disabled = false
49+
50+
attribute_condition = "attribute.aws_role==\"arn:aws:sts::${data.sysdig_secure_trusted_cloud_identity.trusted_identity.aws_account_id}:assumed-role/${data.sysdig_secure_trusted_cloud_identity.trusted_identity.aws_role_name}/${data.sysdig_secure_tenant_external_id.external_id.external_id}\""
51+
52+
attribute_mapping = {
53+
"google.subject" = "assertion.arn",
54+
"attribute.aws_role" = "assertion.arn"
55+
}
56+
57+
aws {
58+
account_id = data.sysdig_secure_trusted_cloud_identity.trusted_identity.aws_account_id
59+
}
60+
}
61+
62+
#---------------------------------------------------------------------------------------------
63+
# role permissions for Onboarding (GCP Predefined Roles for Sysdig Cloud Onboarding)
64+
#---------------------------------------------------------------------------------------------
2965
resource "google_project_iam_member" "browser" {
3066
count = var.is_organizational ? 0 : 1
3167

@@ -34,12 +70,18 @@ resource "google_project_iam_member" "browser" {
3470
member = "serviceAccount:${google_service_account.onboarding_auth.email}"
3571
}
3672

37-
#--------------------------------
38-
# service account private key
39-
40-
#--------------------------------
41-
resource "google_service_account_key" "onboarding_service_account_key" {
73+
# attaching WIF as a member to the service account for auth
74+
resource "google_service_account_iam_member" "custom_onboarding_auth" {
4275
service_account_id = google_service_account.onboarding_auth.name
76+
role = "roles/iam.workloadIdentityUser"
77+
member = "principalSet://iam.googleapis.com/projects/${data.google_project.project.number}/locations/global/workloadIdentityPools/${google_iam_workload_identity_pool.onboarding_auth_pool.workload_identity_pool_id}/attribute.aws_role/arn:aws:sts::${data.sysdig_secure_trusted_cloud_identity.trusted_identity.aws_account_id}:assumed-role/${data.sysdig_secure_trusted_cloud_identity.trusted_identity.aws_role_name}/${data.sysdig_secure_tenant_external_id.external_id.external_id}"
78+
}
79+
80+
# add some timing for SA and permissions to be completely ready before calling Sysdig Backend, ensure that onboarding will pass first time
81+
resource "time_sleep" "wait_for_apply_google_permissions" {
82+
depends_on = [google_organization_iam_member.browser, google_project_iam_member.browser]
83+
84+
create_duration = "30s"
4385
}
4486

4587
#---------------------------------------------------------------------------------------------
@@ -53,22 +95,13 @@ resource "sysdig_secure_cloud_auth_account" "google_account" {
5395
provider_type = "PROVIDER_GCP"
5496
provider_alias = data.google_project.project.name
5597
provider_tenant_id = var.organization_domain
56-
57-
component {
58-
type = "COMPONENT_SERVICE_PRINCIPAL"
59-
instance = "secure-onboarding"
60-
version = "v0.1.0"
61-
service_principal_metadata = jsonencode({
62-
gcp = {
63-
key = google_service_account_key.onboarding_service_account_key.private_key
64-
}
65-
})
66-
}
67-
6898
depends_on = [
6999
google_service_account.onboarding_auth,
100+
google_iam_workload_identity_pool.onboarding_auth_pool,
101+
google_iam_workload_identity_pool_provider.onboarding_auth_pool_provider,
70102
google_project_iam_member.browser,
71-
google_service_account_key.onboarding_service_account_key
103+
google_service_account_iam_member.custom_onboarding_auth,
104+
time_sleep.wait_for_apply_google_permissions
72105
]
73106

74107
lifecycle {
@@ -77,4 +110,33 @@ resource "sysdig_secure_cloud_auth_account" "google_account" {
77110
feature
78111
]
79112
}
113+
}
114+
115+
#--------------------------------------------------------------------------------------------------------------
116+
# Call Sysdig Backend to add the service-principal integration for Onboarding to the Sysdig Cloud Account
117+
#--------------------------------------------------------------------------------------------------------------
118+
resource "sysdig_secure_cloud_auth_account_component" "onboarding_service_principal" {
119+
account_id = sysdig_secure_cloud_auth_account.google_account.id
120+
type = "COMPONENT_SERVICE_PRINCIPAL"
121+
instance = "secure-onboarding"
122+
version = "v0.1.0"
123+
service_principal_metadata = jsonencode({
124+
gcp = {
125+
workload_identity_federation = {
126+
pool_id = google_iam_workload_identity_pool.onboarding_auth_pool.workload_identity_pool_id
127+
pool_provider_id = google_iam_workload_identity_pool_provider.onboarding_auth_pool_provider.workload_identity_pool_provider_id
128+
project_number = data.google_project.project.number
129+
}
130+
email = google_service_account.onboarding_auth.email
131+
}
132+
})
133+
depends_on = [
134+
sysdig_secure_cloud_auth_account.google_account,
135+
google_service_account.onboarding_auth,
136+
google_iam_workload_identity_pool.onboarding_auth_pool,
137+
google_iam_workload_identity_pool_provider.onboarding_auth_pool_provider,
138+
google_project_iam_member.browser,
139+
google_service_account_iam_member.custom_onboarding_auth,
140+
time_sleep.wait_for_apply_google_permissions
141+
]
80142
}

‎modules/onboarding/organizational.tf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,8 @@ resource "sysdig_secure_organization" "google_organization" {
3939
automatic_onboarding = var.enable_automatic_onboarding
4040
depends_on = [
4141
google_organization_iam_member.browser,
42-
sysdig_secure_cloud_auth_account.google_account
42+
sysdig_secure_cloud_auth_account.google_account,
43+
sysdig_secure_cloud_auth_account_component.onboarding_service_principal,
4344
]
4445
lifecycle {
4546
ignore_changes = [automatic_onboarding]

‎modules/onboarding/versions.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,5 +14,9 @@ terraform {
1414
source = "hashicorp/random"
1515
version = ">= 3.1"
1616
}
17+
time = {
18+
source = "hashicorp/time"
19+
version = "0.13.1"
20+
}
1721
}
1822
}

0 commit comments

Comments
 (0)