diff --git a/modules/agentless-scan/README.md b/modules/agentless-scan/README.md index acd02b5..e0ea595 100644 --- a/modules/agentless-scan/README.md +++ b/modules/agentless-scan/README.md @@ -71,13 +71,13 @@ No modules. ## Inputs -| Name | Description | Type | Default | Required | -|----------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|-----------------------------|:--------:| -| [project\_id](#input\_project\_id) | GCP Project ID | `string` | n/a | yes | -| [is\_organizational](#input\_is\_organizational) | Optional. Determines whether module must scope whole organization. Otherwise single project will be scoped | `bool` | `false` | no | -| [organization\_domain](#input\_organization\_domain) | Optional. If `is_organizational=true` is set, its mandatory to specify this value, with the GCP Organization domain. e.g. sysdig.com | `string` | `null` | no | -| [sysdig\_secure\_account\_id](#input\_sysdig\_secure\_account\_id) | ID of the Sysdig Cloud Account to enable Agentless Scanning integration for (in case of organization, ID of the Sysdig management account) | `string` | `null` | no | -| [suffix](#input\_suffix) | Optional. Suffix word to enable multiple deployments with different naming
(Workload Identity Pool and Providers have a soft deletion on Google Platform that will disallow name re-utilization)
By default a random value will be autogenerated. | `string` | `null` | no | +| Name | Description | Type | Default | Required | +|------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|---------|:--------:| +| [project\_id](#input\_project\_id) | GCP Project ID | `string` | n/a | yes | +| [is\_organizational](#input\_is\_organizational) | Optional. Determines whether module must scope whole organization. Otherwise single project will be scoped | `bool` | `false` | no | +| [organization\_domain](#input\_organization\_domain) | Optional. If `is_organizational=true` is set, its mandatory to specify this value, with the GCP Organization domain. e.g. sysdig.com | `string` | `null` | no | +| [sysdig\_secure\_account\_id](#input\_sysdig\_secure\_account\_id) | ID of the Sysdig Cloud Account to enable Agentless Scanning integration for (in case of organization, ID of the Sysdig management account) | `string` | `null` | no | +| [suffix](#input\_suffix) | Optional. Suffix word to enable multiple deployments with different naming
(Workload Identity Pool and Providers have a soft deletion on Google Platform that will disallow name re-utilization)
By default a random value will be autogenerated. | `string` | `null` | no | ## Outputs diff --git a/modules/config-posture/README.md b/modules/config-posture/README.md index 8ad48fc..097e46b 100644 --- a/modules/config-posture/README.md +++ b/modules/config-posture/README.md @@ -55,13 +55,13 @@ No modules. ## Inputs -| Name | Description | Type | Default | Required | -|------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|------|-----------------------------------------------|:--------:| -| [is\_organizational](#input\_is\_organizational) | (Optional) Set this field to 'true' to deploy secure-for-cloud to a GCP Organization. | `bool` | `false` | no | -| [organization\_domain](#input\_organization\_domain) | Organization domain. e.g. sysdig.com | `string` | `""` | no | -| [project\_id](#input\_project\_id) | (Required) Target Project identifier provided by the customer | `string` | n/a | yes | -| [suffix](#input\_suffix) | (Optional) Suffix to uniquely identify resources during multiple installs. If not provided, random value is autogenerated | `string` | `null` | no | -| [sysdig\_secure\_account\_id](#input\_sysdig\_secure\_account\_id) | (Required) The GUID of the management project or single project per sysdig representation | `string` | n/a | yes | +| Name | Description | Type | Default | Required | +|------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|---------------|---------|:--------:| +| [is\_organizational](#input\_is\_organizational) | (Optional) Set this field to 'true' to deploy secure-for-cloud to a GCP Organization. | `bool` | `false` | no | +| [organization\_domain](#input\_organization\_domain) | Organization domain. e.g. sysdig.com | `string` | `""` | no | +| [project\_id](#input\_project\_id) | (Required) Target Project identifier provided by the customer | `string` | n/a | yes | +| [suffix](#input\_suffix) | (Optional) Suffix to uniquely identify resources during multiple installs. If not provided, random value is autogenerated | `string` | `null` | no | +| [sysdig\_secure\_account\_id](#input\_sysdig\_secure\_account\_id) | (Required) The GUID of the management project or single project per sysdig representation | `string` | n/a | yes | ## Outputs diff --git a/modules/config-posture/variables.tf b/modules/config-posture/variables.tf index b975bc2..7864843 100644 --- a/modules/config-posture/variables.tf +++ b/modules/config-posture/variables.tf @@ -24,4 +24,4 @@ variable "suffix" { variable "sysdig_secure_account_id" { type = string description = "ID of the Sysdig Cloud Account to enable Config Posture for (in case of organization, ID of the Sysdig management account)" -} \ No newline at end of file +} diff --git a/modules/integrations/pub-sub/variables.tf b/modules/integrations/pub-sub/variables.tf index 6cf397b..e490efa 100644 --- a/modules/integrations/pub-sub/variables.tf +++ b/modules/integrations/pub-sub/variables.tf @@ -100,4 +100,4 @@ variable "ingestion_sink_filter" { variable "sysdig_secure_account_id" { type = string description = "ID of the Sysdig Cloud Account to enable to enable Pub Sub integration for (incase of organization, ID of the Sysdig management account)" -} \ No newline at end of file +} diff --git a/modules/onboarding/README.md b/modules/onboarding/README.md index d865008..3af445e 100644 --- a/modules/onboarding/README.md +++ b/modules/onboarding/README.md @@ -53,13 +53,17 @@ No modules. ## Inputs -| Name | Description | Type | Default | Required | -|-----------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|------|---------|:--------:| -| [is\_organizational](#input\_is\_organizational) | (Optional) Set this field to 'true' to deploy secure-for-cloud to a GCP Organization. | `bool` | `false` | no | -| [organization\_domain](#input\_organization\_domain) | Organization domain. e.g. sysdig.com | `string` | `""` | no | -| [project\_id](#input\_project\_id) | (Required) Target Project identifier provided by the customer | `string` | n/a | yes | -| [suffix](#input\_suffix) | (Optional) Suffix to uniquely identify resources during multiple installs. If not provided, random value is autogenerated | `string` | `null` | no | -| [suffix](#input\_management\_group\_ids) | (Optional) List of management group ids w.r.t an org install. If not provided, set to empty by default | `string` | `null` | no | +| Name | Description | Type | Default | Required | +|-----------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|---------|:--------:| +| [is\_organizational](#input\_is\_organizational) | (Optional) Set this field to 'true' to deploy secure-for-cloud to a GCP Organization. | `bool` | `false` | no | +| [organization\_domain](#input\_organization\_domain) | Organization domain. e.g. sysdig.com | `string` | `""` | no | +| [project\_id](#input\_project\_id) | (Required) Target Project identifier provided by the customer | `string` | n/a | yes | +| [suffix](#input\_suffix) | (Optional) Suffix to uniquely identify resources during multiple installs. If not provided, random value is autogenerated | `string` | `null` | no | +| [suffix](#input\_management\_group\_ids) | TO BE DEPRECATED: Please work with Sysdig to migrate to using `include_folders` instead.
List of management group ids w.r.t an org install. If not provided, set to empty by default | `set(string)` | `[]` | no | +| [suffix](#input\_include\_folders) | folders to include for organization in the format 'folders/{folder_id}'. i.e: folders/123456789012 | `set(string)` | `[]` | no | +| [suffix](#input\_exclude\_folders) | folders to exclude for organization in the format 'folders/{folder_id}'. i.e: folders/123456789012 | `set(string)` | `[]` | no | +| [suffix](#input\_include\_projects) | projects to include for organization. i.e: my-project-id | `set(string)` | `[]` | no | +| [suffix](#input\_exclude\_projects) | projects to exclude for organization. i.e: my-project-id | `set(string)` | `[]` | no | @@ -71,6 +75,11 @@ No modules. | [is\_organizational](#output\_is\_organizational) | Boolean value to indicate if secure-for-cloud is deployed to an entire GCP organization or not | | [organization\_domain](#output\_organization\_domain) | Organization domain of the GCP org being onboarded | | [project\_id](#output\_project\_id) | The management project id chosen during install, where global resources are deployed | +| [suffix](#output\_include\_folders) | folders to include for organization | +| [suffix](#output\_exclude\_folders) | folders to exclude for organization | +| [suffix](#output\_include\_projects) | projects to include for organization | +| [suffix](#output\_exclude\_projects) | projects to exclude for organization | + ## Authors diff --git a/modules/onboarding/locals.tf b/modules/onboarding/locals.tf new file mode 100644 index 0000000..61ae251 --- /dev/null +++ b/modules/onboarding/locals.tf @@ -0,0 +1,34 @@ +locals { + # check if both old and new include/exclude org parameters are used, we fail early + both_org_configuration_params = var.is_organizational && length(var.management_group_ids) > 0 && ( + length(var.include_folders) > 0 || + length(var.exclude_folders) > 0 || + length(var.include_projects) > 0 || + length(var.exclude_projects) > 0 + ) + + # check if old management_group_ids parameter is provided, for backwards compatibility we will always give preference to it + check_old_management_group_ids_param = var.is_organizational && length(var.management_group_ids) > 0 + + # fetch the GCP root org + root_org = var.is_organizational ? [data.google_organization.org[0].name] : [] +} + +check "validate_org_configuration_params" { + assert { + condition = length(var.management_group_ids) == 0 # if this condition is false we throw warning + error_message = <<-EOT + WARNING: TO BE DEPRECATED 'management_group_ids': Please work with Sysdig to migrate your Terraform installs to use 'include_folders' instead. + EOT + } + + assert { + condition = !local.both_org_configuration_params # if this condition is false we throw error + error_message = <<-EOT + ERROR: If both management_group_ids and include_folders/exclude_folders/include_projects/exclude_projects variables are populated, + ONLY management_group_ids will be considered. Please use only one of the two methods. + + Note: management_group_ids is going to be DEPRECATED soon, please work with Sysdig to migrate your Terraform installs. + EOT + } +} \ No newline at end of file diff --git a/modules/onboarding/organizational.tf b/modules/onboarding/organizational.tf index 3c5f403..29a07ad 100644 --- a/modules/onboarding/organizational.tf +++ b/modules/onboarding/organizational.tf @@ -29,8 +29,13 @@ resource "google_organization_iam_member" "browser" { resource "sysdig_secure_organization" "google_organization" { count = var.is_organizational ? 1 : 0 - management_account_id = sysdig_secure_cloud_auth_account.google_account.id - organizational_unit_ids = var.management_group_ids + management_account_id = sysdig_secure_cloud_auth_account.google_account.id + organizational_unit_ids = local.check_old_management_group_ids_param ? var.management_group_ids : [] + organization_root_id = local.root_org[0] + included_organizational_groups = local.check_old_management_group_ids_param ? [] : var.include_folders + excluded_organizational_groups = local.check_old_management_group_ids_param ? [] : var.exclude_folders + included_cloud_accounts = local.check_old_management_group_ids_param ? [] : var.include_projects + excluded_cloud_accounts = local.check_old_management_group_ids_param ? [] : var.exclude_projects depends_on = [ google_organization_iam_member.browser, sysdig_secure_cloud_auth_account.google_account diff --git a/modules/onboarding/outputs.tf b/modules/onboarding/outputs.tf index 7db7f22..84c3a09 100644 --- a/modules/onboarding/outputs.tf +++ b/modules/onboarding/outputs.tf @@ -17,3 +17,23 @@ output "organization_domain" { value = var.organization_domain description = "Organization domain. e.g. sysdig.com" } + +output "include_folders" { + description = "folders to include for organization" + value = var.include_folders +} + +output "exclude_folders" { + description = "folders to exclude for organization" + value = var.exclude_folders +} + +output "include_projects" { + description = "projects to include for organization" + value = var.include_projects +} + +output "exclude_projects" { + description = "projects to exclude for organization" + value = var.exclude_projects +} \ No newline at end of file diff --git a/modules/onboarding/variables.tf b/modules/onboarding/variables.tf index 9571e7e..1b9ae3c 100644 --- a/modules/onboarding/variables.tf +++ b/modules/onboarding/variables.tf @@ -16,8 +16,12 @@ variable "organization_domain" { } variable "management_group_ids" { + description = <<-EOF + TO BE DEPRECATED: Please work with Sysdig to migrate to using `include_folders` instead. + When set, restrict onboarding to a set of folder identifiers whose child projects and projects are to be onboarded. + Default: onboard all folders. + EOF type = set(string) - description = "(Optional) Management group id to onboard. e.g. [organizations/123456789012], [folders/123456789012]" default = [] } @@ -25,4 +29,28 @@ variable "suffix" { type = string description = "Suffix to uniquely identify resources during multiple installs. If not provided, random value is autogenerated" default = null +} + +variable "include_folders" { + description = "(Optional) folders to include for organization in the format 'folders/{folder_id}' i.e: folders/123456789012" + type = set(string) + default = [] +} + +variable "exclude_folders" { + description = "(Optional) folders to exclude for organization in the format 'folders/{folder_id}' i.e: folders/123456789012" + type = set(string) + default = [] +} + +variable "include_projects" { + description = "(Optional) projects id to include for organization i.e: my-project-id" + type = set(string) + default = [] +} + +variable "exclude_projects" { + description = "(Optional) projects id to exclude for organization i.e: my-project-id" + type = set(string) + default = [] } \ No newline at end of file diff --git a/modules/onboarding/versions.tf b/modules/onboarding/versions.tf index adb6e1a..807c866 100644 --- a/modules/onboarding/versions.tf +++ b/modules/onboarding/versions.tf @@ -8,7 +8,7 @@ terraform { } sysdig = { source = "sysdiglabs/sysdig" - version = ">= 1.34.0" + version = ">= 1.34" } random = { source = "hashicorp/random" diff --git a/modules/vm-workload-scanning/README.md b/modules/vm-workload-scanning/README.md index d1ac2e1..aea0677 100644 --- a/modules/vm-workload-scanning/README.md +++ b/modules/vm-workload-scanning/README.md @@ -41,13 +41,13 @@ No modules. ### Inputs -| Name | Description | Type | Default | Required | -|------|----------------------------------------------------------------------------------------------------------------------------------|------|---------|:--------:| -| project_id | GCP Project ID | string | n/a | yes | -| is_organizational | Set this field to 'true' to deploy workload scanning to a GCP Organization. | bool | false | no | -| organization_domain | (Optional) Organization domain. e.g. sysdig.com | string | "" | no | -| role_name | Name for the Worker Role on the Customer infrastructure | string | "SysdigAgentlessWorkloadRole" | no | -| sysdig_secure_account_id | ID of the Sysdig Cloud Account to enable VM Workload Scanning for (in case of organization, ID of the Sysdig management account) | string | n/a | yes | +| Name | Description | Type | Default | Required | +|---------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------|---------------|-------------------------------|:--------:| +| project_id | GCP Project ID | string | n/a | yes | +| is_organizational | Set this field to 'true' to deploy workload scanning to a GCP Organization. | bool | false | no | +| organization_domain | (Optional) Organization domain. e.g. sysdig.com | string | "" | no | +| role_name | Name for the Worker Role on the Customer infrastructure | string | "SysdigAgentlessWorkloadRole" | no | +| sysdig_secure_account_id | ID of the Sysdig Cloud Account to enable VM Workload Scanning for (in case of organization, ID of the Sysdig management account) | string | n/a | yes | ### Outputs diff --git a/test/examples/modular_organization/onboarding_with_posture.tf b/test/examples/modular_organization/onboarding_with_posture.tf index 3b73142..2915f34 100644 --- a/test/examples/modular_organization/onboarding_with_posture.tf +++ b/test/examples/modular_organization/onboarding_with_posture.tf @@ -2,7 +2,7 @@ terraform { required_providers { sysdig = { source = "sysdiglabs/sysdig" - version = "~> 1.34.0" + version = "~> 1.34" } } } @@ -22,6 +22,15 @@ module "onboarding" { project_id = "org-child-project-3" is_organizational = true organization_domain = "draios.com" + + # legacy include/exclude org install params + # management_group_ids = ["folders/123456789012"] + + # include/exclude parameters + include_folders = ["folders/123456789012"] + exclude_folders = [] + include_projects = ["", ""] + exclude_projects = ["", ""] } module "config-posture" { @@ -47,7 +56,7 @@ resource "sysdig_secure_cloud_auth_account_feature" "identity_entitlement_basic" components = [module.config-posture.service_principal_component_id] depends_on = [module.config-posture, sysdig_secure_cloud_auth_account_feature.config_posture] flags = { - "CIEM_FEATURE_MODE": "basic" + "CIEM_FEATURE_MODE" : "basic" } lifecycle { diff --git a/test/examples/modular_single_project/onboarding_with_posture.tf b/test/examples/modular_single_project/onboarding_with_posture.tf index 81d241e..9cabef2 100644 --- a/test/examples/modular_single_project/onboarding_with_posture.tf +++ b/test/examples/modular_single_project/onboarding_with_posture.tf @@ -2,7 +2,7 @@ terraform { required_providers { sysdig = { source = "sysdiglabs/sysdig" - version = "~> 1.34.0" + version = "~> 1.34" } } }