Skip to content

Commit 3a25e15

Browse files
jose-pablo-camachojose-pablo-camacho
authored
SSPROD-49726 - add(oracle): initial modules onboarding/config-posture (#2)
* add(oracle): initial modules onboarding/config-posture * add(oracle): initial modules onboarding/config-posture * add(oracle): initial modules onboarding/config-posture * add(oracle): initial modules onboarding/config-posture * add(oracle): initial modules onboarding/config-posture * add(oracle): initial modules onboarding/config-posture * add(oracle): initial modules onboarding/config-posture * add(oracle): initial modules onboarding/config-posture * add(oracle): initial modules onboarding/config-posture * add(oracle): initial modules onboarding/config-posture
1 parent 1933c29 commit 3a25e15

File tree

13 files changed

+466
-0
lines changed

13 files changed

+466
-0
lines changed

‎modules/config-posture/README.md‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# Oracle Cloud Config Posture Module
2+
3+
This module will deploy Config Posture resources in Oracle for a compartment or root tenancy.
4+
5+
The following resources will be created in each instrumented compartment/tenancy:
6+
7+
- An Admit Policy on the target tenant that will allow sysdig tenant to `read` all-resources in the specified
8+
compartment/tenancy.
9+
- A cloud account component in the Sysdig Backend, associated with the specified compartment/tenant and with the
10+
required metadata to serve the Config Posture functions.
11+
12+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
13+
14+
## Requirements
15+
16+
| Name | Version |
17+
|---------------------------------------------------------------------------|---------|
18+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
19+
| <a name="requirement_oci"></a> [oci](#requirement\_oci) | >= 6.19.0 |
20+
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | ~> 1.42 |
21+
22+
## Providers
23+
24+
| Name | Version |
25+
|------------------------------------------------------------|---------|
26+
| <a name="provider_oci"></a> [oci](#provider\_oci) | 6.19.0 |
27+
| <a name="provider_random"></a> [random](#provider\_random) | >= 3.1 |
28+
29+
## Modules
30+
31+
No modules.
32+
33+
## Resources
34+
35+
| [oci_identity_compartment.compartment](https://registry.terraform.io/providers/oracle/oci/latest/docs/resources/identity_compartment) |
36+
data source |
37+
| [random_id.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
38+
| [oci_identity_policy.admit_cspm_policy](https://registry.terraform.io/providers/oracle/oci/latest/docs/resources/identity_policy) |
39+
resource |
40+
| [sysdig_secure_cloud_auth_account_component.oracle_service_principal](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/resources/secure_cloud_auth_account_component) |
41+
resource |
42+
43+
## Inputs
44+
45+
| Name | Description | Type | Default | Required |
46+
|------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|----------|------------------|:--------:|
47+
| <a name="input_is_organizational"></a> [is\_organizational](#input\_is\_organizational) | (Optional) True/False whether secure-for-cloud should be deployed in an organizational setup | `bool` | `false` | no |
48+
| <a name="input_tenancy_ocid"></a> [tenancy\_ocid](#input\_tenancy\_ocid) | (Required) Customer tenant OCID | `string` | n/a | yes |
49+
| <a name="input_compartment_ocid"></a> [compartment\_ocid](#input\_compartment\_ocid) | (Optional) Customer compartment OCID | `string` | `""` | no |
50+
| <a name="input_sysdig_secure_account_id"></a> [sysdig\_secure\_account\_id](#input\_sysdig\_secure\_account\_id) | (Required) ID of the Sysdig Cloud Account to enable Config Posture for (in case of organization, ID of the Sysdig management account) | `string` | n/a | yes |
51+
52+
## Outputs
53+
54+
| Name | Description |
55+
|----------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------|
56+
| <a name="output_service_principal_component_id"></a> [sysdig\_service\_principal\_component\_id](#output\_service\_principal\_component\_id) | Component identifier of Service Principal created in Sysdig Backend for Config Posture |
57+
58+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
59+
60+
## Authors
61+
62+
Module is maintained by [Sysdig](https://sysdig.com).
63+
64+
## License
65+
66+
Apache 2 Licensed. See LICENSE for full details.

‎modules/config-posture/main.tf‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
#-----------------------------------------------------------------------------------------
2+
# Fetch the data sources
3+
#-----------------------------------------------------------------------------------------
4+
5+
data "sysdig_secure_trusted_oracle_app" "config_posture" {
6+
name = "config_posture"
7+
}
8+
9+
// compartment data to populate policies if onboarding a compartment
10+
data "oci_identity_compartment" "compartment" {
11+
count = var.compartment_ocid != "" ? 1 : 0
12+
id = var.compartment_ocid
13+
}
14+
15+
16+
// random suffix for policy name
17+
resource "random_id" "suffix" {
18+
byte_length = 3
19+
}
20+
21+
#-----------------------------------------------------------------------------------------
22+
# Admit policy to allow Sysdig Tenant to read resources
23+
#-----------------------------------------------------------------------------------------
24+
25+
resource "oci_identity_policy" "admit_cspm_policy" {
26+
name = "AdmitSysdigSecureTenantConfigPosture-${random_id.suffix.hex}"
27+
description = "Config Posture policy to allow read all resources in tenant/compartment"
28+
compartment_id = var.tenancy_ocid
29+
statements = [
30+
"Define tenancy sysdigTenancy as ${data.sysdig_secure_trusted_oracle_app.config_posture.tenancy_ocid}",
31+
"Define group configPostureGroup as ${data.sysdig_secure_trusted_oracle_app.config_posture.group_ocid}",
32+
var.compartment_ocid != "" ?
33+
"Admit group configPostureGroup of tenancy sysdigTenancy to read all-resources in compartment ${data.oci_identity_compartment.compartment[0].name}"
34+
:
35+
"Admit group configPostureGroup of tenancy sysdigTenancy to read all-resources in tenancy",
36+
]
37+
}
38+
39+
#--------------------------------------------------------------------------------------------------------------
40+
# Call Sysdig Backend to add the service-principal integration for Config Posture to the Sysdig Cloud Account
41+
#--------------------------------------------------------------------------------------------------------------
42+
resource "sysdig_secure_cloud_auth_account_component" "oracle_service_principal" {
43+
account_id = var.sysdig_secure_account_id
44+
type = "COMPONENT_SERVICE_PRINCIPAL"
45+
instance = "secure-posture"
46+
version = "v0.1.0"
47+
service_principal_metadata = jsonencode({
48+
oci = {
49+
api_key = {
50+
user_id = data.sysdig_secure_trusted_oracle_app.config_posture.user_ocid
51+
}
52+
policy = {
53+
policy_id = oci_identity_policy.admit_cspm_policy.id
54+
}
55+
}
56+
})
57+
depends_on = [
58+
oci_identity_policy.admit_cspm_policy
59+
]
60+
}

‎modules/config-posture/outputs.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
output "service_principal_component_id" {
2+
value = "${sysdig_secure_cloud_auth_account_component.oracle_service_principal.type}/${sysdig_secure_cloud_auth_account_component.oracle_service_principal.instance}"
3+
description = "Component identifier of Service Principal created in Sysdig Backend for Config Posture"
4+
depends_on = [sysdig_secure_cloud_auth_account_component.oracle_service_principal]
5+
}

‎modules/config-posture/variables.tf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
variable "is_organizational" {
2+
type = bool
3+
default = false
4+
description = "(Optional) True/False whether secure-for-cloud should be deployed in an organizational setup"
5+
}
6+
7+
variable "tenancy_ocid" {
8+
type = string
9+
description = "(Required) Customer tenant OCID"
10+
}
11+
12+
variable "compartment_ocid" {
13+
type = string
14+
default = ""
15+
description = "(Optional) Customer compartment OCID"
16+
}
17+
18+
variable "sysdig_secure_account_id" {
19+
type = string
20+
description = "(Required) ID of the Sysdig Cloud Account to enable Config Posture for (in case of organization, ID of the Sysdig management account)"
21+
}

‎modules/config-posture/versions.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
terraform {
2+
required_version = ">= 1.0.0"
3+
required_providers {
4+
sysdig = {
5+
source = "sysdiglabs/sysdig"
6+
version = "~> 1.42"
7+
}
8+
oci = {
9+
source = "hashicorp/oci"
10+
}
11+
}
12+
}

‎modules/onboarding/README.md‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# Oracle Cloud Onboarding Module
2+
3+
This module will deploy foundational onboarding resources in Oracle for a compartment or root tenancy.
4+
5+
The following resources will be created in each instrumented compartment/tenancy:
6+
7+
- An Admit Policy on the target tenant that will allow sysdig tenant to `inspect` compartments in the specified
8+
compartment/tenancy.
9+
- A cloud account in the Sysdig Backend, associated with the specified compartment/tenant and with the required
10+
component to serve the foundational functions.
11+
- A cloud organization in the Sysdig Backend, associated with the specified compartment/tenant to fetch the organization
12+
structure(compartment tree) to install Sysdig Secure for Cloud.
13+
14+
Note:
15+
16+
- The outputs from the foundational module, such as `sysdig_secure_account_id` are needed as inputs to the other
17+
features/integrations modules for subsequent modular installations.
18+
19+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
20+
21+
## Requirements
22+
23+
| Name | Version |
24+
|---------------------------------------------------------------------------|---------|
25+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
26+
| <a name="requirement_oci"></a> [oci](#requirement\_oci) | >= 6.19.0 |
27+
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | ~> 1.42 |
28+
29+
## Providers
30+
31+
| Name | Version |
32+
|------------------------------------------------------------|---------|
33+
| <a name="provider_oci"></a> [oci](#provider\_oci) | 6.19.0 |
34+
| <a name="provider_random"></a> [random](#provider\_random) | >= 3.1 |
35+
36+
## Modules
37+
38+
No modules.
39+
40+
## Resources
41+
42+
| [oci_identity_compartment.compartment](https://registry.terraform.io/providers/oracle/oci/latest/docs/resources/identity_compartment) |
43+
data source |
44+
| [random_id.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
45+
| [oci_identity_policy.admit_onboarding_policy](https://registry.terraform.io/providers/oracle/oci/latest/docs/resources/identity_policy) |
46+
resource |
47+
| [sysdig_secure_cloud_auth_account.oracle_account](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/resources/secure_cloud_auth_account) |
48+
resource |
49+
| [sysdig_secure_organization.oracle_organization](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/resources/secure_organization) |
50+
resource |
51+
52+
## Inputs
53+
54+
| Name | Description | Type | Default | Required |
55+
|-----------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------|----------|------------------|:--------:|
56+
| <a name="input_is_organizational"></a> [is\_organizational](#input\_is\_organizational) | (Optional) True/False whether secure-for-cloud should be deployed in an organizational setup | `bool` | `false` | no |
57+
| <a name="input_tenancy_ocid"></a> [tenancy\_ocid](#input\_tenancy\_ocid) | (Required) Customer tenant OCID | `string` | n/a | yes |
58+
| <a name="input_compartment_ocid"></a> [compartment\_ocid](#input\_compartment\_ocid) | (Optional) Customer compartment OCID | `string` | `""` | no |
59+
60+
## Outputs
61+
62+
| Name | Description |
63+
|--------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------|
64+
| <a name="output_sysdig_secure_account_id"></a> [sysdig\_secure\_account\_id](#output\_sysdig\_secure\_account\_id) | ID of the Sysdig Cloud Account created |
65+
| <a name="output_is_organizational"></a> [is\_organizational](#output\_is\_organizational) | Boolean value to indicate if secure-for-cloud is deployed as an organization |
66+
| <a name="output_tenancy_ocid"></a> [tenancy\_ocid](#output\_tenancy\_ocid) | Customer tenant OCID |
67+
| <a name="output_compartment_ocid"></a> [compartment\_ocid](#output_compartment\_ocid) | Customer compartment OCID |
68+
69+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
70+
71+
## Authors
72+
73+
Module is maintained by [Sysdig](https://sysdig.com).
74+
75+
## License
76+
77+
Apache 2 Licensed. See LICENSE for full details.

‎modules/onboarding/main.tf‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
#-----------------------------------------------------------------------------------------
2+
# Fetch the data sources
3+
#-----------------------------------------------------------------------------------------
4+
5+
data "sysdig_secure_trusted_oracle_app" "onboarding" {
6+
name = "onboarding"
7+
}
8+
9+
// compartment data to populate policies if onboarding a compartment
10+
data "oci_identity_compartment" "compartment" {
11+
count = var.compartment_ocid != "" ? 1 : 0
12+
id = var.compartment_ocid
13+
}
14+
15+
16+
// random suffix for policy name
17+
resource "random_id" "suffix" {
18+
byte_length = 3
19+
}
20+
21+
#-----------------------------------------------------------------------------------------
22+
# Admit policy to allow Sysdig Tenant to read resources
23+
#-----------------------------------------------------------------------------------------
24+
25+
resource "oci_identity_policy" "admit_onboarding_policy" {
26+
name = "AdmitSysdigSecureTenantOnboarding-${random_id.suffix.hex}"
27+
description = "Onboarding policy to allow inspect compartments in tenant/compartment"
28+
compartment_id = var.tenancy_ocid
29+
statements = [
30+
"Define tenancy sysdigTenancy as ${data.sysdig_secure_trusted_oracle_app.onboarding.tenancy_ocid}",
31+
"Define group onboardingGroup as ${data.sysdig_secure_trusted_oracle_app.onboarding.group_ocid}",
32+
"Admit group onboardingGroup of tenancy sysdigTenancy to inspect tenancies in tenancy",
33+
var.compartment_ocid != "" ?
34+
"Admit group onboardingGroup of tenancy sysdigTenancy to inspect compartments in compartment ${data.oci_identity_compartment.compartment[0].name}"
35+
:
36+
"Admit group onboardingGroup of tenancy sysdigTenancy to inspect compartments in tenancy",
37+
]
38+
}
39+
40+
41+
#---------------------------------------------------------------------------------------------
42+
# Call Sysdig Backend to create account with foundational onboarding
43+
# (ensure it is called after all above cloud resources are created using explicit depends_on)
44+
#---------------------------------------------------------------------------------------------
45+
resource "sysdig_secure_cloud_auth_account" "oracle_account" {
46+
enabled = true
47+
provider_tenant_id = var.tenancy_ocid // tenancy ocid
48+
// when compartmentID is not specified, default to the rootCompartmentOCID which is the same value as tenancyOCID
49+
provider_id = var.compartment_ocid == "" ? var.tenancy_ocid : var.compartment_ocid
50+
provider_type = "PROVIDER_ORACLECLOUD"
51+
52+
component {
53+
type = "COMPONENT_SERVICE_PRINCIPAL"
54+
instance = "secure-onboarding"
55+
version = "v0.1.0"
56+
service_principal_metadata = jsonencode({
57+
oci = {
58+
api_key = {
59+
user_id = data.sysdig_secure_trusted_oracle_app.onboarding.user_ocid
60+
}
61+
policy = {
62+
policy_id = oci_identity_policy.admit_onboarding_policy.id
63+
}
64+
}
65+
})
66+
}
67+
68+
lifecycle {
69+
# features and components are managed outside this module
70+
ignore_changes = [
71+
component,
72+
feature
73+
]
74+
}
75+
depends_on = [
76+
oci_identity_policy.admit_onboarding_policy
77+
]
78+
}

‎modules/onboarding/organizational.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#---------------------------------------------------------------------------------------------
2+
# Call Sysdig Backend to create organization with foundational onboarding
3+
# (ensure it is called after all above cloud resources are created)
4+
#---------------------------------------------------------------------------------------------
5+
resource "sysdig_secure_organization" "oracle_organization" {
6+
count = var.is_organizational ? 1 : 0
7+
management_account_id = sysdig_secure_cloud_auth_account.oracle_account.id
8+
depends_on = [
9+
oci_identity_policy.admit_onboarding_policy,
10+
sysdig_secure_cloud_auth_account.oracle_account
11+
]
12+
}

‎modules/onboarding/outputs.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
output "tenancy_ocid" {
2+
value = var.tenancy_ocid
3+
description = "Customer tenancy OCID"
4+
}
5+
6+
output "compartment_ocid" {
7+
value = var.compartment_ocid
8+
description = "Customer compartment OCID"
9+
}
10+
11+
output "sysdig_secure_account_id" {
12+
value = sysdig_secure_cloud_auth_account.oracle_account.id
13+
description = "ID of the Sysdig Cloud Account created"
14+
}
15+
16+
output "is_organizational" {
17+
value = var.is_organizational
18+
description = "Boolean value to indicate if secure-for-cloud is deployed to an entire Oracle organization or not"
19+
}

‎modules/onboarding/variables.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
variable "is_organizational" {
2+
type = bool
3+
default = false
4+
description = "(Optional) True/False whether secure-for-cloud should be deployed in an organizational setup"
5+
}
6+
7+
variable "tenancy_ocid" {
8+
type = string
9+
description = "(Required) Customer tenant OCID"
10+
}
11+
12+
variable "compartment_ocid" {
13+
type = string
14+
default = ""
15+
description = "(Optional) Customer compartment OCID"
16+
}
17+

0 commit comments

Comments
 (0)