SSPROD-51715 - fix(oci): add cspm user in customer tenant to support identity resources

modules/config-posture/main.tf

@@ -18,6 +18,54 @@ resource "random_id" "suffix" {
   byte_length = 3
 }
 
+#-----------------------------------------------------------------------------------------
+# Create Group, User and Group Membership
+#-----------------------------------------------------------------------------------------
+resource "oci_identity_group" "cspm_group" {
+  name           = "SysdigSecureConfigPostureGroup-${random_id.suffix.hex}"
+  description    = "Sysdig Secure CSPM Group"
+  compartment_id = var.tenancy_ocid
+}
+
+resource "oci_identity_user" "cspm_user" {
+  name           = "SysdigSecureConfigPostureUser-${random_id.suffix.hex}"
+  description    = "Sysdig Secure CSPM User"
+  compartment_id = var.tenancy_ocid
+  email          = var.email
+}
+
+resource "oci_identity_user_group_membership" "cspm_user_to_group" {
+  user_id  = oci_identity_user.cspm_user.id
+  group_id = oci_identity_group.cspm_group.id
+}
+
+#-----------------------------------------------------------------------------------------
+# Create RSA key for user
+#-----------------------------------------------------------------------------------------
+
+resource "tls_private_key" "rsa_key" {
+  count     = var.private_key_file_path == "" && var.public_key_file_path == "" ? 1 : 0
+  algorithm = "RSA"
+  rsa_bits  = 2048
+}
+
+resource "oci_identity_api_key" "cspm_user_api_key" {
+  user_id   = oci_identity_user.cspm_user.id
+  key_value = (var.public_key_file_path == "" && var.private_key_file_path == "") ? tls_private_key.rsa_key[0].public_key_pem : file(var.public_key_file_path)
+}
+
+#-----------------------------------------------------------------------------------------
+# Allow policy to allow user to read resources
+#-----------------------------------------------------------------------------------------
+
+resource "oci_identity_policy" "cspm_policy" {
+  name           = "AllowSysdigSecureTenantConfigPosture-${random_id.suffix.hex}"
+  description    = "Config Posture allow policy to read all resources in tenant"
+  compartment_id = var.tenancy_ocid
+  statements = [
+    "Allow group ${oci_identity_group.cspm_group.name} to read all-resources in tenancy",
+  ]
+}
 #-----------------------------------------------------------------------------------------
 # Admit policy to allow Sysdig Tenant to read resources
 #-----------------------------------------------------------------------------------------
@@ -44,8 +92,10 @@ resource "sysdig_secure_cloud_auth_account_component" "oracle_service_principal"
   service_principal_metadata = jsonencode({
     oci = {
       api_key = {
-        user_id = data.sysdig_secure_trusted_oracle_app.config_posture.user_ocid
-        region = var.region
+        user_id     = oci_identity_user.cspm_user.id
+        region      = var.region
+#         fingerprint = oci_identity_api_key.cspm_user_api_key.fingerprint
+#         private_key = (var.public_key_file_path == "" && var.private_key_file_path == "") ? base64encode(tls_private_key.rsa_key[0].private_key_pem) : base64encode(file(var.private_key_file_path))
       }
       policy = {
         policy_id = oci_identity_policy.admit_cspm_policy.id
@@ -55,4 +105,4 @@ resource "sysdig_secure_cloud_auth_account_component" "oracle_service_principal"
   depends_on = [
     oci_identity_policy.admit_cspm_policy
   ]
-}
+}

modules/config-posture/variables.tf

@@ -21,6 +21,24 @@ variable "sysdig_secure_account_id" {
 }
 
 variable "region" {
-  type = string
+  type        = string
   description = "(Required) Customer home region"
+}
+
+variable "private_key_file_path" {
+  description = "Path to the private key file"
+  type        = string
+  default     = ""
+}
+
+variable "public_key_file_path" {
+  description = "Path to the public key file"
+  type        = string
+  default     = ""
+}
+
+variable "email" {
+  description = "Email for user created on customer tenant"
+  type        = string
+  default     = "[email protected]"
 }

modules/config-posture/versions.tf

@@ -6,7 +6,10 @@ terraform {
       version = "~> 1.43"
     }
     oci = {
-      source  = "oracle/oci"
+      source = "oracle/oci"
+    }
+    tls = {
+      source = "hashicorp/tls"
     }
   }
 }