Skip to content

Commit 68f8259

Browse files
author
Ben Lucas
authored
feat(policies): Data Source for managed policies (#333)
* add data source for managed policies * add documentation and fix tests * reuse function for getting managed policy
1 parent 7f65882 commit 68f8259

File tree

7 files changed

+316
-5
lines changed

7 files changed

+316
-5
lines changed

‎sysdig/data_source_sysdig_secure_managed_policy.go‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
package sysdig
2+
3+
import (
4+
"context"
5+
"time"
6+
7+
"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
8+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
9+
)
10+
11+
func dataSourceSysdigSecureManagedPolicy() *schema.Resource {
12+
timeout := 5 * time.Minute
13+
14+
return &schema.Resource{
15+
ReadContext: dataSourceSysdigManagedPolicyRead,
16+
17+
Timeouts: &schema.ResourceTimeout{
18+
Read: schema.DefaultTimeout(timeout),
19+
},
20+
21+
Schema: createPolicyDataSourceSchema(),
22+
}
23+
}
24+
25+
func dataSourceSysdigManagedPolicyRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
26+
client, err := getSecurePolicyClient(meta.(SysdigClients))
27+
if err != nil {
28+
return diag.FromErr(err)
29+
}
30+
31+
policyName := d.Get("name").(string)
32+
policyType := d.Get("type").(string)
33+
34+
policy, err := getManagedPolicy(ctx, client, policyName, policyType)
35+
if err != nil {
36+
return diag.FromErr(err)
37+
}
38+
39+
loadedPolicy, _, err := client.GetPolicyByID(ctx, policy.ID)
40+
if err != nil {
41+
return diag.FromErr(err)
42+
}
43+
44+
policyDataSourceToResourceData(loadedPolicy, d)
45+
46+
return nil
47+
}

‎sysdig/data_source_sysdig_secure_managed_policy_test.go‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
//go:build tf_acc_sysdig || tf_acc_sysdig_secure
2+
3+
package sysdig_test
4+
5+
import (
6+
"os"
7+
"testing"
8+
9+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
10+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
11+
12+
"github.com/draios/terraform-provider-sysdig/sysdig"
13+
)
14+
15+
func TestAccManagedPolicyDataSource(t *testing.T) {
16+
resource.ParallelTest(t, resource.TestCase{
17+
PreCheck: func() {
18+
if v := os.Getenv("SYSDIG_SECURE_API_TOKEN"); v == "" {
19+
t.Fatal("SYSDIG_SECURE_API_TOKEN must be set for acceptance tests")
20+
}
21+
},
22+
ProviderFactories: map[string]func() (*schema.Provider, error){
23+
"sysdig": func() (*schema.Provider, error) {
24+
return sysdig.Provider(), nil
25+
},
26+
},
27+
Steps: []resource.TestStep{
28+
{
29+
Config: managedPolicyDataSource(),
30+
},
31+
},
32+
})
33+
}
34+
35+
func managedPolicyDataSource() string {
36+
return `
37+
data "sysdig_secure_managed_policy" "example" {
38+
name = "Sysdig Runtime Threat Detection"
39+
type = "falco"
40+
}
41+
`
42+
}

‎sysdig/data_source_sysdig_secure_policy.go‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
package sysdig
2+
3+
import (
4+
"strconv"
5+
"strings"
6+
7+
v2 "github.com/draios/terraform-provider-sysdig/sysdig/internal/client/v2"
8+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
9+
)
10+
11+
func createPolicyDataSourceSchema() map[string]*schema.Schema {
12+
return map[string]*schema.Schema{
13+
"name": {
14+
Type: schema.TypeString,
15+
Required: true,
16+
},
17+
"type": {
18+
Type: schema.TypeString,
19+
Optional: true,
20+
Default: "falco",
21+
ValidateDiagFunc: validateDiagFunc(validatePolicyType),
22+
},
23+
"id": {
24+
Type: schema.TypeInt,
25+
Computed: true,
26+
},
27+
"description": {
28+
Type: schema.TypeString,
29+
Computed: true,
30+
},
31+
"severity": {
32+
Type: schema.TypeInt,
33+
Computed: true,
34+
},
35+
"enabled": {
36+
Type: schema.TypeBool,
37+
Computed: true,
38+
},
39+
"runbook": {
40+
Type: schema.TypeString,
41+
Optional: true,
42+
},
43+
"scope": {
44+
Type: schema.TypeString,
45+
Computed: true,
46+
},
47+
"rules": {
48+
Type: schema.TypeList,
49+
Computed: true,
50+
Elem: &schema.Resource{
51+
Schema: map[string]*schema.Schema{
52+
"name": {
53+
Type: schema.TypeString,
54+
Computed: true,
55+
},
56+
"enabled": {
57+
Type: schema.TypeBool,
58+
Computed: true,
59+
},
60+
},
61+
},
62+
},
63+
"notification_channels": {
64+
Type: schema.TypeSet,
65+
Computed: true,
66+
Elem: &schema.Schema{
67+
Type: schema.TypeInt,
68+
},
69+
},
70+
"actions": {
71+
Type: schema.TypeList,
72+
Computed: true,
73+
Optional: true,
74+
Elem: &schema.Resource{
75+
Schema: map[string]*schema.Schema{
76+
"container": {
77+
Type: schema.TypeString,
78+
Optional: true,
79+
Computed: true,
80+
},
81+
"capture": {
82+
Type: schema.TypeList,
83+
Optional: true,
84+
Computed: true,
85+
Elem: &schema.Resource{
86+
Schema: map[string]*schema.Schema{
87+
"seconds_after_event": {
88+
Type: schema.TypeInt,
89+
Computed: true,
90+
},
91+
"seconds_before_event": {
92+
Type: schema.TypeInt,
93+
Computed: true,
94+
},
95+
"name": {
96+
Type: schema.TypeString,
97+
Computed: true,
98+
},
99+
},
100+
},
101+
},
102+
},
103+
},
104+
},
105+
}
106+
}
107+
108+
func policyDataSourceToResourceData(policy v2.Policy, d *schema.ResourceData) {
109+
d.SetId(strconv.Itoa(policy.ID))
110+
111+
_ = d.Set("name", policy.Name)
112+
if policy.Type != "" {
113+
_ = d.Set("type", policy.Type)
114+
} else {
115+
_ = d.Set("type", "falco")
116+
}
117+
118+
_ = d.Set("description", policy.Description)
119+
_ = d.Set("severity", policy.Severity)
120+
_ = d.Set("enabled", policy.Enabled)
121+
_ = d.Set("scope", policy.Scope)
122+
_ = d.Set("notification_channels", policy.NotificationChannelIds)
123+
_ = d.Set("runbook", policy.Runbook)
124+
125+
actions := []map[string]interface{}{{}}
126+
for _, action := range policy.Actions {
127+
if action.Type != "POLICY_ACTION_CAPTURE" {
128+
action := strings.Replace(action.Type, "POLICY_ACTION_", "", 1)
129+
actions[0]["container"] = strings.ToLower(action)
130+
//d.Set("actions.0.container", strings.ToLower(action))
131+
} else {
132+
actions[0]["capture"] = []map[string]interface{}{{
133+
"seconds_after_event": action.AfterEventNs / 1000000000,
134+
"seconds_before_event": action.BeforeEventNs / 1000000000,
135+
"name": action.Name,
136+
}}
137+
}
138+
}
139+
140+
_ = d.Set("actions", actions)
141+
142+
rules := []map[string]interface{}{}
143+
144+
for _, rule := range policy.Rules {
145+
rules = append(rules, map[string]interface{}{
146+
"name": rule.Name,
147+
"enabled": rule.Enabled,
148+
})
149+
}
150+
151+
_ = d.Set("rules", rules)
152+
}

‎sysdig/provider.go‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -126,9 +126,11 @@ func Provider() *schema.Provider {
126126
DataSourcesMap: map[string]*schema.Resource{
127127
"sysdig_secure_trusted_cloud_identity": dataSourceSysdigSecureTrustedCloudIdentity(),
128128
"sysdig_secure_notification_channel": dataSourceSysdigSecureNotificationChannel(),
129-
"sysdig_current_user": dataSourceSysdigCurrentUser(),
130-
"sysdig_user": dataSourceSysdigUser(),
131-
"sysdig_secure_connection": dataSourceSysdigSecureConnection(),
129+
"sysdig_secure_managed_policy": dataSourceSysdigSecureManagedPolicy(),
130+
131+
"sysdig_current_user": dataSourceSysdigCurrentUser(),
132+
"sysdig_user": dataSourceSysdigUser(),
133+
"sysdig_secure_connection": dataSourceSysdigSecureConnection(),
132134

133135
"sysdig_fargate_workload_agent": dataSourceSysdigFargateWorkloadAgent(),
134136
"sysdig_monitor_notification_channel_pagerduty": dataSourceSysdigMonitorNotificationChannelPagerduty(),

‎website/docs/d/secure_managed_policy.md‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
---
2+
subcategory: "Sysdig Secure"
3+
layout: "sysdig"
4+
page_title: "Sysdig: sysdig_secure_managed_policy"
5+
description: |-
6+
Retrieves a Sysdig Secure Managed Policy.
7+
---
8+
9+
# sysdig_secure_managed_policy
10+
11+
Retrieves the information of an existing Sysdig Secure Managed Policy.
12+
13+
-> **Note:** Sysdig Terraform Provider is under rapid development at this point. If you experience any issue or discrepancy while using it, please make sure you have the latest version. If the issue persists, or you have a Feature Request to support an additional set of resources, please open a [new issue](https://github.com/sysdiglabs/terraform-provider-sysdig/issues/new) in the GitHub repository.
14+
15+
## Example Usage
16+
17+
```terraform
18+
data "sysdig_secure_notification_channel" "sample-email" {
19+
name = "Sysdig Runtime Threat Detection"
20+
type = "falco"
21+
}
22+
```
23+
24+
## Argument Reference
25+
26+
* `name` - (Required) The name of the Secure managed policy.
27+
28+
* `type` - (Optional) Specifies the type of the runtime policy. Must be one of: `falco`, `list_matching`, `k8s_audit`,
29+
`aws_cloudtrail`, `gcp_auditlog`, `azure_platformlogs`. By default it is `falco`.
30+
31+
## Attributes Reference
32+
33+
In addition to all arguments above, the following attributes are exported:
34+
35+
* `id` - The id for the managed policy.
36+
37+
* `description` - The description for the managed policy.
38+
39+
* `severity` - The severity of Secure policy. The accepted values
40+
are: 0, 1, 2, 3 (High), 4, 5 (Medium), 6 (Low) and 7 (Info).
41+
42+
* `enabled` - Whether the policy is enabled or not.
43+
44+
* `runbook` - Customer provided url that provides a runbook for a given policy.
45+
46+
* `scope` - The application scope for the policy.
47+
48+
* `rules` - An array of rules with the properties `name` and `enabled` to identify the rule name and whether it is enabled.
49+
50+
* `notification_channels` - IDs of the notification channels to send alerts to
51+
when the policy is fired.
52+
53+
### Actions block
54+
55+
The actions block is optional and supports:
56+
57+
* `container` - (Optional) The action applied to container when this Policy is
58+
triggered. Can be *stop*, *pause* or *kill*. If this is not specified,
59+
no action will be applied at the container level.
60+
61+
* `capture` - (Optional) Captures with Sysdig the stream of system calls:
62+
* `seconds_before_event` - (Required) Captures the system calls during the
63+
amount of seconds before the policy was triggered.
64+
* `seconds_after_event` - (Required) Captures the system calls for the amount
65+
of seconds after the policy was triggered.
66+
* `name` - (Optional) The name of the capture file

‎website/docs/r/secure_managed_policy.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@ resource "sysdig_secure_managed_policy" "sysdig_runtime_threat_detection" {
4646

4747
* `name` - (Required) The name of the Secure managed policy. It must match the name of an existing managed policy.
4848

49-
* `type` - (Optional) Specifies the type of the runtime policy. Must be one of: `falco`, `list_matching`, `k8s_audit`, `aws_cloudtrail`. By default it is `falco`.
49+
* `type` - (Optional) Specifies the type of the runtime policy. Must be one of: `falco`, `list_matching`, `k8s_audit`,
50+
`aws_cloudtrail`, `gcp_auditlog`, `azure_platformlogs`. By default it is `falco`.
5051

5152
* `enabled` - (Optional) Will secure process with this policy?. By default this is true.
5253

‎website/docs/r/secure_policy.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,8 @@ resource "sysdig_secure_policy" "write_apt_database" {
5252

5353
* `enabled` - (Optional) Will secure process with this rule?. By default this is true.
5454

55-
* `type` - (Optional) Specifies the type of the runtime policy. Must be one of: `falco`, `list_matching`, `k8s_audit`, `aws_cloudtrail`. By default it is `falco`.
55+
* `type` - (Optional) Specifies the type of the runtime policy. Must be one of: `falco`, `list_matching`, `k8s_audit`,
56+
`aws_cloudtrail`, `gcp_auditlog`, `azure_platformlogs`. By default it is `falco`.
5657

5758
* `runbook` - (Optional) Customer provided url that provides a runbook for a given policy.
5859
- - -

0 commit comments

Comments
 (0)