Skip to content

Commit a214eb2

Browse files
hila-krut-sysdighila-krut-sysdig
authored
Merge branch 'master' into accept-posture-risk
2 parents cb01bf3 + 0c2b3cf commit a214eb2

35 files changed

+1154
-32
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ $ cd terraform-provider-sysdig
3535
$ make build
3636
```
3737

38-
If you're a rookie, check [Official Terraform Provider development guides](https://developer.hashicorp.com/terraform/plugin/frameworkO)
38+
If you're a rookie, check [Official Terraform Provider development guides](https://developer.hashicorp.com/terraform/plugin/framework)
3939

4040
### Creating new resource / data sources
4141

‎examples/serverless-agent/fargate/orchestrator/README.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Serverless Orchestrator Agent
2+
3+
This example deploys an AWS ECS Fargate cluster to run the Serverless Orchestrator Agent. This Agent acts as a proxy between the Collector and many Serverless Workload Agents.
4+
5+
## Prerequisites
6+
7+
The following AWS prerequisites are required to deploy this cluster:
8+
- VPC
9+
- 2 subnets
10+
11+
## Components
12+
13+
The cluster will be called `<prefix>-cluster` and will deploy the following:
14+
- 1 Service (called `OrchestratorAgent`)
15+
- 1 Task (with the latest version of the Serverless Orchestrator Agent)
16+
- Network Load balancer
17+
- Cloudwatch log group
18+
- Security group
19+
20+
## Layout
21+
| **File** | **Purpose** |
22+
| --- | --- |
23+
| `main.tf` | AWS provider configuration |
24+
| `orchestrator.tf` | Orchestrator cluster definition |
25+
| `output.tf` | Defines the output variables |
26+
| `variables.tf` | AWS and Agent configuration |
27+
| `versions.tf` | Defines TF provider versions |

‎examples/serverless-agent/fargate/orchestrator/orchestrator.tf‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
module "fargate-orchestrator-agent" {
2+
source = "sysdiglabs/fargate-orchestrator-agent/aws"
3+
version = "0.5.0"
4+
5+
vpc_id = var.vpc_id
6+
subnets = [var.subnet_1, var.subnet_2]
7+
8+
access_key = var.access_key
9+
10+
collector_host = var.collector_host
11+
collector_port = var.collector_port
12+
13+
name = var.prefix
14+
agent_image = var.agent_orchestrator_image
15+
16+
# True if the VPC uses an InternetGateway, false otherwise
17+
assign_public_ip = true
18+
19+
tags = var.tags
20+
}
21+
22+
23+
data "aws_ecs_cluster" "fargate-orchestrator" {
24+
depends_on = [
25+
module.fargate-orchestrator-agent
26+
]
27+
cluster_name = "${var.prefix}-cluster"
28+
}
29+
30+
data "aws_ecs_service" "orchestrator-service" {
31+
depends_on = [
32+
module.fargate-orchestrator-agent
33+
]
34+
service_name = "OrchestratorAgent"
35+
cluster_arn = data.aws_ecs_cluster.fargate-orchestrator.arn
36+
}

‎examples/serverless-agent/fargate/orchestrator/output.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
output "orchestrator_cluster_name" {
2+
value = data.aws_ecs_cluster.fargate-orchestrator.cluster_name
3+
}
4+
5+
output "orchestrator_cluster_arn" {
6+
value = data.aws_ecs_cluster.fargate-orchestrator.arn
7+
}
8+
9+
output "orchestrator_service_arn" {
10+
value = data.aws_ecs_service.orchestrator-service.arn
11+
}

‎examples/serverless-agent/fargate/orchestrator/providers.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
provider "aws" {
2+
region = var.region
3+
profile = var.profile
4+
}

‎examples/serverless-agent/fargate/orchestrator/variables.tf‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# AWS configuration
2+
variable "prefix" {
3+
description = "All resources created by Terraform have this prefix prepended to them"
4+
}
5+
6+
variable "profile" {
7+
description = "AWS profile name"
8+
type = string
9+
}
10+
11+
variable "region" {
12+
description = "AWS Region for deployment"
13+
default = "us-east-1"
14+
}
15+
16+
variable "subnet_1" {
17+
description = "Subnet-1 Id"
18+
}
19+
20+
variable "subnet_2" {
21+
description = "Subnet-2 Id"
22+
}
23+
24+
variable "vpc_id" {
25+
description = "VPC Id"
26+
}
27+
28+
variable "tags" {
29+
type = map(string)
30+
description = "Tags to assign to resources in module"
31+
default = {}
32+
}
33+
34+
# Serverless Agent Configuration
35+
variable "access_key" {
36+
description = "Sysdig Agent access key"
37+
}
38+
39+
variable "agent_orchestrator_image" {
40+
description = "Orchestrator Agent image to use"
41+
default = "quay.io/sysdig/orchestrator-agent:latest"
42+
}
43+
44+
variable "collector_host" {
45+
description = "Collector host where agent will send the data"
46+
}
47+
48+
variable "collector_port" {
49+
description = "Collector port where agent will send the data"
50+
default = "6443"
51+
}

‎examples/serverless-agent/fargate/orchestrator/versions.tf‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
terraform {
2+
required_version = ">=1.7.2"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = "~> 5.35.0"
8+
}
9+
local = {
10+
source = "hashicorp/local"
11+
version = "~> 2.4.1"
12+
}
13+
sysdig = {
14+
source = "sysdiglabs/sysdig"
15+
version = "~> 1.24.5"
16+
}
17+
}
18+
}

‎examples/serverless-agent/fargate/workload/README.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Workload with Serverless Workload Agent
2+
3+
This example deploys a cluster with a workload and the Serverless Workload Agent as a sidecar to secure the workload.
4+
5+
## Prerequisites
6+
7+
The following prerequisites are required to deploy this cluster:
8+
- Orchestrator Agent deployed
9+
- VPC
10+
- 2 subnets
11+
12+
## Components
13+
14+
The cluster will be called `<prefix>-instrumented-workload` and will deploy the following:
15+
- 1 Service (called `<prefix-instrumented-service`)
16+
- 1 Task (with the latest version of the Serverless Orchestrator Agent)
17+
- 1 container named `event-gen-1` running `falcosecurity/event-generator`
18+
- 1 container named `event-gen-2` also running `falcosecurity/event-generator`
19+
- 1 container named `SysdigInstrumentation` running the Workload Agent which will secure both workload containers
20+
21+
## Layout
22+
| **File** | **Purpose** |
23+
| --- | --- |
24+
| `instrumented_load.tf` | Workload definition. By default it instruments `falcosecurity/event-generator` |
25+
| `main.tf` | AWS provider configuration |
26+
| `output.tf` | Defines the output variables |
27+
| `variables.tf` | AWS and Agent configuration |
28+
| `versions.tf` | Defines TF provider versions |

‎examples/serverless-agent/fargate/workload/instrumented_load.tf‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
data "sysdig_fargate_workload_agent" "containers_instrumented" {
2+
container_definitions = jsonencode([
3+
{
4+
"name" : "event-gen-1",
5+
"image" : "falcosecurity/event-generator",
6+
"command" : ["run", "syscall", "--all", "--loop"],
7+
"logConfiguration" : {
8+
"logDriver" : "awslogs",
9+
"options" : {
10+
"awslogs-group" : aws_cloudwatch_log_group.instrumented_logs.name,
11+
"awslogs-region" : var.region,
12+
"awslogs-stream-prefix" : "task"
13+
},
14+
}
15+
},
16+
{
17+
"name" : "event-gen-2",
18+
"image" : "falcosecurity/event-generator",
19+
"command" : ["run", "syscall", "--all", "--loop"],
20+
"logConfiguration" : {
21+
"logDriver" : "awslogs",
22+
"options" : {
23+
"awslogs-group" : aws_cloudwatch_log_group.instrumented_logs.name,
24+
"awslogs-region" : var.region,
25+
"awslogs-stream-prefix" : "task"
26+
},
27+
}
28+
}
29+
])
30+
31+
workload_agent_image = var.agent_workload_image
32+
33+
sysdig_access_key = var.access_key
34+
orchestrator_host = var.orchestrator_host
35+
orchestrator_port = var.orchestrator_port
36+
37+
log_configuration {
38+
group = aws_cloudwatch_log_group.instrumented_logs.name
39+
stream_prefix = "instrumentation"
40+
region = var.region
41+
}
42+
}
43+
44+
resource "aws_ecs_task_definition" "task_definition" {
45+
family = "${var.prefix}-instrumented-task-definition"
46+
task_role_arn = aws_iam_role.task_role.arn
47+
execution_role_arn = aws_iam_role.execution_role.arn
48+
49+
cpu = "256"
50+
memory = "512"
51+
network_mode = "awsvpc"
52+
requires_compatibilities = ["FARGATE"]
53+
pid_mode = "task"
54+
55+
container_definitions = data.sysdig_fargate_workload_agent.containers_instrumented.output_container_definitions
56+
}
57+
58+
59+
resource "aws_ecs_cluster" "cluster" {
60+
name = "${var.prefix}-instrumented-workload"
61+
}
62+
63+
resource "aws_cloudwatch_log_group" "instrumented_logs" {
64+
}
65+
66+
data "aws_iam_policy_document" "assume_role_policy" {
67+
statement {
68+
actions = ["sts:AssumeRole"]
69+
70+
principals {
71+
type = "Service"
72+
identifiers = ["ecs-tasks.amazonaws.com"]
73+
}
74+
}
75+
}
76+
77+
resource "aws_iam_role" "execution_role" {
78+
assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
79+
80+
managed_policy_arns = ["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]
81+
}
82+
83+
resource "aws_iam_role" "task_role" {
84+
assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
85+
86+
inline_policy {
87+
name = "root"
88+
policy = data.aws_iam_policy_document.task_policy.json
89+
}
90+
}
91+
92+
data "aws_iam_policy_document" "task_policy" {
93+
statement {
94+
actions = [
95+
"ecr:GetAuthorizationToken",
96+
"ecr:BatchCheckLayerAvailability",
97+
"ecr:GetDownloadUrlForLayer",
98+
"ecr:BatchGetImage",
99+
"logs:CreateLogGroup",
100+
"logs:CreateLogStream",
101+
"logs:PutLogEvents",
102+
]
103+
104+
resources = ["*"]
105+
}
106+
}
107+
108+
resource "aws_ecs_service" "service" {
109+
name = "${var.prefix}-instrumented-service"
110+
111+
cluster = aws_ecs_cluster.cluster.id
112+
task_definition = aws_ecs_task_definition.task_definition.arn
113+
desired_count = var.replicas
114+
launch_type = "FARGATE"
115+
platform_version = "1.4.0"
116+
117+
network_configuration {
118+
subnets = [var.subnet_1, var.subnet_2]
119+
security_groups = [aws_security_group.security_group.id]
120+
assign_public_ip = true
121+
}
122+
}
123+
124+
resource "aws_security_group" "security_group" {
125+
description = "${var.prefix}-security-group"
126+
vpc_id = var.vpc_id
127+
}
128+
129+
resource "aws_security_group_rule" "orchestrator_agent_ingress_rule" {
130+
type = "ingress"
131+
protocol = "tcp"
132+
from_port = 0
133+
to_port = 0
134+
cidr_blocks = ["0.0.0.0/0"]
135+
security_group_id = aws_security_group.security_group.id
136+
}
137+
138+
resource "aws_security_group_rule" "orchestrator_agent_egress_rule" {
139+
type = "egress"
140+
protocol = "all"
141+
from_port = 0
142+
to_port = 0
143+
cidr_blocks = ["0.0.0.0/0"]
144+
security_group_id = aws_security_group.security_group.id
145+
}

‎examples/serverless-agent/fargate/workload/output.tf‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
output "workload_cluster_name" {
2+
value = aws_ecs_cluster.cluster.name
3+
}
4+
5+
output "workload_cluster_arn" {
6+
value = aws_ecs_cluster.cluster.arn
7+
}
8+
9+
output "service_arn" {
10+
value = aws_ecs_service.service.id
11+
}
12+
13+
output "task_revision" {
14+
value = aws_ecs_task_definition.task_definition.revision
15+
}

0 commit comments

Comments
 (0)