Skip to content

Commit f320fcc

Browse files
Add support for CloudTrail SNS ingestion
1 parent e33ed88 commit f320fcc

File tree

4 files changed

+44
-8
lines changed

4 files changed

+44
-8
lines changed

sysdig/data_source_sysdig_secure_onboarding.go

Lines changed: 24 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,11 @@ import (
88
"time"
99

1010
"github.com/aws/aws-sdk-go/aws/arn"
11-
v2 "github.com/draios/terraform-provider-sysdig/sysdig/internal/client/v2"
1211
"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
1312
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
1413
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
14+
15+
v2 "github.com/draios/terraform-provider-sysdig/sysdig/internal/client/v2"
1516
)
1617

1718
func getSecureOnboardingClient(c SysdigClients) (v2.OnboardingSecureInterface, error) {
@@ -344,6 +345,15 @@ func dataSourceSysdigSecureCloudIngestionAssets() *schema.Resource {
344345
},
345346

346347
Schema: map[string]*schema.Schema{
348+
"cloud_provider": {
349+
Type: schema.TypeString,
350+
Required: true,
351+
ValidateFunc: validation.StringInSlice([]string{"aws", "gcp", "azure"}, false),
352+
},
353+
"cloud_provider_id": {
354+
Type: schema.TypeString,
355+
Required: true,
356+
},
347357
"aws": {
348358
Type: schema.TypeMap,
349359
Computed: true,
@@ -359,6 +369,14 @@ func dataSourceSysdigSecureCloudIngestionAssets() *schema.Resource {
359369
Type: schema.TypeMap,
360370
Computed: true,
361371
},
372+
"sns_routing_key": {
373+
Type: schema.TypeString,
374+
Computed: true,
375+
},
376+
"sns_metadata": {
377+
Type: schema.TypeMap,
378+
Computed: true,
379+
},
362380
},
363381
}
364382
}
@@ -370,7 +388,7 @@ func dataSourceSysdigSecureCloudIngestionAssetsRead(ctx context.Context, d *sche
370388
return diag.FromErr(err)
371389
}
372390

373-
assets, err := client.GetCloudIngestionAssetsSecure(ctx)
391+
assets, err := client.GetCloudIngestionAssetsSecure(ctx, d.Get("cloud_provider").(string), d.Get("cloud_provider_id").(string))
374392
if err != nil {
375393
return diag.FromErr(err)
376394
}
@@ -380,8 +398,10 @@ func dataSourceSysdigSecureCloudIngestionAssetsRead(ctx context.Context, d *sche
380398

381399
d.SetId("cloudIngestionAssets")
382400
err = d.Set("aws", map[string]interface{}{
383-
"eventBusARN": assetsAws["eventBusARN"],
384-
"eventBusARNGov": assetsAws["eventBusARNGov"],
401+
"eventBusARN": assetsAws["eventBusARN"],
402+
"eventBusARNGov": assetsAws["eventBusARNGov"],
403+
"sns_routing_key": assetsAws["snsRoutingKey"],
404+
"sns_metadata": assetsAws["snsMetadata"],
385405
})
386406
if err != nil {
387407
return diag.FromErr(err)

sysdig/data_source_sysdig_secure_onboarding_test.go

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -175,6 +175,10 @@ func TestAccCloudIngestionAssetsDataSource(t *testing.T) {
175175
},
176176
},
177177
Steps: []resource.TestStep{
178+
{
179+
Config: `data "sysdig_secure_cloud_ingestion_assets" "assets" { cloud_provider = "invalid" }`,
180+
ExpectError: regexp.MustCompile(`.*expected cloud_provider to be one of.*`),
181+
},
178182
{
179183
Config: `data "sysdig_secure_cloud_ingestion_assets" "assets" {}`,
180184
Check: resource.ComposeTestCheckFunc(
@@ -188,6 +192,15 @@ func TestAccCloudIngestionAssetsDataSource(t *testing.T) {
188192
resource.TestCheckResourceAttrSet("data.sysdig_secure_cloud_ingestion_assets.assets", "gcp_metadata.ingestionURL"),
189193
),
190194
},
195+
{
196+
Config: `data "sysdig_secure_trusted_cloud_identity" "trusted_identity" { cloud_provider = "aws" }`,
197+
Check: resource.ComposeTestCheckFunc(
198+
resource.TestCheckResourceAttr("data.sysdig_secure_trusted_cloud_identity.trusted_identity", "cloud_provider", "aws"),
199+
resource.TestCheckResourceAttrSet("data.sysdig_secure_trusted_cloud_identity.trusted_identity", "aws_account_id"),
200+
resource.TestCheckResourceAttrSet("data.sysdig_secure_trusted_cloud_identity.trusted_identity", "aws_role_name"),
201+
// not asserting the gov exported fields because not every backend environment is gov supported and thus will have empty values
202+
),
203+
},
191204
},
192205
})
193206
}

sysdig/internal/client/v2/onboarding.go

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ const (
1111
onboardingTrustedAzureAppPath = "%s/api/secure/onboarding/v2/trustedAzureApp?app=%s"
1212
onboardingTenantExternaIDPath = "%s/api/secure/onboarding/v2/externalID"
1313
onboardingAgentlessScanningAssetsPath = "%s/api/secure/onboarding/v2/agentlessScanningAssets"
14-
onboardingCloudIngestionAssetsPath = "%s/api/secure/onboarding/v2/cloudIngestionAssets"
14+
onboardingCloudIngestionAssetsPath = "%s/api/secure/onboarding/v2/cloudIngestionAssets?provider=%s&providerID=%s"
1515
onboardingTrustedRegulationAssetsPath = "%s/api/secure/onboarding/v2/trustedRegulationAssets?provider=%s"
1616
onboardingTrustedOracleAppPath = "%s/api/secure/onboarding/v2/trustedOracleApp?app=%s"
1717
)
@@ -22,7 +22,7 @@ type OnboardingSecureInterface interface {
2222
GetTrustedAzureAppSecure(ctx context.Context, app string) (map[string]string, error)
2323
GetTenantExternalIDSecure(ctx context.Context) (string, error)
2424
GetAgentlessScanningAssetsSecure(ctx context.Context) (map[string]any, error)
25-
GetCloudIngestionAssetsSecure(ctx context.Context) (map[string]any, error)
25+
GetCloudIngestionAssetsSecure(ctx context.Context, provider, providerID string) (map[string]any, error)
2626
GetTrustedCloudRegulationAssetsSecure(ctx context.Context, provider string) (map[string]string, error)
2727
GetTrustedOracleAppSecure(ctx context.Context, app string) (map[string]string, error)
2828
}
@@ -83,8 +83,8 @@ func (client *Client) GetAgentlessScanningAssetsSecure(ctx context.Context) (map
8383
return Unmarshal[map[string]interface{}](response.Body)
8484
}
8585

86-
func (client *Client) GetCloudIngestionAssetsSecure(ctx context.Context) (map[string]interface{}, error) {
87-
response, err := client.requester.Request(ctx, http.MethodGet, fmt.Sprintf(onboardingCloudIngestionAssetsPath, client.config.url), nil)
86+
func (client *Client) GetCloudIngestionAssetsSecure(ctx context.Context, provider, providerID string) (map[string]interface{}, error) {
87+
response, err := client.requester.Request(ctx, http.MethodGet, fmt.Sprintf(onboardingCloudIngestionAssetsPath, client.config.url, provider, providerID), nil)
8888
if err != nil {
8989
return nil, err
9090
}

website/docs/d/secure_cloud_ingestion_assets.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,3 +32,6 @@ In addition to all arguments above, the following attributes are exported:
3232

3333
* `gcp_metadata` - GCP ingestion metadata
3434

35+
* `sns_routing_key` - CloudTrail SNS ingestion routing key
36+
37+
* `sns_metadata` - CloudTrail SNS ingestion metadata

0 commit comments

Comments
 (0)