Skip to content

Commit 5ac45af

Browse files
idanch4idanch4
authored
Merge pull request #22 from aquasecurity/idan-SAAS-29781-add-registry-serverless-roles
SAAS-29781 - Split CSPM Role to Registry and Serverless Roles (Single/Org)
2 parents 3c4ef87 + 264cd92 commit 5ac45af

File tree

15 files changed

+489
-139
lines changed

15 files changed

+489
-139
lines changed

‎README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,9 @@ Before using this module, ensure that you have the following:
106106
| <a name="input_custom_cspm_role_name"></a> [custom\_cspm\_role\_name](#input\_custom\_cspm\_role\_name) | Custom CSPM role Name | `string` | `""` | no |
107107
| <a name="input_custom_internet_gateway_name"></a> [custom\_internet\_gateway\_name](#input\_custom\_internet\_gateway\_name) | Custom Internet Gateway Name | `string` | `""` | no |
108108
| <a name="input_custom_processor_lambda_role_name"></a> [custom\_processor\_lambda\_role\_name](#input\_custom\_processor\_lambda\_role\_name) | Custom Processor lambda role Name | `string` | `""` | no |
109+
| <a name="input_custom_registry_scanning_role_name"></a> [custom\_registry\_scanning\_role\_name](#input\_custom\_registry\_scanning\_role\_name) | Custom Registry Scanning role Name | `string` | `""` | no |
109110
| <a name="input_custom_security_group_name"></a> [custom\_security\_group\_name](#input\_custom\_security\_group\_name) | Custom Security Group Name | `string` | `""` | no |
111+
| <a name="input_custom_serverless_scanning_role_name"></a> [custom\_serverless\_scanning\_role\_name](#input\_custom\_serverless\_scanning\_role\_name) | Custom Serverless Scanning role Name | `string` | `""` | no |
110112
| <a name="input_custom_vpc_name"></a> [custom\_vpc\_name](#input\_custom\_vpc\_name) | Custom VPC Name | `string` | `""` | no |
111113
| <a name="input_custom_vpc_subnet1_name"></a> [custom\_vpc\_subnet1\_name](#input\_custom\_vpc\_subnet1\_name) | Custom VPC Subnet 1 Name | `string` | `""` | no |
112114
| <a name="input_custom_vpc_subnet2_name"></a> [custom\_vpc\_subnet2\_name](#input\_custom\_vpc\_subnet2\_name) | Custom VPC Subnet 2 Name | `string` | `""` | no |
@@ -115,6 +117,8 @@ Before using this module, ensure that you have the following:
115117
| <a name="input_organizational_unit_id"></a> [organizational\_unit\_id](#input\_organizational\_unit\_id) | AWS Organizational unit (OU) ID to deploy resources on (This should be provided only if type of onboarding is 'organization') | `string` | `""` | no |
116118
| <a name="input_region"></a> [region](#input\_region) | Main AWS Region to deploy resources | `string` | n/a | yes |
117119
| <a name="input_regions"></a> [regions](#input\_regions) | AWS Regions to deploy discovery and scanning resources | `list(string)` | n/a | yes |
120+
| <a name="input_registry_scanning_deployment"></a> [registry\_scanning\_deployment](#input\_registry\_scanning\_deployment) | Toggle to deploy Registry/ECR scanning resources | `string` | `"true"` | no |
121+
| <a name="input_serverless_scanning_deployment"></a> [serverless\_scanning\_deployment](#input\_serverless\_scanning\_deployment) | Toggle to deploy Serverless/Lambda scanning resources | `string` | `"true"` | no |
118122
| <a name="input_show_outputs"></a> [show\_outputs](#input\_show\_outputs) | Whether to show outputs after deployment | `bool` | `false` | no |
119123
| <a name="input_type"></a> [type](#input\_type) | The type of onboarding. Valid values are 'single' or 'organization' onboarding types | `string` | n/a | yes |
120124
| <a name="input_volume_scanning_deployment"></a> [volume\_scanning\_deployment](#input\_volume\_scanning\_deployment) | Toggle to deploy Volume Scanning resources | `string` | `"true"` | no |

‎main.tf‎

Lines changed: 73 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -7,70 +7,80 @@ resource "random_string" "id" {
77
}
88

99
module "single" {
10-
source = "./modules/single"
11-
count = var.type == "single" ? 1 : 0
12-
random_id = local.random_id
13-
region = var.region
14-
regions = var.regions
15-
additional_tags = var.additional_tags
16-
aqua_autoconnect_url = var.aqua_autoconnect_url
17-
aqua_session_id = var.aqua_session_id
18-
aqua_worker_role_arn = var.aqua_worker_role_arn
19-
aqua_api_key = var.aqua_api_key
20-
aqua_api_secret = var.aqua_api_secret
21-
aqua_bucket_name = var.aqua_bucket_name
22-
aqua_volscan_api_url = var.aqua_volscan_api_url
23-
aqua_volscan_aws_account_id = var.aqua_volscan_aws_account_id
24-
aqua_volscan_api_token = var.aqua_volscan_api_token
25-
aqua_cspm_aws_account_id = var.aqua_cspm_aws_account_id
26-
aqua_cspm_ipv4_address = var.aqua_cspm_ipv4_address
27-
aqua_cspm_url = var.aqua_cspm_url
28-
aqua_cspm_group_id = var.aqua_cspm_group_id
29-
aqua_cspm_role_prefix = var.aqua_cspm_role_prefix
30-
custom_cspm_role_name = var.custom_cspm_role_name
31-
custom_bucket_name = var.custom_bucket_name
32-
custom_agentless_role_name = var.custom_agentless_role_name
33-
custom_processor_lambda_role_name = var.custom_processor_lambda_role_name
34-
create_vpcs = var.create_vpcs
35-
custom_internet_gateway_name = var.custom_internet_gateway_name
36-
custom_security_group_name = var.custom_security_group_name
37-
custom_vpc_name = var.custom_vpc_name
38-
custom_vpc_subnet1_name = var.custom_vpc_subnet1_name
39-
custom_vpc_subnet2_name = var.custom_vpc_subnet2_name
40-
custom_vpc_subnet_route_table1_name = var.custom_vpc_subnet_route_table1_name
41-
custom_vpc_subnet_route_table2_name = var.custom_vpc_subnet_route_table2_name
42-
custom_cspm_regions = var.custom_cspm_regions
43-
volume_scanning_deployment = var.volume_scanning_deployment
44-
base_cspm = var.base_cspm
10+
source = "./modules/single"
11+
count = var.type == "single" ? 1 : 0
12+
random_id = local.random_id
13+
region = var.region
14+
regions = var.regions
15+
additional_tags = var.additional_tags
16+
aqua_autoconnect_url = var.aqua_autoconnect_url
17+
aqua_session_id = var.aqua_session_id
18+
aqua_worker_role_arn = var.aqua_worker_role_arn
19+
aqua_api_key = var.aqua_api_key
20+
aqua_api_secret = var.aqua_api_secret
21+
aqua_bucket_name = var.aqua_bucket_name
22+
aqua_volscan_api_url = var.aqua_volscan_api_url
23+
aqua_volscan_aws_account_id = var.aqua_volscan_aws_account_id
24+
aqua_volscan_api_token = var.aqua_volscan_api_token
25+
aqua_cspm_aws_account_id = var.aqua_cspm_aws_account_id
26+
aqua_cspm_ipv4_address = var.aqua_cspm_ipv4_address
27+
aqua_cspm_url = var.aqua_cspm_url
28+
aqua_cspm_group_id = var.aqua_cspm_group_id
29+
aqua_cspm_role_prefix = var.aqua_cspm_role_prefix
30+
custom_cspm_role_name = var.custom_cspm_role_name
31+
custom_bucket_name = var.custom_bucket_name
32+
custom_agentless_role_name = var.custom_agentless_role_name
33+
custom_processor_lambda_role_name = var.custom_processor_lambda_role_name
34+
create_vpcs = var.create_vpcs
35+
custom_internet_gateway_name = var.custom_internet_gateway_name
36+
custom_security_group_name = var.custom_security_group_name
37+
custom_vpc_name = var.custom_vpc_name
38+
custom_vpc_subnet1_name = var.custom_vpc_subnet1_name
39+
custom_vpc_subnet2_name = var.custom_vpc_subnet2_name
40+
custom_vpc_subnet_route_table1_name = var.custom_vpc_subnet_route_table1_name
41+
custom_vpc_subnet_route_table2_name = var.custom_vpc_subnet_route_table2_name
42+
custom_cspm_regions = var.custom_cspm_regions
43+
volume_scanning_deployment = var.volume_scanning_deployment
44+
base_cspm = var.base_cspm
45+
registry_scanning_deployment = var.registry_scanning_deployment
46+
serverless_scanning_deployment = var.serverless_scanning_deployment
47+
custom_registry_scanning_role_name = var.custom_registry_scanning_role_name
48+
custom_serverless_scanning_role_name = var.custom_serverless_scanning_role_name
4549
}
4650

4751
module "organization" {
48-
source = "./modules/organization"
49-
count = var.type == "organization" ? 1 : 0
50-
region = var.region
51-
regions = var.regions
52-
organizational_unit_id = var.organizational_unit_id
53-
additional_tags = var.additional_tags
54-
aqua_tenant_id = var.aqua_tenant_id
55-
aqua_random_id = var.aqua_random_id
56-
aqua_worker_role_arn = var.aqua_worker_role_arn
57-
aqua_bucket_name = var.aqua_bucket_name
58-
aqua_api_key = var.aqua_api_key
59-
aqua_api_secret = var.aqua_api_secret
60-
aqua_volscan_api_token = var.aqua_volscan_api_token
61-
aqua_group_name = var.aqua_group_name
62-
aqua_session_id = var.aqua_session_id
63-
custom_cspm_role_name = var.custom_cspm_role_name
64-
custom_bucket_name = var.custom_bucket_name
65-
custom_agentless_role_name = var.custom_agentless_role_name
66-
custom_processor_lambda_role_name = var.custom_processor_lambda_role_name
67-
custom_internet_gateway_name = var.custom_internet_gateway_name
68-
custom_security_group_name = var.custom_security_group_name
69-
custom_vpc_name = var.custom_vpc_name
70-
custom_vpc_subnet1_name = var.custom_vpc_subnet1_name
71-
custom_vpc_subnet2_name = var.custom_vpc_subnet2_name
72-
custom_vpc_subnet_route_table1_name = var.custom_vpc_subnet_route_table1_name
73-
custom_vpc_subnet_route_table2_name = var.custom_vpc_subnet_route_table2_name
74-
custom_cspm_regions = var.custom_cspm_regions
75-
volume_scanning_deployment = var.volume_scanning_deployment
52+
source = "./modules/organization"
53+
count = var.type == "organization" ? 1 : 0
54+
region = var.region
55+
regions = var.regions
56+
organizational_unit_id = var.organizational_unit_id
57+
additional_tags = var.additional_tags
58+
aqua_tenant_id = var.aqua_tenant_id
59+
aqua_random_id = var.aqua_random_id
60+
aqua_worker_role_arn = var.aqua_worker_role_arn
61+
aqua_bucket_name = var.aqua_bucket_name
62+
aqua_api_key = var.aqua_api_key
63+
aqua_api_secret = var.aqua_api_secret
64+
aqua_volscan_api_token = var.aqua_volscan_api_token
65+
aqua_group_name = var.aqua_group_name
66+
aqua_session_id = var.aqua_session_id
67+
custom_cspm_role_name = var.custom_cspm_role_name
68+
custom_bucket_name = var.custom_bucket_name
69+
custom_agentless_role_name = var.custom_agentless_role_name
70+
custom_processor_lambda_role_name = var.custom_processor_lambda_role_name
71+
custom_internet_gateway_name = var.custom_internet_gateway_name
72+
custom_security_group_name = var.custom_security_group_name
73+
custom_vpc_name = var.custom_vpc_name
74+
custom_vpc_subnet1_name = var.custom_vpc_subnet1_name
75+
custom_vpc_subnet2_name = var.custom_vpc_subnet2_name
76+
custom_vpc_subnet_route_table1_name = var.custom_vpc_subnet_route_table1_name
77+
custom_vpc_subnet_route_table2_name = var.custom_vpc_subnet_route_table2_name
78+
custom_cspm_regions = var.custom_cspm_regions
79+
volume_scanning_deployment = var.volume_scanning_deployment
80+
base_cspm = var.base_cspm
81+
aqua_cspm_group_id = var.aqua_cspm_group_id
82+
registry_scanning_deployment = var.registry_scanning_deployment
83+
serverless_scanning_deployment = var.serverless_scanning_deployment
84+
custom_registry_scanning_role_name = var.custom_registry_scanning_role_name
85+
custom_serverless_scanning_role_name = var.custom_serverless_scanning_role_name
7686
}

‎modules/organization/main.tf‎

Lines changed: 30 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -19,30 +19,36 @@ resource "aws_cloudformation_stack_set" "stack_set" {
1919
}
2020

2121
parameters = {
22-
AquaApiKey = sensitive(var.aqua_api_key),
23-
AquaSecretKey = sensitive(var.aqua_api_secret),
24-
AquaGroupName = var.aqua_group_name,
25-
WorkerRoleArn = var.aqua_worker_role_arn,
26-
TenantId = var.aqua_tenant_id,
27-
AquaApiTokenVolScan = sensitive(var.aqua_volscan_api_token),
28-
RandomID = var.aqua_random_id,
29-
ConfigurationID = var.aqua_session_id,
30-
OrganizationID = var.organizational_unit_id,
31-
DeployedInfrastructureRegion = var.region,
32-
AdditionalTags = join(",", [for key, value in var.additional_tags : "${key}:${value}"])
33-
CustomCSPMRoleName = var.custom_cspm_role_name
34-
CustomAgentlessRoleName = var.custom_agentless_role_name
35-
CustomBucketName = var.custom_bucket_name
36-
CustomProcessorLambdaRoleName = var.custom_processor_lambda_role_name
37-
CustomVpcName = var.custom_vpc_name
38-
CustomVpcSubnet1Name = var.custom_vpc_subnet1_name
39-
CustomVpcSubnetRouteTable1Name = var.custom_vpc_subnet_route_table1_name
40-
CustomVpcSubnet2Name = var.custom_vpc_subnet2_name
41-
CustomVpcSubnetRouteTable2Name = var.custom_vpc_subnet_route_table2_name
42-
CustomInternetGatewayName = var.custom_internet_gateway_name
43-
CustomSecurityGroupName = var.custom_security_group_name
44-
CustomCSPMRegions = var.custom_cspm_regions
45-
VolumeScanningDeployment = var.volume_scanning_deployment
22+
AquaApiKey = sensitive(var.aqua_api_key),
23+
AquaSecretKey = sensitive(var.aqua_api_secret),
24+
AquaGroupName = var.aqua_group_name,
25+
WorkerRoleArn = var.aqua_worker_role_arn,
26+
TenantId = var.aqua_tenant_id,
27+
AquaApiTokenVolScan = sensitive(var.aqua_volscan_api_token),
28+
RandomID = var.aqua_random_id,
29+
ConfigurationID = var.aqua_session_id,
30+
OrganizationID = var.organizational_unit_id,
31+
DeployedInfrastructureRegion = var.region,
32+
AdditionalTags = join(",", [for key, value in var.additional_tags : "${key}:${value}"])
33+
CustomCSPMRoleName = var.custom_cspm_role_name
34+
CustomAgentlessRoleName = var.custom_agentless_role_name
35+
CustomBucketName = var.custom_bucket_name
36+
CustomProcessorLambdaRoleName = var.custom_processor_lambda_role_name
37+
CustomVpcName = var.custom_vpc_name
38+
CustomVpcSubnet1Name = var.custom_vpc_subnet1_name
39+
CustomVpcSubnetRouteTable1Name = var.custom_vpc_subnet_route_table1_name
40+
CustomVpcSubnet2Name = var.custom_vpc_subnet2_name
41+
CustomVpcSubnetRouteTable2Name = var.custom_vpc_subnet_route_table2_name
42+
CustomInternetGatewayName = var.custom_internet_gateway_name
43+
CustomSecurityGroupName = var.custom_security_group_name
44+
CustomCSPMRegions = var.custom_cspm_regions
45+
VolumeScanningDeployment = var.volume_scanning_deployment
46+
BaseCSPM = tostring(var.base_cspm)
47+
GroupId = tostring(var.aqua_cspm_group_id)
48+
RegistryScanningDeployment = var.registry_scanning_deployment
49+
ServerlessScanningDeployment = var.serverless_scanning_deployment
50+
CustomRegistryScanningRoleName = var.custom_registry_scanning_role_name
51+
CustomServerlessScanningRoleName = var.custom_serverless_scanning_role_name
4652
}
4753
}
4854

‎modules/organization/variables.tf‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,11 @@ variable "aqua_session_id" {
6666
type = string
6767
}
6868

69+
variable "aqua_cspm_group_id" {
70+
description = "Aqua CSPM Group ID"
71+
type = number
72+
}
73+
6974
variable "custom_cspm_role_name" {
7075
description = "Custom CSPM role Name"
7176
type = string
@@ -131,4 +136,62 @@ variable "volume_scanning_deployment" {
131136
description = "Toggle to deploy Volume Scanning resources"
132137
type = string
133138
default = "true"
139+
validation {
140+
condition = var.volume_scanning_deployment == "true" || var.volume_scanning_deployment == "false"
141+
error_message = "Volume scanning deployment must be either 'true' or 'false'."
142+
}
143+
}
144+
145+
variable "base_cspm" {
146+
description = "Toggle for base CSPM only"
147+
type = bool
148+
default = false
149+
}
150+
151+
variable "registry_scanning_deployment" {
152+
description = "Toggle to deploy Registry/ECR scanning resources"
153+
type = string
154+
default = "true"
155+
validation {
156+
condition = var.registry_scanning_deployment == "true" || var.registry_scanning_deployment == "false"
157+
error_message = "Registry scanning deployment must be either 'true' or 'false'."
158+
}
159+
}
160+
161+
variable "serverless_scanning_deployment" {
162+
description = "Toggle to deploy Serverless/Lambda scanning resources"
163+
type = string
164+
default = "true"
165+
validation {
166+
condition = var.serverless_scanning_deployment == "true" || var.serverless_scanning_deployment == "false"
167+
error_message = "Serverless scanning deployment must be either 'true' or 'false'."
168+
}
169+
}
170+
171+
variable "custom_registry_scanning_role_name" {
172+
description = "Custom Registry Scanning role Name"
173+
type = string
174+
default = ""
175+
validation {
176+
condition = length(var.custom_registry_scanning_role_name) == 0 || (length(var.custom_registry_scanning_role_name) >= 1 && length(var.custom_registry_scanning_role_name) <= 64)
177+
error_message = "The Registry Scanning IAM role name must be between 1 and 64 characters."
178+
}
179+
validation {
180+
condition = length(var.custom_registry_scanning_role_name) == 0 || can(regex("[a-zA-Z0-9+=,.@_-]+", var.custom_registry_scanning_role_name))
181+
error_message = "The Registry Scanning IAM role name can contain only alphanumeric characters and the following special characters: +=,.@_-"
182+
}
183+
}
184+
185+
variable "custom_serverless_scanning_role_name" {
186+
description = "Custom Serverless Scanning role Name"
187+
type = string
188+
default = ""
189+
validation {
190+
condition = length(var.custom_serverless_scanning_role_name) == 0 || (length(var.custom_serverless_scanning_role_name) >= 1 && length(var.custom_serverless_scanning_role_name) <= 64)
191+
error_message = "The Serverless Scanning IAM role name must be between 1 and 64 characters."
192+
}
193+
validation {
194+
condition = length(var.custom_serverless_scanning_role_name) == 0 || can(regex("[a-zA-Z0-9+=,.@_-]+", var.custom_serverless_scanning_role_name))
195+
error_message = "The Serverless Scanning IAM role name can contain only alphanumeric characters and the following special characters: +=,.@_-"
196+
}
134197
}

0 commit comments

Comments
 (0)