Skip to content

Commit 0932aa6

Browse files
author
iru
authored
chore: resouce-group+tags usage awareness (#70)
* fix: create resource-group based on 'product' key tag * chore: remove rg outside examples * doc: raise awarenes on default 'product' tag for resource-group creation * doc: raise awareness on resource-groups * ci: avoid collision * doc: clarify rg is only on examples
1 parent 351c387 commit 0932aa6

File tree

28 files changed

+67
-65
lines changed

28 files changed

+67
-65
lines changed

‎README.md

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -106,9 +106,10 @@ $ terraform plan
106106
$ terraform apply
107107
```
108108

109-
Notice that:
110-
* This example will create resources that cost money.<br/>Run `terraform destroy` when you don't need them anymore
111-
* All created resources will be created within the tags `product:sysdig-secure-for-cloud`, within the resource-group `sysdig-secure-for-cloud`
109+
### Notice
110+
111+
* **Resource creation inventory** Find all the resources created by Sysdig examples in the resource-group `sysdig-secure-for-cloud` (AWS Resource Group & Tag Editor) <br/><br/>
112+
* **Deployment cost** This example will create resources that cost money.<br/>Run `terraform destroy` when you don't need them anymore
112113

113114
<br/><br/>
114115

‎examples-internal/organizational-k8s-threat-reuse_cloudtrail_s3/README.md

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,12 @@ This three-actor setup (S3-SNS-SQS) can be manually provisioned, or handled thro
2626
Client is responsible for provisioning the ARN of this SQS, which will be required as an input parameter.<br/>
2727
2828
29+
## Notice
30+
31+
* **Resource creation inventory** Find all the resources created by Sysdig examples in the resource-group `sysdig-secure-for-cloud` (AWS Resource Group & Tag Editor) <br/><br/>
32+
* **Deployment cost** This example will create resources that cost money.<br/>Run `terraform destroy` when you don't need them anymore
33+
34+
2935
## Usage
3036
3137
For quick testing, use this snippet on your terraform files.
@@ -75,10 +81,6 @@ $ terraform plan
7581
$ terraform apply
7682
```
7783

78-
Notice that:
79-
* This example will create resources that cost money.<br/>Run `terraform destroy` when you don't need them anymore
80-
* All created resources will be created within the tags `product:sysdig-secure-for-cloud`, within the resource-group `sysdig-secure-for-cloud`
81-
8284
<!-- BEGIN_TF_DOCS -->
8385
## Requirements
8486

‎examples-internal/organizational-k8s-threat-reuse_cloudtrail_s3/variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ variable "name" {
3333

3434
variable "tags" {
3535
type = map(string)
36-
description = "sysdig secure-for-cloud tags"
36+
description = "sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning"
3737
default = {
3838
"product" = "sysdig-secure-for-cloud"
3939
}

‎examples-internal/utils-eks/variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ variable "region" {
2121

2222
variable "tags" {
2323
type = map(string)
24-
description = "sysdig secure-for-cloud tags"
24+
description = "sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning"
2525
default = {
2626
"product" = "sysdig-secure-for-cloud"
2727
}

‎examples/organizational/README.md

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,11 @@ Minimum requirements:
3838
sysdig_secure_api_token=<SECURE_API_TOKEN>
3939
```
4040
41+
## Notice
42+
43+
* **Resource creation inventory** Find all the resources created by Sysdig examples in the resource-group `sysdig-secure-for-cloud` (AWS Resource Group & Tag Editor) <br/><br/>
44+
* **Deployment cost** This example will create resources that cost money.<br/>Run `terraform destroy` when you don't need them anymore
45+
4146
## Usage
4247
4348
For quick testing, use this snippet on your terraform files
@@ -87,10 +92,6 @@ $ terraform plan
8792
$ terraform apply
8893
```
8994

90-
Notice that:
91-
* This example will create resources that cost money.<br/>Run `terraform destroy` when you don't need them anymore
92-
* All created resources will be created within the tags `product:sysdig-secure-for-cloud`, within the resource-group `sysdig-secure-for-cloud`
93-
9495

9596
<!-- BEGIN_TF_DOCS -->
9697
## Requirements

‎examples/organizational/main.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,14 @@ module "resource_group" {
99
tags = var.tags
1010
}
1111

12+
module "resource_group_secure_for_cloud_member" {
13+
providers = {
14+
aws = aws.member
15+
}
16+
source = "../../modules/infrastructure/resource-group"
17+
name = var.name
18+
tags = var.tags
19+
}
1220

1321
#-------------------------------------
1422
# secure-for-cloud member account workload

‎examples/organizational/permissions.tf

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,3 @@
1-
module "resource_group_secure_for_cloud_member" {
2-
providers = {
3-
aws = aws.member
4-
}
5-
source = "../../modules/infrastructure/resource-group"
6-
name = var.name
7-
tags = var.tags
8-
}
9-
101
module "secure_for_cloud_role" {
112
source = "../../modules/infrastructure/permissions/org-role-ecs"
123
providers = {

‎examples/organizational/variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,7 @@ variable "name" {
142142

143143
variable "tags" {
144144
type = map(string)
145-
description = "sysdig secure-for-cloud tags"
145+
description = "sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning"
146146
default = {
147147
"product" = "sysdig-secure-for-cloud"
148148
}

‎examples/single-account-k8s/README.md

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,12 @@ Minimum requirements:
2121
sysdig_secure_api_token=<SECURE_API_TOKEN>
2222
```
2323

24+
## Notice
25+
26+
* **Resource creation inventory** Find all the resources created by Sysdig examples in the resource-group `sysdig-secure-for-cloud` (AWS Resource Group & Tag Editor) <br/><br/>
27+
* **Deployment cost** This example will create resources that cost money.<br/>Run `terraform destroy` when you don't need them anymore
28+
29+
2430
## Usage
2531

2632
For quick testing, use this snippet on your terraform files
@@ -63,10 +69,6 @@ $ terraform plan
6369
$ terraform apply
6470
```
6571

66-
Notice that:
67-
68-
* This example will create resources that cost money.<br/>Run `terraform destroy` when you don't need them anymore
69-
* All created resources will be created within the tags `product:sysdig-secure-for-cloud`, within the resource-group `sysdig-secure-for-cloud`
7072

7173
<!-- BEGIN_TF_DOCS -->
7274
## Requirements

‎examples/single-account-k8s/variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ variable "name" {
3232

3333
variable "tags" {
3434
type = map(string)
35-
description = "sysdig secure-for-cloud tags"
35+
description = "sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning"
3636
default = {
3737
"product" = "sysdig-secure-for-cloud"
3838
}

‎examples/single-account/README.md

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,12 @@ Minimum requirements:
1515
sysdig_secure_api_token=<SECURE_API_TOKEN>
1616
```
1717
18+
## Notice
19+
20+
* **Resource creation inventory** Find all the resources created by Sysdig examples in the resource-group `sysdig-secure-for-cloud` (AWS Resource Group & Tag Editor) <br/><br/>
21+
* **Deployment cost** This example will create resources that cost money.<br/>Run `terraform destroy` when you don't need them anymore
22+
23+
1824
## Usage
1925
2026
For quick testing, use this snippet on your terraform files
@@ -50,10 +56,6 @@ $ terraform plan
5056
$ terraform apply
5157
```
5258

53-
Notice that:
54-
* This example will create resources that cost money.<br/>Run `terraform destroy` when you don't need them anymore
55-
* All created resources will be created within the tags `product:sysdig-secure-for-cloud`, within the resource-group `sysdig-secure-for-cloud`
56-
5759
<!-- BEGIN_TF_DOCS -->
5860
## Requirements
5961

‎examples/single-account/variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ variable "name" {
115115

116116
variable "tags" {
117117
type = map(string)
118-
description = "sysdig secure-for-cloud tags"
118+
description = "sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning"
119119
default = {
120120
"product" = "sysdig-secure-for-cloud"
121121
}

‎examples/trigger-events/README.md

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,12 @@ Minimum requirements:
1010
1. Deploy Cloud Connector Stack on AWS.
1111
2. Configure [Terraform **AWS** Provider](https://registry.terraform.io/providers/hashicorp/aws/latest/docs)
1212

13+
## Notice
14+
15+
* **Resource creation inventory** Find all the resources created by Sysdig examples in the resource-group `sysdig-secure-for-cloud` (AWS Resource Group & Tag Editor) <br/><br/>
16+
* **Deployment cost** This example will create resources that cost money.<br/>Run `terraform destroy` when you don't need them anymore
17+
18+
1319
## Usage
1420

1521
For quick testing, use this snippet on your terraform files
@@ -31,10 +37,6 @@ $ terraform plan
3137
$ terraform apply
3238
```
3339

34-
Notice that:
35-
* This example will create resources that cost money.<br/>Run `terraform destroy` when you don't need them anymore
36-
* All created resources will be created within the tags `product:sysdig-secure-for-cloud`, within the resource-group `sysdig-secure-for-cloud`
37-
3840
<!-- BEGIN_TF_DOCS -->
3941
## Requirements
4042

‎modules/infrastructure/cloudtrail/variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ variable "name" {
6464

6565
variable "tags" {
6666
type = map(string)
67-
description = "sysdig secure-for-cloud tags"
67+
description = "sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning"
6868
default = {
6969
"product" = "sysdig-secure-for-cloud"
7070
}

‎modules/infrastructure/cloudtrail_s3-sns-sqs/main.tf

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,3 @@
1-
module "resource_group" {
2-
source = "../resource-group"
3-
name = var.name
4-
tags = var.tags
5-
}
6-
7-
8-
91
# --------------------------------------------
102
# cloudtrail_s3 bucket sns event notification
113
# --------------------------------------------

‎modules/infrastructure/cloudtrail_s3-sns-sqs/variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ variable "name" {
2626

2727
variable "tags" {
2828
type = map(string)
29-
description = "sysdig secure-for-cloud tags"
29+
description = "sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning"
3030
default = {
3131
"product" = "sysdig-secure-for-cloud"
3232
}

‎modules/infrastructure/codebuild/variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ variable "name" {
2020

2121
variable "tags" {
2222
type = map(string)
23-
description = "sysdig secure-for-cloud tags"
23+
description = "sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning"
2424
default = {
2525
"product" = "sysdig-secure-for-cloud"
2626
}

‎modules/infrastructure/ecs-vpc/variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ variable "name" {
2323

2424
variable "tags" {
2525
type = map(string)
26-
description = "sysdig secure-for-cloud tags"
26+
description = "sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning"
2727
default = {
2828
"product" = "sysdig-secure-for-cloud"
2929
}

‎modules/infrastructure/permissions/org-role-ecs/variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ variable "organizational_role_per_account" {
2626

2727
variable "tags" {
2828
type = map(string)
29-
description = "sysdig secure-for-cloud tags"
29+
description = "sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning"
3030
default = {
3131
"product" = "sysdig-secure-for-cloud"
3232
}

‎modules/infrastructure/permissions/org-role-eks/variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ variable "organizational_role_per_account" {
3939

4040
variable "tags" {
4141
type = map(string)
42-
description = "sysdig secure-for-cloud tags"
42+
description = "sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning"
4343
default = {
4444
"product" = "sysdig-secure-for-cloud"
4545
}

‎modules/infrastructure/resource-group/main.tf

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ resource "aws_resourcegroups_group" "sysdig_secure_for_cloud" {
33
name = var.name
44
tags = var.tags
55

6-
# FIXME. convert tags to JSON resource_query
76
resource_query {
87
query = <<JSON
98
{
@@ -13,7 +12,7 @@ resource "aws_resourcegroups_group" "sysdig_secure_for_cloud" {
1312
"TagFilters": [
1413
{
1514
"Key": "product",
16-
"Values": ["sysdig-secure-for-cloud"]
15+
"Values": ["${var.tags["product"]}"]
1716
}
1817
]
1918
}

‎modules/infrastructure/resource-group/variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ variable "name" {
1111

1212
variable "tags" {
1313
type = map(string)
14-
description = "sysdig secure-for-cloud tags"
14+
description = "sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning"
1515
default = {
1616
"product" = "sysdig-secure-for-cloud"
1717
}

‎modules/infrastructure/sqs-sns-subscription/variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ variable "sns_topic_arn" {
1010

1111
variable "tags" {
1212
type = map(string)
13-
description = "sysdig secure-for-cloud tags"
13+
description = "sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning"
1414
default = {
1515
"product" = "sysdig-secure-for-cloud"
1616
}

‎modules/infrastructure/ssm/variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ variable "sysdig_secure_api_token" {
1212

1313
variable "tags" {
1414
type = map(string)
15-
description = "sysdig secure-for-cloud tags"
15+
description = "sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning"
1616
default = {
1717
"product" = "sysdig-secure-for-cloud"
1818
}

‎modules/services/cloud-bench/variables.tf

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -26,17 +26,17 @@ variable "benchmark_regions" {
2626
default = []
2727
}
2828

29+
variable "provision_in_management_account" {
30+
type = bool
31+
default = true
32+
description = "Whether to deploy the stack in the management account"
33+
}
34+
2935
variable "tags" {
3036
type = map(string)
31-
description = "sysdig secure-for-cloud tags"
37+
description = "sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning"
3238

3339
default = {
3440
"product" = "sysdig-secure-for-cloud"
3541
}
3642
}
37-
38-
variable "provision_in_management_account" {
39-
type = bool
40-
default = true
41-
description = "Whether to deploy the stack in the management account"
42-
}

‎modules/services/cloud-connector/ecs-service.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ resource "aws_ecs_task_definition" "task_definition" {
2323
requires_compatibilities = ["FARGATE"]
2424
network_mode = "awsvpc"
2525
execution_role_arn = aws_iam_role.execution.arn # ARN of the task execution role that the Amazon ECS container agent and the Docker daemon can assume
26-
task_role_arn = local.ecs_task_role_arn # ARN of IAM role that allows your Amazon ECS container task to make calls to other AWS resource-group.
26+
task_role_arn = local.ecs_task_role_arn # ARN of IAM role that allows your Amazon ECS container task to make calls to other AWS services.
2727
cpu = var.ecs_task_cpu
2828
memory = var.ecs_task_memory
2929

‎modules/services/cloud-connector/variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,7 @@ variable "name" {
159159

160160
variable "tags" {
161161
type = map(string)
162-
description = "sysdig secure-for-cloud tags"
162+
description = "sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning"
163163
default = {
164164
"product" = "sysdig-secure-for-cloud"
165165
}

‎test/fixtures/organizational-k8s/main.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ module "cloudtrail_s3_sns_sqs" {
4040
source = "../../../modules/infrastructure/cloudtrail_s3-sns-sqs"
4141
cloudtrail_s3_name = var.cloudtrail_s3_name
4242
s3_event_notification_filter_prefix = var.s3_event_notification_filter_prefix
43+
name = "${var.name}-orgk8s"
4344
}
4445

4546

@@ -51,6 +52,7 @@ module "org_user" {
5152
deploy_image_scanning = false
5253
cloudtrail_s3_bucket_arn = module.cloudtrail_s3_sns_sqs.cloudtrail_s3_arn
5354
cloudtrail_subscribed_sqs_arn = module.cloudtrail_s3_sns_sqs.cloudtrail_subscribed_sqs_arn
55+
name = "${var.name}-orgk8s"
5456
}
5557

5658

0 commit comments

Comments
 (0)