You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: examples-internal/use-cases-reuse-resources/org-existing-cloudtrail-ecs-vpc-subnet.md
+37-28Lines changed: 37 additions & 28 deletions
Original file line number
Diff line number
Diff line change
@@ -5,21 +5,23 @@
5
5
**Client Setup**
6
6
7
7
-[X] organizational setup
8
-
-[X] organizational cloudtrail
9
-
-[X] centralized S3 bucket with cloudtrail-events
10
-
-[X] member account usage - all required resources (cloudtrail/s3/sns/sqs for sysdig workload) in same account (managed or specific) (?)
11
-
-[ ] member account usage - all required resources are in scattered
8
+
-[X] organizational cloudtrail that reports to SNS and persists events in a managed-account stored S3 bucket
9
+
-[X] member account usage - all required and pre-existing resources exist in the same account
10
+
- cloudtrail/sns/s3 in the management account
11
+
- and pre-existing objects in the same account where Sysdig Secure for Cloud workload is to be deployed
12
+
-[ ] member account usage - all required resources are in scattered organizational member accounts
12
13
-[X] pre-existing resources
14
+
-[X] organizational cloudtrail, reporting to an SNS topic and delivering events to the S3 bucket
15
+
-[X] ecs cluster/vpc/subnet we want to use to deploy Sysdig for Cloud workload
13
16
-[ ] k8s cluster we want to use to deploy Sysdig for Cloud workload
14
-
-[X] pre-existing ECS Cluster/VPC/Subnet we want to use to deploy Sysdig for Cloud workload
15
17
16
18
**Sysdig Secure For Cloud Features**
17
19
18
-
-[X]Threat Detection
20
+
-[X]threat Detection
19
21
-[X] all accounts of the organization (management account included)
20
-
-[ ]Image Scanning (?)
21
-
-[ ]ECR pushed images
22
-
-[ ]ECS running images
22
+
-[ ]image Scanning (?)
23
+
-[ ]ecr pushed images
24
+
-[ ]ecs running images
23
25
-[ ] CSPM/Compliance (?)
24
26
-[ ] CIEM (?)
25
27
@@ -37,13 +39,13 @@ Please contact us if something requires to be adjusted.
37
39
38
40
### Step by Step Example Guide
39
41
40
-
41
42
<!--
42
43
manual testing pre-requirements
43
44
44
45
0.1 Cloudtrail must exist. To be deployed on a separated terraform state
45
46
46
47
```
48
+
# AWS_PROFILE must point to organizatinal management account
47
49
provider "aws" {
48
50
region = "eu-west-3"
49
51
}
@@ -63,42 +65,49 @@ module "utils_cloudtrail" {
63
65
0.2. ECS/VPC/Subnet must exist. To be deployed on a separated terraform state
64
66
65
67
```
68
+
# AWS_PROFILE must point to org member account where workload is to be deployed
66
69
provider "aws" {
67
70
region = "eu-west-3"
68
71
}
69
72
70
-
module "utils_ecs-vpc-secgroup" {
73
+
module "utils_ecs-vpc" {
71
74
source = "../../modules/infrastructure/ecs-vpc"
72
75
}
73
76
```
74
77
-->
75
78
76
-
0. Configure `AWS_PROFILE` with an organizational Administration credentials
79
+
1. Configure `AWS_PROFILE` with an organizational Administration credentials
77
80
78
-
1. Choose an Organizational **Member account for Sysdig Workload** to be deployed. This accountID will be provided in the `sysdig_secure_for_cloud_member_account_id` parameter
81
+
2. Choose an Organizational **Member account for Sysdig Workload** to be deployed.
82
+
- This accountID will be provided in the `SYSDIG_SECURE_FOR_CLOUD_MEMBER_ACCOUNT_ID` parameter
83
+
- Use-case workload-related pre-existing resources (ecs,vpc,subnets) must live within this member account
79
84
80
-
2. Use `organizational` example with following parameters
85
+
3. Use `organizational` example snippet with following parameters
81
86
82
87
- General
83
-
-`AWS_REGION` Same region is to be used for all the following resources, both on the organizational managed account and sysdig workload member account
88
+
-`AWS_REGION` Same region is to be used for both organizational managed account and Sysdig workload member account resources.
89
+
-`SYSDIG_SECURE_FOR_CLOUD_MEMBER_ACCOUNT_ID` where Sysdig Workoad is to be deployed under the pre-existing ECS
84
90
85
91
- Existing Organizational Cloudtrail Setup
86
-
-`cloudtrail_sns_arn`
87
-
-`cloudtrail_s3_arn`
92
+
-`CLOUDTRAIL_SNS_ARN`
93
+
-`CLOUDTRAIL_S3_ARN`
88
94
- You MUST grant manual permissions to the organizational cloudtrail, for the AWS member-account management role `OrganizationAccountAccessRole` to be able to perform `SNS:Subscribe`.
89
-
<br/>This will be required for the CloudConnector SQS Topic subscription.
95
+
- This will be required for the CloudConnector SQS Topic subscription.
96
+
- Use [`./modules/infrastructure/cloudtrail/sns_permissions.tf`](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/blob/master/modules/infrastructure/cloudtrail/sns_permissions.tf#L22) as guideline
97
+
90
98
91
99
- Existing ECS Cluster Workload Setup
92
-
-`ecs_cluster_name` ex.: "sfc"
100
+
-`ECS_CLUSTER_NAME` ex.: "sfc"
93
101
94
102
- Existing Networking Setup
95
-
-`ecs_vpc_id` ex.: "vpc-0e91bfef6693f296b"
96
-
-`ecs_vpc_subnets_private_ids` Two subnets for the VPC. ex.: "subnet-0c7d803ecdc88437b"
103
+
-`ECS_VPC_ID` ex.: "vpc-0e91bfef6693f296b"
104
+
-`ECS_VPC_SUBNET_PRIVATE_ID_X` Two subnets for the VPC. ex.: "subnet-0c7d803ecdc88437b"
Copy file name to clipboardExpand all lines: examples/organizational/README.md
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -19,7 +19,7 @@ Minimum requirements:
19
19
1. Have an existing AWS account as the organization management account
20
20
* Organizational CloudTrail service must be enabled
21
21
*[Organizational CloudFormation StackSets](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-enable-trusted-access.html) service must be enabled
22
-
1. Configure [Terraform **AWS** Provider](https://registry.terraform.io/providers/hashicorp/aws/latest/docs) for the `management` account of the organization
22
+
2. Configure [Terraform **AWS** Provider](https://registry.terraform.io/providers/hashicorp/aws/latest/docs) for the `management` account of the organization
23
23
* This provider credentials must be [able to manage cloudtrail creation](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/creating-trail-organization.html)
24
24
> You must be logged in with the management account for the organization to create an organization trail. You must also have sufficient permissions for the IAM user or role in the management account to successfully create an organization trail.
25
25
* When an account is created within an organization, AWS will create an `OrganizationAccountAccessRole`[for account management](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html), which Sysdig Secure for Cloud will use for member-account provisioning and role assuming.
| <aname="input_ecs_cluster_name"></a> [ecs\_cluster\_name](#input\_ecs\_cluster\_name)| Name of a pre-existing ECS (elastic container service) cluster |`string`| n/a | yes |
68
+
| <aname="input_ecs_vpc_id"></a> [ecs\_vpc\_id](#input\_ecs\_vpc\_id)| ID of the VPC where the workload is to be deployed. |`string`| n/a | yes |
69
+
| <aname="input_ecs_vpc_subnets_private_ids"></a> [ecs\_vpc\_subnets\_private\_ids](#input\_ecs\_vpc\_subnets\_private\_ids)| List of VPC subnets where workload is to be deployed. |`list(string)`| n/a | yes |
67
70
| <aname="input_secure_api_token_secret_name"></a> [secure\_api\_token\_secret\_name](#input\_secure\_api\_token\_secret\_name)| Sysdig Secure API token SSM parameter name |`string`| n/a | yes |
68
71
| <aname="input_sns_topic_arn"></a> [sns\_topic\_arn](#input\_sns\_topic\_arn)| ARN of a cloudtrail-sns topic |`string`| n/a | yes |
69
72
| <aname="input_cloudwatch_log_retention"></a> [cloudwatch\_log\_retention](#input\_cloudwatch\_log\_retention)| Days to keep logs for CloudConnector |`number`|`5`| no |
70
73
| <aname="input_connector_ecs_task_role_name"></a> [connector\_ecs\_task\_role\_name](#input\_connector\_ecs\_task\_role\_name)| Default ecs cloudconnector task role name |`string`|`"ECSTaskRole"`| no |
71
-
| <aname="input_ecs_cluster_name"></a> [ecs\_cluster\_name](#input\_ecs\_cluster\_name)| Name of a pre-existing ECS (elastic container service) cluster. If defaulted, a new ECS cluster/VPC/Security Group will be created |`string`|`"create"`| no |
72
-
| <aname="input_ecs_vpc_id"></a> [ecs\_vpc\_id](#input\_ecs\_vpc\_id)| ID of the VPC where the workload is to be deployed. If defaulted, one will be created |`string`|`"create"`| no |
73
-
| <aname="input_ecs_vpc_subnets_private_ids"></a> [ecs\_vpc\_subnets\_private\_ids](#input\_ecs\_vpc\_subnets\_private\_ids)| List of VPC subnets where workload is to be deployed. Defaulted to be created when 'ecs\_cluster\_name' is not provided. |`list(string)`|`[]`| no |
74
74
| <aname="input_extra_env_vars"></a> [extra\_env\_vars](#input\_extra\_env\_vars)| Extra environment variables for the Cloud Connector deployment |`map(string)`|`{}`| no |
75
75
| <aname="input_image"></a> [image](#input\_image)| Image of the cloud connector to deploy |`string`|`"quay.io/sysdig/cloud-connector:latest"`| no |
76
76
| <aname="input_is_organizational"></a> [is\_organizational](#input\_is\_organizational)| whether secure-for-cloud should be deployed in an organizational setup |`bool`|`false`| no |
0 commit comments