Skip to content

Commit 2c97cfa

Browse files
radhikapcradhikapc
authored
docs: edits use-cases for clarity (#174)
1 parent 375e87a commit 2c97cfa

File tree

5 files changed

+183
-175
lines changed

5 files changed

+183
-175
lines changed

‎use-cases/org-existing-cloudtrail-ecs-vpc-subnet.md

Lines changed: 30 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,41 +1,37 @@
1-
# OrganizationSetup - Existing Cloudtrail - Existing ECS/VPC/Subnet
1+
# AWS Organizational Setup with Existing ECS Environment
22

3-
## Use-Case explanation
3+
## Overview
44

5-
**Client Setup**
5+
This usecase covers securing an AWS organizational setup consisting an existing ECS cluster with its own VPC and subnet.
66

7-
- [X] organizational setup
8-
- [X] organizational cloudtrail that reports to SNS and persists events in a managed-account stored S3 bucket
9-
- [X] member account usage - all required and pre-existing resources exist in the same account
10-
- cloudtrail/sns/s3 in the management account
11-
- and pre-existing objects in the same account where Sysdig Secure for Cloud workload is to be deployed
12-
- [ ] member account usage - all required resources are in scattered organizational member accounts
13-
- [X] pre-existing resources
14-
- [X] organizational cloudtrail, reporting to an SNS topic and delivering events to the S3 bucket
15-
- [X] ecs cluster/vpc/subnet we want to use to deploy Sysdig for Cloud workload
16-
- [ ] k8s cluster we want to use to deploy Sysdig for Cloud workload
7+
### User Setup
178

18-
**Sysdig Secure For Cloud Features**
9+
- [X] AWS organizational account
10+
- [X] Organizational Cloudtrail that reports to SNS and persists events in a managed-account S3 bucket
11+
- [X] Member account usage: All the required and pre-existing resources exist in the same account
12+
- Cloudtrail, SNS, and S3 in the Management account
13+
- Pre-existing objects in the same account where Sysdig Secure for Cloud workload is to be deployed
14+
- [ ] Member account usage: All the required resources reside in different member accounts
15+
- [X] Pre-existing resources
16+
- [X] Organizational cloudtrail reporting to an SNS topic and delivering events to the S3 bucket
17+
- [X] ECS cluster with VPC and subnet to deploy Sysdig for Cloud workload
18+
- [ ] Kubernetes cluster to deploy Sysdig for Cloud workload
1919

20-
- [X] threat Detection
21-
- [X] all accounts of the organization (management account included)
20+
### Sysdig Secure For Cloud Features
21+
22+
- [X] Threat Detection
23+
- [X] all accounts of the organization, including the Management account
2224
- [ ] image Scanning (?)
23-
- [ ] ecr pushed images
24-
- [ ] ecs running images
25+
- [ ] ECR pushed images
26+
- [ ] ECS running images
2527
- [ ] CSPM/Compliance (?)
2628
- [ ] CIEM (?)
2729

30+
## Preparation
2831

32+
For this usecase, you will use the [`./examples/organizational`](../examples/organizational/README.md) setup. In order for this setup to work, several roles and permissions are required. Before proceeding, see the [readme](../examples/organizational/README.md) and check whether you comply with the requirements.
2933

30-
31-
## Suggested setup
32-
33-
For this use-case we're going to use the [`./examples/organizational`](../examples/organizational/README.md) setup.
34-
In order for this setup to work, several roles and permissions are required.
35-
Before proceeding, please read the example README and check whether you comply with requirements.
36-
37-
Please contact us if something requires to be adjusted.
38-
34+
Contact Sysdig for support.
3935

4036
### Step by Step Example Guide
4137

@@ -76,17 +72,17 @@ module "utils_ecs-vpc" {
7672
```
7773
-->
7874

79-
1. Configure `AWS_PROFILE` with an organizational Administration credentials
75+
1. Configure `AWS_PROFILE` with an organizational administration credentials.
8076

81-
2. Choose an Organizational **Member account for Sysdig Workload** to be deployed.
82-
- This accountID will be provided in the `SYSDIG_SECURE_FOR_CLOUD_MEMBER_ACCOUNT_ID` parameter
83-
- Use-case workload-related pre-existing resources (ecs,vpc,subnets) must live within this member account
77+
2. Choose an Organizational member account for Sysdig Workload to be deployed.
78+
- Note the account ID of this account. This value will be provided in the `SYSDIG_SECURE_FOR_CLOUD_MEMBER_ACCOUNT_ID` parameter.
79+
- Ensure that workload resources (ECS, VPC, subnets) exist in this member account.
8480

85-
3. Use `organizational` example snippet with following parameters
81+
3. Use the `organizational` example snippet with following parameters:
8682

8783
- General
88-
- `AWS_REGION` Same region is to be used for both organizational managed account and Sysdig workload member account resources.
89-
- `SYSDIG_SECURE_FOR_CLOUD_MEMBER_ACCOUNT_ID` where Sysdig Workload is to be deployed under the pre-existing ECS
84+
- `AWS_REGION` : Same region is to be used for both organizational managed account and Sysdig workload member account resources.
85+
- `SYSDIG_SECURE_FOR_CLOUD_MEMBER_ACCOUNT_ID`: where Sysdig Workload is to be deployed under the pre-existing ECS
9086

9187
- Existing Organizational Cloudtrail Setup
9288
- `CLOUDTRAIL_SNS_ARN`
@@ -103,7 +99,6 @@ module "utils_ecs-vpc" {
10399
- `ECS_VPC_ID` ex.: "vpc-0e91bfef6693f296b"
104100
- `ECS_VPC_SUBNET_PRIVATE_ID_X` Two subnets for the VPC. ex.: "subnet-0c7d803ecdc88437b"<br/><br/>
105101

106-
107102
### Terraform Manifest Snippet
108103

109104
```terraform

‎use-cases/org-single-account.md

Lines changed: 23 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,39 @@
1-
# OrganizationSetup - Single-Account deployment
1+
# Organization Setup: Single Account Deployment
22

3-
## Use-Case explanation
3+
## Overview
44

5-
This use case will cover the way of deploying `examples/organizational` within a more limited scope (single-account)
5+
This use case will leverage the [`examples/organizational`](./examples/organizational/README.md) setup within a more limited scope (single-account). Therefore, the CloudTrail you will set up will be organizational.
66

7-
> Being able to **allow/deny member accounts** where SecureForCloud is deployed, in organizational example, is under
8-
> feature-request.
7+
> Being able to allow/deny member accounts where Secure for Cloud is deployed is under development.
98
10-
### Scope and Limitations
9+
### Features
1110

12-
- While the feature-request is being developed, this workaround will only cover following [features](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud#sysdig-secure-for-cloud-in-aws)
13-
- [x] Thread Detection
14-
- [x] Compliance
15-
- [x] Identity and Access Management
16-
- [ ] Image scanning
17-
- Because we will still rely on organizational setup, the **cloudtrail will still be organizational**
11+
This use case provides the following [Sysdig Secure For Cloud](https://docs.sysdig.com/en/docs/sysdig-secure/sysdig-secure-for-cloud/#features) features:
1812

19-
## Suggested setup
13+
- [Threat Detection](https://docs.sysdig.com/en/docs/sysdig-secure/policies/threat-detect-policies/)
14+
- [Posture](https://docs.sysdig.com/en/docs/sysdig-secure/posture/)
15+
- [Compliance](https://docs.sysdig.com/en/docs/sysdig-secure/posture/compliance/)
16+
- [Identity Access Management](https://docs.sysdig.com/en/docs/sysdig-secure/posture/identity-and-access/)
2017

21-
We will rely on
18+
## Preparation
2219

23-
- the `deploy_benchmark_organizational"` input variable of the example.
20+
You will use the following to enable single account deployment:
21+
22+
### `deploy_benchmark_organizational`
23+
24+
You will set the `deploy_benchmark_organizational"` variable to false in the terraform configuration.
2425

2526
| Name | Description | Type | Default | Required |
2627
|------|-------------|------|---------|:--------:|
27-
| <a name="input_deploy_benchmark_organizational"></a> [deploy\_benchmark\_organizational](#input\_deploy\_benchmark\_organizational) | true/false whether benchmark module should be deployed on organizational or single-account mode (1 role per org accounts if true, 1 role in default aws provider account if false)</li></ul> | `bool` | `true` | no |
28+
| <a name="input_deploy_benchmark_organizational"></a> [deploy\_benchmark\_organizational](#input\_deploy\_benchmark\_organizational) | Determines if the benchmark module should be deployed on organizational or single-account mode. Creates one role per org accounts if true. Creates one role in the default aws provider account if false)</li></ul> | `bool` | `true` | no |
29+
30+
### AWS Terraform Providers
31+
32+
You will work on the following setups: default and member terraform providers.
2833

34+
1. Member account: Use the [default use-case snippet](#terraform-snippet) to deploy compute and compliance role in a member account.
35+
2. Management account: Use the [default use-case snippet](#terraform-snippet) to deploy compute on the Management account.
2936

30-
- the two aws terraform providers (default, member); here we will work two setups
31-
1. to deploy compute and compliance role **just in one member account**, use [default use-case snippet](#terraform-snippet)
32-
1. to deploy compute part **on management account**, use following provider setup on the [default use-case snippet](#terraform-snippet)<br/>
3337
```terraform
3438
provider "aws" {
3539
region = var.region

0 commit comments

Comments
 (0)