Skip to content

Commit 30b14c7

Browse files
author
iru
authored
docs: split manual compliance use-case (#140)
1 parent 9c4f86f commit 30b14c7

File tree

2 files changed

+120
-112
lines changed

2 files changed

+120
-112
lines changed

‎use-cases/manual-compliance.md

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
# Compliance
2+
3+
On each account where compliance wants to be checked (`AWS_ACCOUNT_ID`), we need to provide a role for Sysdig to be able to impersonate and perform `SecurityAudit` tasks.
4+
5+
In addition, we must make Sysdig aware of these accounts and role.
6+
We will guide you to provide, on the Sysdig Secure SaaS backend, the following resources:
7+
- a cloud-account for each account of your organization where compliance is wanted to be checked
8+
- a task that will run `aws_foundations_bench-1.3.0` schema on previously defined accounts
9+
10+
## Sysdig Side
11+
12+
1. **Register cloud accounts** on Sysdig
13+
14+
For each account you want to provision for the Compliance feature, we need to register it on Sysdig Secure, so
15+
it can impersonate and perform `SecurityAudit` tasks.
16+
17+
For Sysdig Secure backend API communication [How to use development tools](https://docs.sysdig.com/en/docs/developer-tools/). Also, we have this [AWS provisioning script](./utils/sysdig_cloud_compliance_provisioning.sh) as reference, but we will explain it here too.
18+
```shell
19+
$ curl "https://<SYSDIG_SECURE_ENDPOINT>/api/cloud/v2/accounts?upsert=true" \
20+
--header "Authorization: Bearer <SYSDIG_SECURE_API_TOKEN>" \
21+
-X POST \
22+
-H 'Accept: application/json' \
23+
-H 'Content-Type: application/json' \
24+
-d '{
25+
"accountId": "<AWS_ACCOUNT_ID>",
26+
"alias": "<AWS_ACCOUNT_ALIAS>",
27+
"provider": "aws",
28+
"roleAvailable": true,
29+
"roleName": "SysdigComplianceRole"
30+
}'
31+
```
32+
<br/>
33+
34+
2. Register **Benchmark Task**
35+
36+
Create a single task to scope the organization account ids (or just a single account) to be assessed with the
37+
`aws_foundations_bench-1.3.0` compliance framework.
38+
39+
This script does not cover it, but specific regions can be scoped too. Check `Benchmarks-V2` REST-API for more detail
40+
```shell
41+
$ curl -s "https://<SYSDIG_SECURE_ENDPOINT>/api/benchmarks/v2/tasks" \
42+
--header "Authorization: Bearer <SYSDIG_SECURE_API_TOKEN>" \
43+
-X POST \
44+
-H 'Accept: application/json' \
45+
-H 'Content-Type: application/json' \
46+
-d '{
47+
"name": "Sysdig Secure for Cloud (AWS) - Organization",
48+
"schedule": "0 3 * * *",
49+
"schema": "aws_foundations_bench-1.2.0",
50+
"scope": "aws.accountId in ('<AWS_ACCOUNT_ID_1>',...,'<AWS_ACCOUNT_ID_N>')'",
51+
"enabled": true
52+
}'
53+
```
54+
55+
<br/>
56+
57+
3. Get **Sysdig Federation Trusted Identity**
58+
59+
For later usage, fetch the Trusted Identity `SYSDIG_AWS_TRUSTED_IDENTITY_ARN`
60+
61+
```shell
62+
$ curl -s 'https://<SYSDIG_SECURE_ENDPOINT>/api/cloud/v2/aws/trustedIdentity' \
63+
--header 'Authorization: Bearer <SYSDIG_SECURE_API_TOKEN>'
64+
```
65+
66+
Response pattern:
67+
```shell
68+
arn:aws:iam::SYSDIG_AWS_ACCOUNT_ID:role/SYSDIG_AWS_ROLE_NAME
69+
```
70+
71+
<br/>
72+
73+
4. Get **Sysdig ExternalId**
74+
75+
For later usage, fetch `SYSDIG_AWS_EXTERNAL_ID` from one of the previously registered GCP accounts. All accounts will have same id (you only need to run it once).
76+
```shell
77+
$ curl -s "https://<SYSDIG_SECURE_ENDPOINT>/api/cloud/v2/accounts/<AWS_ACCOUNT_ID>?includeExternalId=true" \
78+
--header "Authorization: Bearer <SYSDIG_SECURE_API_TOKEN>"
79+
```
80+
From the resulting payload get the `externalId` attribute value.
81+
82+
<br/>
83+
84+
## Customer's Side
85+
86+
Now create `SysdigCompliance` role on each account using the values gathered in previous step.
87+
- Add `arn:aws:iam::aws:policy/SecurityAudit` AWS managed policy
88+
- Allow following Trusted-Identity
89+
```json
90+
{
91+
"Effect": "Allow",
92+
"Action": "sts:AssumeRole",
93+
"Principal": {
94+
"AWS": [ "<SYSDIG_AWS_TRUSTED_IDENTITY_ARN>" ]
95+
},
96+
"Condition": {
97+
"StringEquals": {"sts:ExternalId": "<SYSDIG_AWS_EXTERNAL_ID>"}
98+
}
99+
}
100+
```
101+
102+
## End-To-End Validation
103+
104+
Validate if Sysdig <-> Customer infra connection is properly made using [`/cloud/accounts/{accountId}/validateRole`](https://secure.sysdig.com/swagger.html#tag/Cloud/paths/~1api~1cloud~1v2~1accounts~1{accountId}~1validateRole/get)
105+
106+
```bash
107+
$ https://<SYSDIG_SECURE_ENDPOINT>/api/cloud/v2/accounts/<AWS_ACCOUNT_ID>/validateRole \
108+
--header 'Authorization: Bearer <SYSDIG_SECURE_API_TOKEN>'
109+
```
110+
111+
You should get success or the reason of failure.
112+
113+
114+
## Testing
115+
116+
Check within Sysdig Secure
117+
- Posture > Compliance for the compliance task schedule
118+
- [Official Docs Check Guide](https://docs.sysdig.com/en/docs/installation/sysdig-secure-for-cloud/deploy-sysdig-secure-for-cloud-on-aws/#confirm-the-services-are-working)

‎use-cases/manual-org-three-way.md

Lines changed: 2 additions & 112 deletions
Original file line numberDiff line numberDiff line change
@@ -263,7 +263,6 @@ If using Kubernetes, we will make use of the [Sysdig cloud-connector helm chart]
263263

264264
Provided the following `values.yaml` template
265265
```yaml
266-
-- values.yaml suggestion
267266
sysdig:
268267
url: "https://secure.sysdig.com"
269268
secureAPIToken: "SYSDIG_API_TOKEN"
@@ -297,9 +296,9 @@ If using , AWS ECS (Elastic Container Service), we will create a new Fargate Tas
297296

298297
- TaskRole: Use previously created `SysdigComputeRole`
299298
- Task memory (GB): 0.5 and Task CPU (vCPU: 0.25 will suffice
300-
- Container definition:
299+
- Container definition
301300
- Image: `quay.io/sysdig/cloud-connector:latest`
302-
- Port Mappings; bind port 5000:5000 tcp protocol
301+
- Port Mappings; bind port 5000 tcp protocol
303302
- Environment variables
304303
- SECURE_URL
305304
- SECURE_API_TOKEN
@@ -341,120 +340,11 @@ ExecutionRole
341340
}
342341
-->
343342

344-
## Compliance
345-
346-
On each member-account where compliance wants to be checked (`AWS_ACCOUNT_ID`), we need to provide a role for Sysdig to be able to impersonate and perform `SecurityAudit` tasks.
347-
348-
In addition, we must make Sysdig aware of this accounts and role.
349-
We will guide you to provide, on the Sysdig Secure SaaS backend, the following resources:
350-
- a cloud-account for each member account of your organization where compliance is wanted to be checked
351-
- a task that will run "aws_foundations_bench-1.3.0" schema on previously defined accounts
352-
353-
### Sysdig Side
354-
355-
356-
### 1. **Compliance setup** on Sysdig backend and AWS Accounts
357-
358-
1. **Register Organization accounts** on Sysdig
359-
- For each account you want to provision for the Compliance feature, we need to register it on Sysdig Secure, so
360-
it can impersonate and perform `SecurityAudit` tasks.
361-
- For Sysdig Secure backend API communication [How to use development tools](https://docs.sysdig.com/en/docs/developer-tools/). Also, we have this [AWS provisioning script](./utils/sysdig_cloud_compliance_provisioning.sh) as reference, but we will explain it here too.
362-
```shell
363-
$ curl "https://<SYSDIG_SECURE_ENDPOINT>/api/cloud/v2/accounts?upsert=true" \
364-
--header "Authorization: Bearer <SYSDIG_SECURE_API_TOKEN>" \
365-
-X POST \
366-
-H 'Accept: application/json' \
367-
-H 'Content-Type: application/json' \
368-
-d '{
369-
"accountId": "<AWS_ACCOUNT_ID>",
370-
"alias": "<AWS_ACCOUNT_ALIAS>",
371-
"provider": "aws",
372-
"roleAvailable": true,
373-
"roleName": "SysdigComplianceRole"
374-
}'
375-
```
376-
<br/>
377-
378-
2. Register **Benchmark Task**
379-
- Create a single task to scope the organization account ids to be assessed with the "aws_foundations_bench-1.3.0"
380-
compliance framework
381-
- This script does not cover it, but specific regions can be scoped too. Check `Benchmarks-V2` REST-API for more detail
382-
```shell
383-
$ curl -s "https://<SYSDIG_SECURE_ENDPOINT>/api/benchmarks/v2/tasks" \
384-
--header "Authorization: Bearer <SYSDIG_SECURE_API_TOKEN>" \
385-
-X POST \
386-
-H 'Accept: application/json' \
387-
-H 'Content-Type: application/json' \
388-
-d '{
389-
"name": "Sysdig Secure for Cloud (AWS) - Organization",
390-
"schedule": "0 3 * * *",
391-
"schema": "aws_foundations_bench-1.2.0",
392-
"scope": "aws.accountId in ('<AWS_ACCOUNT_ID_1>',...,'<AWS_ACCOUNT_ID_N>')'",
393-
"enabled": true
394-
}'
395-
```
396-
397-
<br/>
398-
399-
3. Get **Sysdig Federation Trusted Identity**
400-
- For later usage, fetch the Trusted Identity `SYSDIG_AWS_TRUSTED_IDENTITY_ARN`
401-
```shell
402-
$ curl -s 'https://<SYSDIG_SECURE_ENDPOINT>/api/cloud/v2/aws/trustedIdentity' \
403-
--header 'Authorization: Bearer <SYSDIG_SECURE_API_TOKEN>'
404-
```
405-
Response pattern:
406-
```shell
407-
arn:aws:iam::SYSDIG_AWS_ACCOUNT_ID:role/SYSDIG_AWS_ROLE_NAME
408-
```
409-
<br/>
410-
411-
4. Get **Sysdig ExternalId**
412-
- For later usage, fetch `SYSDIG_AWS_EXTERNAL_ID` from one of the previously registered GCP accounts. All accounts will have same id (you only need to run it once).
413-
```shell
414-
$ curl -s "https://<SYSDIG_SECURE_ENDPOINT>/api/cloud/v2/accounts/<AWS_ACCOUNT_ID>?includeExternalId=true" \
415-
--header "Authorization: Bearer <SYSDIG_SECURE_API_TOKEN>"
416-
```
417-
From the resulting payload get the `externalId` attribute value.
418-
419-
<br/>
420-
421-
### Customer's Side
422-
423-
1. Now create `SysdigCompliance` role on each member account using the values gathered in previous step.
424-
- Add `arn:aws:iam::aws:policy/SecurityAudit` AWS managed policy
425-
- Allow following Trusted-Identity
426-
```json
427-
{
428-
"Effect": "Allow",
429-
"Action": "sts:AssumeRole",
430-
"Principal": {
431-
"AWS": [ "<SYSDIG_AWS_TRUSTED_IDENTITY_ARN>" ]
432-
},
433-
"Condition": {
434-
"StringEquals": {"sts:ExternalId": "<SYSDIG_AWS_EXTERNAL_ID>"}
435-
}
436-
}
437-
```
438-
439-
### End-To-End Validation
440-
441-
Validate if Sysdig <-> Customer infra connection is properly made using [`/cloud/accounts/{accountId}/validateRole`](https://secure.sysdig.com/swagger.html#tag/Cloud/paths/~1api~1cloud~1v2~1accounts~1{accountId}~1validateRole/get)
442-
443-
```bash
444-
$ https://<SYSDIG_SECURE_ENDPOINT>/api/cloud/v2/accounts/<AWS_ACCOUNT_ID>/validateRole \
445-
--header 'Authorization: Bearer <SYSDIG_SECURE_API_TOKEN>'
446-
```
447-
448-
You should get success or the reason of failure.
449-
450-
<br/>
451-
452343

453344
## Testing
454345

455346
Check within Sysdig Secure
456347
- Integrations > Cloud Accounts
457-
- Posture > Compliance for the compliance task schedule
458348
- Insights > Cloud Activity
459349

460350
- [Official Docs Check Guide](https://docs.sysdig.com/en/docs/installation/sysdig-secure-for-cloud/deploy-sysdig-secure-for-cloud-on-gcp/#confirm-the-services-are-working)

0 commit comments

Comments
 (0)