Skip to content

Commit 7d14282

Browse files
author
iru
committed
chore(doc): diagram review
1 parent 3ea403c commit 7d14282

File tree

4 files changed

+72
-50
lines changed

4 files changed

+72
-50
lines changed

‎examples/organizational/diagram-org.png

10.4 KB
Loading

‎examples/organizational/diagram-org.py

Lines changed: 48 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# diagrams as code vía https://diagrams.mingrammer.com
22
from diagrams import Cluster, Diagram, Edge, Node
3-
from diagrams.aws.compute import ElasticContainerServiceService
3+
from diagrams.aws.compute import ElasticContainerServiceService, ECR
44
from diagrams.aws.devtools import Codebuild
55
from diagrams.aws.general import General
66
from diagrams.aws.integration import SNS, SQS
@@ -14,68 +14,83 @@
1414
}
1515

1616
role_attr = {
17-
"height":"1",
18-
"width":"0.8",
17+
"imagescale":"false",
18+
"height":"1.5",
19+
"width":"3",
1920
"fontsize":"9",
2021
}
2122

22-
event_color="firebrick"
23+
color_event="firebrick"
24+
color_scanning = "dark-green"
25+
color_permission="red"
26+
color_non_important="gray"
27+
color_sysdig="lightblue"
2328

24-
with Diagram("Sysdig Secure for Cloud\n(organizational usecase)", graph_attr=diagram_attr, filename="diagram-org", show=True):
2529

26-
with Cluster("AWS organization"):
27-
28-
with Cluster("member accounts (main targets)", graph_attr={"bgcolor":"lightblue"}):
29-
member_accounts = [General("account-1"), General("account-2"), General("..."), General("account-n")]
3030

31-
org_member_role = IAMRole("OrganizationAccountAccessRole\n(created by AWS for org. member accounts)", **role_attr)
31+
with Diagram("Sysdig Secure for Cloud\n(organizational)", graph_attr=diagram_attr, filename="diagram-org", show=True, direction="LR"):
3232

33+
with Cluster("AWS organization"):
3334

34-
with Cluster("master account"):
3535

36+
with Cluster("management account"):
3637

3738
cloudtrail = Cloudtrail("cloudtrail", shape="plaintext")
38-
cloudtrail_legend = ("for clarity purpose events received from 'secure for cloud' member account\n\
39-
and master account have been removed from diagram, but will be processed too ")
4039

41-
Node(label=cloudtrail_legend, width="5",shape="plaintext", labelloc="t", fontsize="10")
4240

43-
master_credentials = IAM("credentials \npermissions: cloudtrail, role creation,...", fontsize="10")
44-
secure_for_cloud_role = IAMRole("SysdigSecureForCloudRole", **role_attr)
41+
management_credentials = IAM("credentials \npermissions: cloudtrail, role creation,...", fontsize="10")
42+
secure_for_cloud_role = IAMRole("SysdigSecureForCloudRole\n\(enabled to assumeRole on `OrganizationAccountAccessRole`)", **role_attr)
4543
cloudtrail_s3 = S3("cloudtrail-s3-events")
4644
sns = SNS("cloudtrail-sns-events", comment="i'm a graph")
4745

48-
cloudtrail >> Edge(color=event_color, style="dashed") >> cloudtrail_s3 >> Edge(color=event_color, style="dashed") >> sns
46+
cloudtrail >> Edge(color=color_event, style="dashed") >> cloudtrail_s3 >> Edge(color=color_event, style="dashed") >> sns
4947

48+
with Cluster("member accounts (main targets)", graph_attr={"bgcolor":"lightblue"}):
49+
member_accounts = General("account-1..n")
50+
org_member_role_1 = IAMRole("OrganizationAccountAccessRole\n(created by AWS for org. member accounts)", **role_attr)
51+
ecr = ECR("container-registry\n *within any account")
5052

5153

5254
with Cluster("member account (secure for cloud)", graph_attr={"bgcolor":"seashell2"}):
5355

54-
org_member_role = IAMRole("OrganizationAccountAccessRole\n(created by AWS for org. member accounts)", **role_attr)
55-
56-
with Cluster("ecs-cluster"):
57-
cloud_connector = ElasticContainerServiceService("cloud-connector")
58-
cloud_scanning = ElasticContainerServiceService("cloud-scanning")
56+
org_member_role_2 = IAMRole("OrganizationAccountAccessRole\n(created by AWS for org. member accounts)", **role_attr)
5957

6058
sqs = SQS("cloudtrail-sqs")
6159
s3_config = S3("cloud-connector-config")
6260
cloudwatch = Cloudwatch("cloudwatch\nlogs and alarms")
63-
codebuild = Codebuild("codebuild project")
61+
codebuild = Codebuild("codebuild project")
6462

65-
sqs << Edge(color=event_color) << cloud_connector
66-
sqs << Edge(color=event_color) << cloud_scanning
67-
cloud_connector - s3_config
68-
cloud_connector >> cloudwatch
63+
with Cluster("ecs-cluster"):
64+
cloud_connector = ElasticContainerServiceService("cloud-connector")
65+
cloud_scanning = ElasticContainerServiceService("cloud-scanning")
66+
67+
sqs << Edge(color=color_event) << cloud_connector
68+
sqs << Edge(color=color_event) << cloud_scanning
69+
cloud_connector - Edge(color=color_non_important) - s3_config
70+
cloud_connector >> Edge(color=color_non_important) >> cloudwatch
71+
cloud_scanning >> Edge(color=color_non_important) >> cloudwatch
6972
cloud_scanning >> codebuild
73+
codebuild >> Edge(color=color_non_important) >> ecr
74+
75+
76+
member_accounts >> Edge(color=color_event, style="dashed") >> cloudtrail
77+
sns >> Edge(color=color_event, style="dashed") >> sqs
78+
# cloudtrail_s3 << Edge(color=color_non_important) << cloud_connector
79+
# cloudtrail_s3 << Edge(color=color_non_important) << cloud_scanning
80+
# secure_for_cloud_role << Edge(color=color_permission, fontcolor=color_permission, xlabel="assumeRole") << cloud_connector
81+
# (cloudtrail_s3 << Edge(color=color_event) <<
7082

7183

72-
member_accounts >> Edge(color=event_color, style="dashed") >> cloudtrail
73-
sns >> Edge(color=event_color, style="dashed") >> sqs
74-
# cloudtrail_s3 << Edge(color=event_color) << cloud_connector
75-
(cloudtrail_s3 << Edge(color=event_color) << secure_for_cloud_role) - Edge(xlabel="assumeRole", color=event_color) - cloud_connector
7684

7785
with Cluster("AWS account (sysdig)"):
7886
sds = Custom("Sysdig Secure", "../../resources/diag-sysdig-icon.png")
7987

80-
cloud_connector >> sds
81-
codebuild >> sds
88+
89+
cloud_connector >> Edge(color=color_sysdig) >> sds
90+
codebuild >> Edge(color=color_sysdig) >> sds
91+
92+
# secure_for_cloud_role >> Edge(color=color_permission, fontcolor=color_permission, xlable="assumeRole") >> org_member_role_1
93+
94+
95+
# cloudtrail_legend = ("to simplify,\l- events received from 'secure for cloud' member account and management account have been removed from diagram, but will be processed too")
96+
# Node(label=cloudtrail_legend, shape="plaintext", labelloc="t", width="10", fontsize="10" )

‎examples/single-account/diagram-single.png

-7.46 KB
Loading

‎examples/single-account/diagram-single.py

Lines changed: 24 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
from diagrams.aws.storage import S3, SimpleStorageServiceS3Bucket
77
from diagrams.aws.integration import SNS
88
from diagrams.aws.integration import SQS
9-
from diagrams.aws.compute import ECS, ElasticContainerServiceService
9+
from diagrams.aws.compute import ECS, ElasticContainerServiceService, ECR
1010
from diagrams.aws.security import IAMRole,IAM
1111
from diagrams.aws.management import Cloudwatch
1212
from diagrams.aws.devtools import Codebuild
@@ -23,16 +23,22 @@
2323
# "fontsize":"10",
2424
}
2525

26-
event_color="firebrick"
2726

28-
with Diagram("Sysdig Secure for Cloud{}(single-account usecase)".format("\n"), graph_attr=diagram_attr, filename="diagram-single", show=True):
27+
color_event="firebrick"
28+
color_scanning = "dark-green"
29+
color_permission="red"
30+
color_non_important="gray"
31+
color_sysdig="lightblue"
32+
33+
with Diagram("Sysdig Secure for Cloud{}(single-account)".format("\n"), graph_attr=diagram_attr, filename="diagram-single", show=True):
2934

3035
with Cluster("AWS account (target)"):
3136

3237
master_credentials = IAM("credentials \npermissions: cloudtrail, role creation,...", fontsize="10")
3338

3439
with Cluster("other resources", graph_attr={"bgcolor":"lightblue"}):
35-
account_resources = [General("resource-1"),General("..."),General("resource-n")]
40+
account_resources = [General("resource-1..n")]
41+
ecr = ECR("container-registry")
3642

3743
with Cluster("sysdig-secure-for-cloud resources"):
3844

@@ -44,7 +50,7 @@
4450
cloudtrail_s3 = S3("cloudtrail-s3-events")
4551
sns = SNS("cloudtrail-sns-events", comment="i'm a graph")
4652

47-
cloudtrail >> Edge(color=event_color, style="dashed") >> cloudtrail_s3 >> Edge(color=event_color, style="dashed") >> sns
53+
cloudtrail >> Edge(color=color_event, style="dashed") >> cloudtrail_s3 >> Edge(color=color_event, style="dashed") >> sns
4854

4955
with Cluster("ecs-cluster"):
5056
cloud_connector = ElasticContainerServiceService("cloud-connector")
@@ -55,21 +61,22 @@
5561
cloudwatch = Cloudwatch("cloudwatch\n(logs and alarms)")
5662
codebuild = Codebuild("Build-project")
5763

58-
sqs << Edge(color=event_color) << cloud_connector
59-
sqs << Edge(color=event_color) << cloud_scanning
60-
cloud_connector - s3_config
61-
cloud_connector >> cloudwatch
62-
cloud_scanning >> cloudwatch
64+
sqs << Edge(color=color_event) << cloud_connector
65+
sqs << Edge(color=color_event) << cloud_scanning
66+
cloud_connector - Edge(color=color_non_important) - s3_config
67+
cloud_connector >> Edge(color=color_non_important) >> cloudwatch
68+
cloud_scanning >> Edge(color=color_non_important) >> cloudwatch
6369
cloud_scanning >> codebuild
70+
codebuild >> Edge(color=color_non_important) >> ecr
6471

6572

6673
# bench-role
6774
cloud_bench_role = IAMRole("SysdigCloudBench\n(aws:SecurityAudit policy)", **role_attr)
6875

69-
account_resources >> Edge(color=event_color, style="dashed") >> cloudtrail
70-
sns >> Edge(color=event_color, style="dashed") >> sqs
71-
(cloudtrail_s3 << Edge(color=event_color)) - cloud_connector
72-
(cloudtrail_s3 << Edge(color=event_color)) - cloud_scanning
76+
account_resources >> Edge(color=color_event, style="dashed") >> cloudtrail
77+
sns >> Edge(color=color_event, style="dashed") >> sqs
78+
(cloudtrail_s3 << Edge(color=color_non_important)) - cloud_connector
79+
(cloudtrail_s3 << Edge(color=color_non_important)) - cloud_scanning
7380

7481
with Cluster("AWS account (sysdig)"):
7582
sds_account = General("cloud-bench")
@@ -78,6 +85,6 @@
7885
sds - Edge(label="aws_foundations_bench\n schedule on 0 6 * * *") >> sds_account
7986

8087

81-
cloud_connector >> sds
82-
cloud_scanning >> sds
83-
sds_account >> Edge(color="darkgreen", xlabel="assumeRole") >> cloud_bench_role
88+
cloud_connector >> Edge(color=color_sysdig) >> sds
89+
codebuild >> Edge(color=color_sysdig) >> sds
90+
sds_account >> Edge(color=color_permission, fontcolor=color_permission, xlabel="assumeRole") >> cloud_bench_role

0 commit comments

Comments
 (0)