Skip to content

Commit 8556e71

Browse files
author
iru
authored
refactor!: remove all providers from examples to enable conditional usage (#66)
* refactor: remove all providers * ci: revert. org hack to avoid kitchen initial destroy problem with aliased aws provider
1 parent 00421fe commit 8556e71

File tree

66 files changed

+313
-245
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

66 files changed

+313
-245
lines changed

‎.github/workflows/ci-integration-tests.yaml

Lines changed: 4 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222
name: Test-Kitchen-EKS
2323
runs-on: ubuntu-latest
2424
env:
25-
TF_VAR_sysdig_secure_endpoint: https://secure.sysdig.com
25+
TF_VAR_sysdig_secure_url: https://secure.sysdig.com
2626
TF_VAR_sysdig_secure_api_token: ${{secrets.KUBELAB_SECURE_API_TOKEN}}
2727

2828
steps:
@@ -74,12 +74,7 @@ jobs:
7474
TF_VAR_cloudnative_secretAccessKey: ${{ secrets.AWS_QA_CLOUDNATIVE_SECRET_ACCESS_KEY }}
7575
TF_VAR_region: ${{secrets.AWS_QA_MANAGED_RESOURCES_REGION }}
7676
TF_VAR_cloudtrail_s3_name: ${{ secrets.AWS_QA_MANAGED_CLOUDTRAIL_NAME }}
77-
run: |
78-
bundle exec kitchen create "organizational-k8s-aws"
79-
bundle exec kitchen converge "organizational-k8s-aws"
80-
bundle exec kitchen setup "organizational-k8s-aws"
81-
bundle exec kitchen verify "organizational-k8s-aws"
82-
bundle exec kitchen destroy "organizational-k8s-aws"
77+
run: bundle exec kitchen test "organizational-k8s-aws"
8378

8479
- name: Inspect k8s failures
8580
if: ${{ failure() }}
@@ -111,7 +106,7 @@ jobs:
111106
name: Test-Kitchen-ECS
112107
runs-on: ubuntu-latest
113108
env:
114-
TF_VAR_sysdig_secure_endpoint: https://secure.sysdig.com
109+
TF_VAR_sysdig_secure_url: https://secure.sysdig.com
115110
TF_VAR_sysdig_secure_api_token: ${{secrets.KUBELAB_SECURE_API_TOKEN}}
116111

117112
steps:
@@ -144,12 +139,7 @@ jobs:
144139
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_QA_MANAGED_SECRET_ACCESS_KEY }}
145140
AWS_REGION: ${{ secrets.AWS_REGION }}
146141
TF_VAR_sysdig_secure_for_cloud_member_account_id: ${{ secrets.AWS_QA_CLOUDNATIVE_ACCOUNT_ID }}
147-
run: |
148-
bundle exec kitchen create "organizational-aws"
149-
bundle exec kitchen converge "organizational-aws"
150-
bundle exec kitchen setup "organizational-aws"
151-
bundle exec kitchen verify "organizational-aws"
152-
bundle exec kitchen destroy "organizational-aws"
142+
run: bundle exec kitchen test "organizational-aws"
153143

154144
- name: Destroy organizational resources
155145
env:

‎.github/workflows/ci-test-cleanup.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_QA_CLOUDNATIVE_ACCESS_KEY_ID }}
1313
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_QA_CLOUDNATIVE_SECRET_ACCESS_KEY }}
1414
AWS_REGION: ${{ secrets.AWS_REGION }}
15-
TF_VAR_sysdig_secure_endpoint: https://secure.sysdig.com
15+
TF_VAR_sysdig_secure_url: https://secure.sysdig.com
1616
TF_VAR_sysdig_secure_api_token: ${{secrets.KUBELAB_SECURE_API_TOKEN}}
1717
steps:
1818
- name: Checkout
@@ -37,7 +37,7 @@ jobs:
3737
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_QA_MANAGED_SECRET_ACCESS_KEY }}
3838
AWS_REGION: ${{ secrets.AWS_REGION }}
3939
TF_VAR_sysdig_secure_for_cloud_member_account_id: ${{ secrets.AWS_QA_CLOUDNATIVE_ACCOUNT_ID }}
40-
TF_VAR_sysdig_secure_endpoint: https://secure.sysdig.com
40+
TF_VAR_sysdig_secure_url: https://secure.sysdig.com
4141
TF_VAR_sysdig_secure_api_token: ${{secrets.KUBELAB_SECURE_API_TOKEN}}
4242
steps:
4343
- name: Checkout

‎.pre-commit-terraform-validate-examples.sh

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,13 @@ bash ./resources/terraform-clean.sh
88

99
for dir in examples*/*
1010
do
11+
12+
# skip aliased providers due to terraform validate unresolved bug
13+
# https://github.com/hashicorp/terraform/issues/28490
14+
if [ $dir == "examples/organizational" ]; then
15+
echo "skipping validation on [$dir]"
16+
break
17+
fi
1118
echo validating example [$dir]
1219
cd $dir
1320
terraform init

‎CONTRIBUTE.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,8 +55,8 @@ We're using **pre-commit** | https://pre-commit.com
5555
- custom configuration | https://github.com/sysdiglabs/terraform-google-secure-for-cloud/blob/master/.pre-commit-config.yaml
5656
- current `terraform-docs` version, requires developer to create `README.md` file, with the enclosure tags for docs to insert the automated content
5757
```markdown
58-
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
59-
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
58+
<!-- BEGIN_TF_DOCS -->
59+
<!-- END_TF_DOCS -->
6060
```
6161

6262
- If pre-commit fails on Github but not on your local, try cleaning-up `terraform` files with

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ provider "sysdig" {
9393
}
9494
9595
module "cloud_bench" {
96-
source = "sysdiglabs/secure-for-cloud/aws//modules/cloud-bench"
96+
source = "sysdiglabs/secure-for-cloud/aws//modules/services/cloud-bench"
9797
}
9898
9999
```

‎examples-internal/organizational-k8s-threat-reuse_cloudtrail_s3/README.md

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,19 @@ Client is responsible for provisioning the ARN of this SQS, which will be requir
3131
For quick testing, use this snippet on your terraform files.
3232
3333
```terraform
34+
terraform {
35+
required_providers {
36+
sysdig = {
37+
source = "sysdiglabs/sysdig"
38+
configuration_aliases = [aws.member]
39+
}
40+
}
41+
}
42+
43+
provider "sysdig" {
44+
sysdig_secure_api_token = "00000000-1111-2222-3333-444444444444"
45+
}
46+
3447
provider "aws" {
3548
region = "<AWS-REGION>; ex. us-east-1"
3649
}
@@ -44,8 +57,6 @@ provider "helm" {
4457
module "org_k8s_threat_reuse_cloudtrail" {
4558
source = "sysdiglabs/secure-for-cloud/aws//examples-internal/organizational-k8s-threat-reuse_cloudtrail"
4659
47-
sysdig_secure_api_token = "00000000-1111-2222-3333-444444444444"
48-
4960
region = "CLOUDTRAIL_SNS_SQS_REGION"
5061
cloudtrail_s3_sns_sqs_url = "SQS-URL"
5162
@@ -68,7 +79,7 @@ Notice that:
6879
* This example will create resources that cost money.<br/>Run `terraform destroy` when you don't need them anymore
6980
* All created resources will be created within the tags `product:sysdig-secure-for-cloud`, within the resource-group `sysdig-secure-for-cloud`
7081

71-
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
82+
<!-- BEGIN_TF_DOCS -->
7283
## Requirements
7384

7485
| Name | Version |
@@ -107,13 +118,13 @@ Notice that:
107118
| <a name="input_cloudtrail_s3_sns_sqs_url"></a> [cloudtrail\_s3\_sns\_sqs\_url](#input\_cloudtrail\_s3\_sns\_sqs\_url) | Organization cloudtrail event notification S3-SNS-SQS URL to listen to | `string` | n/a | yes |
108119
| <a name="input_sysdig_secure_api_token"></a> [sysdig\_secure\_api\_token](#input\_sysdig\_secure\_api\_token) | Sysdig Secure API token | `string` | n/a | yes |
109120
| <a name="input_name"></a> [name](#input\_name) | Name to be assigned to all child resources. A suffix may be added internally when required. Use default value unless you need to install multiple instances | `string` | `"sfc"` | no |
110-
| <a name="input_sysdig_secure_endpoint"></a> [sysdig\_secure\_endpoint](#input\_sysdig\_secure\_endpoint) | Sysdig Secure API endpoint | `string` | `"https://secure.sysdig.com"` | no |
121+
| <a name="input_sysdig_secure_url"></a> [sysdig\_secure\_endpoint](#input\_sysdig\_secure\_endpoint) | Sysdig Secure API endpoint | `string` | `"https://secure.sysdig.com"` | no |
111122
| <a name="input_tags"></a> [tags](#input\_tags) | sysdig secure-for-cloud tags | `map(string)` | <pre>{<br> "product": "sysdig-secure-for-cloud"<br>}</pre> | no |
112123

113124
## Outputs
114125

115126
No outputs.
116-
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
127+
<!-- END_TF_DOCS -->
117128

118129

119130
## Troubleshooting

‎examples-internal/organizational-k8s-threat-reuse_cloudtrail_s3/cloud-connector.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,12 @@ resource "helm_release" "cloud_connector" {
1717

1818
set {
1919
name = "sysdig.url"
20-
value = var.sysdig_secure_endpoint
20+
value = data.sysdig_secure_connection.current.secure_url
2121
}
2222

2323
set_sensitive {
2424
name = "sysdig.secureAPIToken"
25-
value = var.sysdig_secure_api_token
25+
value = data.sysdig_secure_connection.current.secure_api_token
2626
}
2727

2828
set_sensitive {

‎examples-internal/organizational-k8s-threat-reuse_cloudtrail_s3/data.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
data "aws_region" "current" {}
2+
data "sysdig_secure_connection" "current" {}

‎examples-internal/organizational-k8s-threat-reuse_cloudtrail_s3/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,5 +11,5 @@ module "resource_group" {
1111
module "ssm" {
1212
source = "../../modules/infrastructure/ssm"
1313
name = var.name
14-
sysdig_secure_api_token = var.sysdig_secure_api_token
14+
sysdig_secure_api_token = data.sysdig_secure_connection.current.secure_api_token
1515
}

‎examples-internal/organizational-k8s-threat-reuse_cloudtrail_s3/variables.tf

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,3 @@
1-
variable "sysdig_secure_api_token" {
2-
sensitive = true
3-
type = string
4-
description = "Sysdig Secure API token"
5-
}
6-
71
variable "cloudtrail_s3_sns_sqs_url" {
82
type = string
93
description = "Organization cloudtrail event notification S3-SNS-SQS URL to listen to"
@@ -37,12 +31,6 @@ variable "name" {
3731
default = "sfc"
3832
}
3933

40-
variable "sysdig_secure_endpoint" {
41-
type = string
42-
default = "https://secure.sysdig.com"
43-
description = "Sysdig Secure API endpoint"
44-
}
45-
4634
variable "tags" {
4735
type = map(string)
4836
description = "sysdig secure-for-cloud tags"

‎examples-internal/organizational-k8s-threat-reuse_cloudtrail_s3/versions.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,5 +8,9 @@ terraform {
88
source = "hashicorp/helm"
99
version = ">=2.3.0"
1010
}
11+
sysdig = {
12+
source = "sysdiglabs/sysdig"
13+
version = ">= 0.5.33"
14+
}
1115
}
1216
}

‎examples-internal/use-cases-reuse-resources/org-existing-cloudtrail-ecs-vpc-subnet.md

Lines changed: 26 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -107,18 +107,42 @@ module "utils_ecs-vpc" {
107107
### Terraform Manifest Snippet
108108

109109
```terraform
110+
terraform {
111+
required_providers {
112+
sysdig = {
113+
source = "sysdiglabs/sysdig"
114+
configuration_aliases = [aws.member]
115+
}
116+
}
117+
}
118+
119+
provider "sysdig" {
120+
sysdig_secure_api_token = "<SYSDIG_SECURE_API_TOKEN>"
121+
}
110122
111123
provider "aws" {
112124
region = "<AWS_REGION>"
113125
}
114126
127+
provider "aws" {
128+
alias = "member"
129+
region = "<AWS_REGION>"
130+
assume_role {
131+
# 'OrganizationAccountAccessRole' is the default role created by AWS for management-account users to be able to admin member accounts.
132+
# if this is changed, please change to the `examples/organizational` input var `organizational_member_default_admin_role` too
133+
# <br/>https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html
134+
role_arn = "arn:aws:iam::<SYSDIG_SECURE_FOR_CLOUD_MEMBER_ACCOUNT_ID>:role/OrganizationAccountAccessRole"
135+
}
136+
}
137+
115138
module "sysdig-s4c" {
139+
providers = {
140+
aws.member = aws.member
141+
}
116142
117143
source = "sysdiglabs/secure-for-cloud/aws//examples/organizational"
118144
name = "sysdig-s4c"
119145
120-
sysdig_secure_api_token = "<SYSDIG_SECURE_API_TOKEN>"
121-
122146
sysdig_secure_for_cloud_member_account_id="<SYSDIG_SECURE_FOR_CLOUD_MEMBER_ACCOUNT_ID>"
123147
124148
cloudtrail_sns_arn = "<CLOUDTRAIL_SNS_ARN>"

‎examples-internal/use-cases-reuse-resources/single-existing-cloudtrail.md

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ If cloudtrail is in another account
5454
"Sid": "AllowCrossAccountSNSSubscription,
5555
"Effect": "Allow",
5656
"Principal": {
57-
"AWS": "arn:aws:iam::account-member:user/<SPECIFC_USER>"
57+
"AWS": "arn:aws:iam::account-member:user/<SPECIFIC_USER>"
5858
# or
5959
#"AWS": "arn:aws:iam::account-member:root"
6060
},
@@ -68,15 +68,26 @@ If cloudtrail is in another account
6868
### Terraform Manifest Snippet
6969

7070
```terraform
71+
terraform {
72+
required_providers {
73+
sysdig = {
74+
source = "sysdiglabs/sysdig"
75+
}
76+
}
77+
}
78+
79+
provider "sysdig" {
80+
sysdig_secure_api_token = "<SYSDIG_API_TOKEN>"
81+
}
82+
7183
provider "aws" {
72-
region = <AWS_REGION>
84+
region = "<AWS_REGION>"
7385
}
7486
7587
module "sysdig-s4c" {
7688
source = "sysdiglabs/secure-for-cloud/aws//examples/single-account"
7789
name = "sysdig-s4c"
7890
79-
sysdig_secure_api_token = <SYSDIG_API_TOKEN>
80-
cloudtrail_sns_arn = <CLOUDRAIL_SNS_TOPIC_ARN>
91+
cloudtrail_sns_arn = "<CLOUDRAIL_SNS_TOPIC_ARN>"
8192
}
8293
```

‎examples-internal/use-cases-self-baked/org-s3-k8s-filtered-account.md

Lines changed: 14 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -35,23 +35,22 @@ Skip step 4 and remove `aws_access_key_id` and `aws_secret_access_key` parameter
3535
## Suggested building-blocks
3636

3737
1. Define different **AWS providers**
38-
1. Populate `_REGION_`. Currently, same region is to be used
39-
2. Because we are going to provision resources on multiple accounts, we're gonna need several AWS providers
40-
41-
2. `s3` for s3-sns-sqs resources to be deployed. IAM user-credentials, to be used for k8s must also be in S3 account
42-
3. `sfc` for secure-for-cloud utility resources to be deployed
38+
- Populate `REGION`. Currently, same region is to be used
39+
- Because we are going to provision resources on multiple accounts, we're gonna use **two AWS providers**
40+
- `aws.s3` for s3-sns-sqs resources to be deployed. IAM user-credentials, to be used for k8s must also be in S3 account
41+
- `aws.sfc` for secure-for-cloud utility resources to be deployed
4342

4443

4544
```terraform
4645
provider "aws" {
4746
alias = "s3"
48-
region = "_REGION_"
47+
region = "<REGION>"
4948
...
5049
}
5150
5251
provider "aws" {
5352
alias = "sfc"
54-
region = "_REGION_"
53+
region = "<REGION>"
5554
...
5655
}
5756
```
@@ -72,12 +71,12 @@ provider "helm" {
7271

7372
3. **Cloudtrail-S3-SNS-SQS**
7473

75-
1. Populate `_CLOUDTRAIL_S3_NAME_`
74+
1. Populate `CLOUDTRAIL_S3_NAME`
7675
<br/>ex.:
7776
```text
7877
cloudtrail_s3_name=cloudtrail-logging-237944556329
7978
```
80-
2. Populate `_CLOUDTRAIL_S3_FILTER_PREFIX_` in order to ingest a specific-account. Otherwise just remove its assignation
79+
2. Populate `CLOUDTRAIL_S3_FILTER_PREFIX` in order to ingest a specific-account. Otherwise, just remove its assignation
8180
<br/>ex.:
8281
```text
8382
s3_event_notification_filter_prefix=cloudtrail/AWSLogs/237944556329
@@ -89,8 +88,8 @@ module "cloudtrail_s3_sns_sqs" {
8988
aws = aws.s3
9089
}
9190
source = "sysdiglabs/secure-for-cloud/aws//modules/infrastructure/cloudtrail_s3-sns-sqs"
92-
cloudtrail_s3_name = _CLOUDTRAIL_S3_NAME_
93-
s3_event_notification_filter_prefix=_CLOUDTRAIL_S3_FILTER_PREFIX_
91+
cloudtrail_s3_name = "<CLOUDTRAIL_S3_NAME>"
92+
s3_event_notification_filter_prefix="<CLOUDTRAIL_S3_FILTER_PREFIX>"
9493
}
9594
```
9695

@@ -112,7 +111,7 @@ module "org_user" {
112111

113112
5. **Sysdig workload deployment on K8s**
114113

115-
* Populate `_SYSDIG_SECURE_ENDPOINT_`, `_SYSDID_SECURE_API_TOKEN_` and `_REGION_`
114+
* Populate `sysdig_secure_url`, `SYSDID_SECURE_API_TOKEN` and `REGION`
116115

117116
```terraform
118117
resource "helm_release" "cloud_connector" {
@@ -134,12 +133,12 @@ resource "helm_release" "cloud_connector" {
134133
135134
set {
136135
name = "sysdig.url"
137-
value = "_SYSDIG_SECURE_ENDPOINT_"
136+
value = "<sysdig_secure_url>"
138137
}
139138
140139
set_sensitive {
141140
name = "sysdig.secureAPIToken"
142-
value = "_SYSDID_SECURE_API_TOKEN_"
141+
value = "<SYSDIG_SECURE_API_TOKEN>"
143142
}
144143
145144
set_sensitive {
@@ -154,7 +153,7 @@ resource "helm_release" "cloud_connector" {
154153
155154
set {
156155
name = "aws.region"
157-
value = "_REGION_"
156+
value = "<REGION>"
158157
}
159158
160159
values = [

0 commit comments

Comments
 (0)