Skip to content

Commit 93f26a2

Browse files
author
iru
committed
doc: add self-baked example
1 parent b0158e3 commit 93f26a2

File tree

1 file changed

+202
-0
lines changed

1 file changed

+202
-0
lines changed

‎examples-internal/use-cases-self-baked/multiple-accounts-k8s-threat.md

Lines changed: 202 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,202 @@
1+
# Multi-Account - Existing Cloudtrails per account - Existing K8s Cluster
2+
3+
## Use-Case explanation
4+
5+
**Current User Setup**
6+
7+
- [X] multi-account setup
8+
- [X] per-account cloudtrail, each reporting to their own S3 bucket
9+
- [X] pre-existing resources
10+
- [?] multiple cloudtrail-S3 buckets synced to a single S3 bucket to which an SQS is attached
11+
- [?] multiple cloudtrail-S3 buckets reporting to same SQS
12+
- [X] k8s cluster we want to use to deploy Sysdig for Cloud workload
13+
- [X] permission setup
14+
- [?] sysdig workload account usage - all required and pre-existing resources exist in the same account
15+
- [?] sydig workload account usage - all required resources are in scattered accounts
16+
17+
**Sysdig Secure For Cloud Features**
18+
19+
From the [Secure for cloud AWS available features](https://docs.sysdig.com/en/docs/sysdig-secure/sysdig-secure-for-cloud/aws/#available-features)
20+
21+
- [X] threat-detection
22+
- [X] account-specific
23+
- [?] all individual-cloudtrail accounts need to be analysed
24+
- [ ] image-scanning (ECR and ECS)
25+
- [ ] compliance/benchmark
26+
- [ ] CIEM
27+
28+
**Other Requirements**
29+
30+
- [?] pre-existing kubernetes management vía service account (WIP)
31+
<br/>this has not been tested yet, we rely on an `accessKeyId/secretAccessKey`
32+
<!--
33+
Skip step 4 and remove `aws_access_key_id` and `aws_secret_access_key` parameters from `org_k8s_threat_reuse_cloudtrail` module
34+
-->
35+
36+
## Solution
37+
38+
For clients that only require thread-detection feature, and do not have an organizational cloudtrail setup, but multiple-accounts,
39+
we can make use of the [cloud-connector `aws-cloudtrail-s3-sns-sqs` ingestor](https://charts.sysdig.com/charts/cloud-connector/#ingestors)
40+
41+
This processes through a single SQS AWS queue the events that come through a single S3 bucket (through an SNS topic) or
42+
multiple S3 buckets (that through several SNS topics, report to a single SQS topic).
43+
44+
## Suggested building-blocks
45+
46+
1. Define different **AWS providers**
47+
48+
WIP.
49+
- ?? We need to know the account where Sysdig Secure for cloud workload will be deployed
50+
- And the accounts where the cloudtrail-S3 bucket(s) will be
51+
<!--
52+
- Populate `REGION`. Currently, same region is to be used
53+
- Because we are going to provision resources on multiple accounts, we're gonna use **two AWS providers**
54+
- `aws.s3` for s3-sns-sqs resources to be deployed. IAM user-credentials, to be used for k8s must also be in S3 account
55+
- `aws.sfc` for secure-for-cloud utility resources to be deployed
56+
57+
```terraform
58+
provider "aws" {
59+
alias = "s3"
60+
region = "<REGION>"
61+
...
62+
}
63+
64+
provider "aws" {
65+
alias = "sfc"
66+
region = "<REGION>"
67+
...
68+
}
69+
```
70+
-->
71+
72+
2. **Helm provider** definition
73+
74+
Sysdig workload will be deployed through its official **Helm** [cloud-connector chart](https://charts.sysdig.com/charts/cloud-connector/).
75+
<br/>Note: Configure [**Helm** Provider](https://registry.terraform.io/providers/hashicorp/helm/latest/docs) for **Kubernetes** cluster
76+
<br/>ex:.
77+
```terraform
78+
provider "helm" {
79+
kubernetes {
80+
config_path = "~/.kube/config"
81+
}
82+
}
83+
84+
```
85+
86+
3. **Cloudtrail-S3-SNS-SQS**
87+
88+
WIP.
89+
90+
Create an SQS que that will subscribe to one S3-SNS (1) or several S3 buckets SNS topics (2)
91+
92+
We currently provide a module to create first use-case,
93+
[one S3-SNS-SQS](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/modules/infrastructure/cloudtrail_s3-sns-sqs) (1),
94+
but can work on providing a way to automatize the later (2)
95+
96+
<!--
97+
1. Populate `CLOUDTRAIL_S3_NAME`
98+
<br/>ex.:
99+
```text
100+
cloudtrail_s3_name=cloudtrail-logging-237944556329
101+
```
102+
2. Populate `CLOUDTRAIL_S3_FILTER_PREFIX` in order to ingest a specific-account. Otherwise, just remove its assignation
103+
<br/>ex.:
104+
```text
105+
s3_event_notification_filter_prefix=cloudtrail/AWSLogs/237944556329
106+
```
107+
108+
```terraform
109+
module "cloudtrail_s3_sns_sqs" {
110+
providers = {
111+
aws = aws.s3
112+
}
113+
source = "sysdiglabs/secure-for-cloud/aws//modules/infrastructure/cloudtrail_s3-sns-sqs"
114+
cloudtrail_s3_name = "<CLOUDTRAIL_S3_NAME>"
115+
s3_event_notification_filter_prefix="<CLOUDTRAIL_S3_FILTER_PREFIX>"
116+
}
117+
```
118+
-->
119+
120+
4. Kubernetes Multi-Account **AWS Permissions** to be able to handle S3/SQS operations
121+
Helm Cloud-Connector chart requires specific AWS credentials to be passed by parameter, a new user + access key will be created within account,
122+
to be able to fetch the events in the S3 bucket (1) or several S3 buckets (2)
123+
124+
WIP.
125+
126+
We currently provide a module to create first use-case,
127+
[`modules/infrastructure/permissions/iam-user`](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/blob/master/modules/infrastructure/permissions/iam-user) (1),
128+
but can work on providing a way to automatize the later (2)
129+
130+
<!--
131+
```terraform
132+
module "multi-account" {
133+
providers = {
134+
aws = aws.s3
135+
}
136+
source = "sysdiglabs/secure-for-cloud/aws//modules/infrastructure/permissions/iam-user"
137+
deploy_image_scanning = false
138+
cloudtrail_s3_bucket_arn = module.cloudtrail_s3_sns_sqs.cloudtrail_s3_arn
139+
cloudtrail_subscribed_sqs_arn = module.cloudtrail_s3_sns_sqs.cloudtrail_subscribed_sqs_arn
140+
}
141+
```
142+
-->
143+
144+
5. **Sysdig workload deployment on K8s**
145+
146+
* Populate `sysdig_secure_url`, `SYSDID_SECURE_API_TOKEN` and `REGION`
147+
* WIP. enable terraform module to be able to define [`nodeSelector` and `tolerations` parameters of the cloud-connector helm chart](https://charts.sysdig.com/charts/cloud-connector/#configuration)
148+
149+
```terraform
150+
resource "helm_release" "cloud_connector" {
151+
152+
provider = helm
153+
154+
name = "cloud-connector"
155+
156+
repository = "https://charts.sysdig.com"
157+
chart = "cloud-connector"
158+
159+
create_namespace = true
160+
namespace = "sysdig"
161+
162+
set {
163+
name = "image.pullPolicy"
164+
value = "Always"
165+
}
166+
167+
set {
168+
name = "sysdig.url"
169+
value = "<sysdig_secure_url>"
170+
}
171+
172+
set_sensitive {
173+
name = "sysdig.secureAPIToken"
174+
value = "<SYSDIG_SECURE_API_TOKEN>"
175+
}
176+
177+
set_sensitive {
178+
name = "aws.accessKeyId"
179+
value = "<AWS_ACCESS_KEY>"
180+
}
181+
182+
set_sensitive {
183+
name = "aws.secretAccessKey"
184+
value = "<AWS_SECRET_ACCESS_KEY>"
185+
}
186+
187+
set {
188+
name = "aws.region"
189+
value = "<REGION>"
190+
}
191+
192+
values = [
193+
<<CONFIG
194+
logging: info
195+
ingestors:
196+
- aws-cloudtrail-s3-sns-sqs:
197+
queueURL: CLOUDTRAIL_S3_SNS_SQS_URL
198+
CONFIG
199+
]
200+
}
201+
202+
```

0 commit comments

Comments
 (0)