chore: reorganize use-cases and utils

iru · iru · commit 94249958a107 · 2022-05-04T18:24:57.000+02:00
diff --git a/README.md b/README.md
@@ -53,9 +53,9 @@ For other Cloud providers check: [GCP](https://github.com/sysdiglabs/terraform-g
   - There are several ways to deploy this in you AWS infrastructure, gathered under **[`/examples`](./examples)**
   - Many module,examples and use-cases provide ways to **re-use existing resources (as optionals)** in your infrastructure (cloudtrail, ecs, vpc, k8s cluster,...)
   - Find some real **use-case scenario explanations** under [`/examples-internal/use-cases*`](./examples-internal)
-    - [Single Account - Existing Cloudtrail](./examples-internal/use-cases-reuse-resources/single-existing-cloudtrail.md)
-    - [Organizational - Existing Cloudtrail, ECS, VPC, Subnet](./examples-internal/use-cases-reuse-resources/org-existing-cloudtrail-ecs-vpc-subnet.md)
-    - [Organizational - Existing Cloudtrail withouth SNS, but with S3 configuration, with K8s Cluster and Filtered Cloudtrail Event Account](./examples-internal/use-cases-self-baked/org-s3-k8s-filtered-account.md)
+    - [Single Account - Existing Cloudtrail](use-cases/single-existing-cloudtrail.md)
+    - [Organizational - Existing Cloudtrail, ECS, VPC, Subnet](use-cases/org-existing-cloudtrail-ecs-vpc-subnet.md)
+    - [Organizational - Existing Cloudtrail withouth SNS, but with S3 configuration, with K8s Cluster and Filtered Cloudtrail Event Account](use-cases/org-s3-k8s-filtered-account.md)
 
 ### - Single-Account
 
diff --git a/examples-internal/utils-eks/.envrc.template b/examples-internal/utils-eks/.envrc.template
diff --git a/examples-internal/utils-eks/outputs.tf b/examples-internal/utils-eks/outputs.tf
diff --git a/examples/single-account-k8s/README.md b/examples/single-account-k8s/README.md
@@ -85,9 +85,9 @@ $ terraform apply
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.10.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.12.1 |
 | <a name="provider_helm"></a> [helm](#provider\_helm) | 2.5.1 |
-| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.36 |
+| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.37 |
 
 ## Modules
 
diff --git a/examples/single-account/README.md b/examples/single-account/README.md
@@ -70,7 +70,7 @@ $ terraform apply
 
 | Name | Version |
 |------|---------|
-| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.36 |
+| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.37 |
 
 ## Modules
 
diff --git a/examples/trigger-events/README.md b/examples/trigger-events/README.md
@@ -49,7 +49,7 @@ $ terraform apply
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.10.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.12.1 |
 
 ## Modules
 
diff --git a/modules/infrastructure/cloudtrail/README.md b/modules/infrastructure/cloudtrail/README.md
@@ -12,7 +12,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.10.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.12.1 |
 
 ## Modules
 
diff --git a/modules/infrastructure/cloudtrail_s3-sns-sqs/README.md b/modules/infrastructure/cloudtrail_s3-sns-sqs/README.md
@@ -46,7 +46,7 @@ EVENT FILTER/fine-tunning, regarding what we want to send to Sysdig Cloud-Connec
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.10.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.12.1 |
 
 ## Modules
 
diff --git a/modules/infrastructure/codebuild/README.md b/modules/infrastructure/codebuild/README.md
@@ -12,7 +12,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.10.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.12.1 |
 
 ## Modules
 
diff --git a/modules/infrastructure/ecs-vpc/README.md b/modules/infrastructure/ecs-vpc/README.md
@@ -13,7 +13,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.10.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.12.1 |
 
 ## Modules
 
diff --git a/modules/infrastructure/eks/README.md b/modules/infrastructure/eks/README.md
diff --git a/modules/infrastructure/eks/data.tf b/modules/infrastructure/eks/data.tf
diff --git a/modules/infrastructure/eks/main.tf b/modules/infrastructure/eks/main.tf
@@ -1,8 +1,3 @@
-provider "aws" {
-  region = var.region
-}
-
-
 resource "aws_iam_role" "eks_cluster" {
   name = "${var.name}-eks_cluster"
 
@@ -23,12 +18,12 @@ POLICY
   tags               = var.tags
 }
 
-resource "aws_iam_role_policy_attachment" "AmazonEKSClusterPolicy" {
+resource "aws_iam_role_policy_attachment" "eks_cluster_policy" {
   policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
   role       = aws_iam_role.eks_cluster.name
 }
 
-resource "aws_iam_role_policy_attachment" "AmazonEKSServicePolicy" {
+resource "aws_iam_role_policy_attachment" "eks_service_policy" {
   policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
   role       = aws_iam_role.eks_cluster.name
 }
@@ -54,17 +49,17 @@ POLICY
   tags               = var.tags
 }
 
-resource "aws_iam_role_policy_attachment" "AmazonEKSWorkerNodePolicy" {
+resource "aws_iam_role_policy_attachment" "eks_worker_node_policy" {
   policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
   role       = aws_iam_role.eks_nodes.name
 }
 
-resource "aws_iam_role_policy_attachment" "AmazonEKS_CNI_Policy" {
+resource "aws_iam_role_policy_attachment" "eks_cni_policy" {
   policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
   role       = aws_iam_role.eks_nodes.name
 }
 
-resource "aws_iam_role_policy_attachment" "AmazonEC2ContainerRegistryReadOnly" {
+resource "aws_iam_role_policy_attachment" "container_registry_read_only" {
   policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
   role       = aws_iam_role.eks_nodes.name
 }
@@ -94,9 +89,9 @@ resource "aws_eks_node_group" "node" {
     min_size     = 1
   }
   depends_on = [
-    aws_iam_role_policy_attachment.AmazonEKSWorkerNodePolicy,
-    aws_iam_role_policy_attachment.AmazonEKS_CNI_Policy,
-    aws_iam_role_policy_attachment.AmazonEC2ContainerRegistryReadOnly,
+    aws_iam_role_policy_attachment.eks_worker_node_policy,
+    aws_iam_role_policy_attachment.eks_cni_policy,
+    aws_iam_role_policy_attachment.container_registry_read_only,
   ]
   tags = var.tags
 }
diff --git a/modules/infrastructure/eks/outputs.tf b/modules/infrastructure/eks/outputs.tf
@@ -0,0 +1,19 @@
+output "k8s_name" {
+  value       = aws_eks_cluster.aws_eks.name
+  description = "eks cluster name"
+}
+output "k8s_endpoint" {
+  value       = aws_eks_cluster.aws_eks.endpoint
+  description = "eks cluster endpoint"
+}
+
+output "k8s_kubeconfig_certificate_authority_data" {
+  value       = aws_eks_cluster.aws_eks.certificate_authority[0].data
+  description = "eks cluster certificate authority data"
+}
+
+output "k8s_auth_token" {
+  sensitive   = true
+  value       = data.aws_eks_cluster_auth.eks_auth.token
+  description = "eks cluster auth token"
+}
diff --git a/modules/infrastructure/eks/variables.tf b/modules/infrastructure/eks/variables.tf
@@ -10,14 +10,15 @@ variable "default_vpc_subnets" {
 
 
 variable "name" {
-  type    = string
-  default = "eks-test"
+  type        = string
+  description = "Name to be assigned to all child resources. A suffix may be added internally when required. Use default value unless you need to install multiple instances"
+  default     = "sfc"
 }
 
-variable "region" {
-  type    = string
-  default = "eu-central-1"
-}
+#variable "region" {
+#  type    = string
+#  default = "eu-central-1"
+#}
 
 variable "tags" {
   type        = map(string)
diff --git a/modules/infrastructure/eks/versions.tf b/modules/infrastructure/eks/versions.tf
@@ -0,0 +1,8 @@
+terraform {
+  required_version = ">= 0.15.0"
+  required_providers {
+    aws = {
+      version = ">= 3.50.0"
+    }
+  }
+}
diff --git a/modules/infrastructure/permissions/cloud-connector/README.md b/modules/infrastructure/permissions/cloud-connector/README.md
@@ -12,7 +12,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.10.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.12.1 |
 
 ## Modules
 
diff --git a/modules/infrastructure/permissions/cloud-scanning/README.md b/modules/infrastructure/permissions/cloud-scanning/README.md
@@ -12,7 +12,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.10.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.12.1 |
 
 ## Modules
 
diff --git a/modules/infrastructure/permissions/general/README.md b/modules/infrastructure/permissions/general/README.md
@@ -15,7 +15,7 @@ General permissions that apply to both cloud-connector and cloud-scanning module
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.10.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.12.1 |
 
 ## Modules
 
diff --git a/modules/infrastructure/permissions/iam-user/README.md b/modules/infrastructure/permissions/iam-user/README.md
@@ -45,7 +45,7 @@ Note: Contact us if this authentication system does not match your requirement.
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.10.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.12.1 |
 
 ## Modules
 
diff --git a/modules/infrastructure/permissions/org-role-eks/README.md b/modules/infrastructure/permissions/org-role-eks/README.md
@@ -29,7 +29,7 @@ The aim of this module is to manage the organizational **managed account** requi
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.10.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.12.1 |
 
 ## Modules
 
diff --git a/modules/infrastructure/resource-group/README.md b/modules/infrastructure/resource-group/README.md
@@ -13,7 +13,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.10.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.12.1 |
 
 ## Modules
 
diff --git a/modules/infrastructure/sqs-sns-subscription/README.md b/modules/infrastructure/sqs-sns-subscription/README.md
@@ -12,7 +12,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.10.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.12.1 |
 
 ## Modules
 
diff --git a/modules/infrastructure/ssm/README.md b/modules/infrastructure/ssm/README.md
@@ -16,7 +16,7 @@ and pass it, in a safe way, to all the modules that require it.
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.10.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.12.1 |
 
 ## Modules
 
diff --git a/modules/services/cloud-bench/README.md b/modules/services/cloud-bench/README.md
@@ -26,9 +26,9 @@ Deployed on **Sysdig Backend**
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.10.0 |
-| <a name="provider_random"></a> [random](#provider\_random) | 3.1.2 |
-| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.36 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.12.1 |
+| <a name="provider_random"></a> [random](#provider\_random) | 3.1.3 |
+| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.37 |
 
 ## Modules
 
diff --git a/modules/services/cloud-connector/README.md b/modules/services/cloud-connector/README.md
@@ -15,8 +15,8 @@ A task deployed on an **ECS deployment** will detect events in your infrastructu
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.10.0 |
-| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.36 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.12.1 |
+| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.37 |
 
 ## Modules
 
diff --git a/use-cases/multiple-accounts-k8s-threat.md b/use-cases/multiple-accounts-k8s-threat.md
diff --git a/use-cases/org-existing-cloudtrail-ecs-vpc-subnet.md b/use-cases/org-existing-cloudtrail-ecs-vpc-subnet.md
@@ -30,7 +30,7 @@
 
 ## Suggested setup
 
-For this use-case we're going to use the [`./examples/organizational`](../../examples/organizational/README.md) setup.
+For this use-case we're going to use the [`./examples/organizational`](../examples/organizational/README.md) setup.
 In order for this setup to work, several roles and permissions are required.
 Before proceeding, please read the example README and check whether you comply with requirements.
 
diff --git a/use-cases/org-s3-k8s-filtered-account.md b/use-cases/org-s3-k8s-filtered-account.md
diff --git a/use-cases/single-benchmark.md b/use-cases/single-benchmark.md
diff --git a/use-cases/single-existing-cloudtrail.md b/use-cases/single-existing-cloudtrail.md
@@ -23,7 +23,7 @@
 
 ## Suggested setup
 
-For this use-case we're going to use the [`./examples/single-account`](../../examples/single-account/README.md) setup.
+For this use-case we're going to use the [`./examples/single-account`](../examples/single-account/README.md) setup.
 In order for this setup to work, all resources must be in the same AWS account and region.
 Before proceeding, please read the example README and check whether you comply with requirements.
 
