Skip to content

Commit b42a86d

Browse files
author
iru
authored
chore(permissions): remove unnecesary (#38)
- fix (permission): work both with `*` (single-account) and specific ARN (org-account) - chore(refact): reviewed that `k8s` based examples. do not need `assumeRole` - chore(qa): add `org-k8s` example to CI
1 parent 8960b6e commit b42a86d

File tree

6 files changed

+50
-31
lines changed

6 files changed

+50
-31
lines changed

‎.github/workflows/ci-integration-tests.yaml

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,3 +113,41 @@ jobs:
113113
AWS_REGION: ${{ secrets.AWS_REGION }}
114114
if: ${{ failure() }}
115115
run: bundle exec kitchen destroy "single-account-k8s-aws"
116+
117+
118+
- name: Run org-k8s test
119+
env:
120+
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_QA_MANAGED_ACCESS_KEY_ID }}
121+
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_QA_MANAGED_SECRET_ACCESS_KEY }}
122+
AWS_REGION: ${{ secrets.AWS_REGION }}
123+
TF_VAR_org_accessKeyId: ${{ secrets.AWS_QA_MANAGED_ACCESS_KEY_ID }}
124+
TF_VAR_org_secretAccessKey: ${{ secrets.AWS_QA_MANAGED_SECRET_ACCESS_KEY }}
125+
TF_VAR_cloudnative_accessKeyId: ${{ secrets.AWS_QA_CLOUDNATIVE_ACCESS_KEY_ID }}
126+
TF_VAR_cloudnative_secretAccessKey: ${{ secrets.AWS_QA_CLOUDNATIVE_SECRET_ACCESS_KEY }}
127+
TF_VAR_region: ${{secrets.AWS_QA_MANAGED_RESOURCES_REGION }}
128+
TF_VAR_cloudtrail_s3_name: ${{ secrets.AWS_QA_MANAGED_CLOUDTRAIL_NAME }}
129+
run: bundle exec kitchen test "organizational-k8s-aws"
130+
131+
- name: Inspect k8s failures
132+
if: ${{ failure() }}
133+
run: |
134+
kubectl get namespaces
135+
kubectl get deployments -n sfc-tests-kitchen-singlek8s
136+
kubectl describe deployment cloud-connector -n sfc-tests-kitchen-orgk8s
137+
kubectl logs deployment.apps/cloud-connector -n sfc-tests-kitchen-orgk8s
138+
kubectl logs deployment.apps/cloud-scanning -n sfc-tests-kitchen-orgk8s
139+
140+
141+
- name: Destroy org-k8s test
142+
env:
143+
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_QA_MANAGED_ACCESS_KEY_ID }}
144+
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_QA_MANAGED_SECRET_ACCESS_KEY }}
145+
TF_VAR_org_accessKeyId: ${{ secrets.AWS_QA_MANAGED_ACCESS_KEY_ID }}
146+
TF_VAR_org_secretAccessKey: ${{ secrets.AWS_QA_MANAGED_SECRET_ACCESS_KEY }}
147+
TF_VAR_cloudnative_accessKeyId: ${{ secrets.AWS_QA_CLOUDNATIVE_ACCESS_KEY_ID }}
148+
TF_VAR_cloudnative_secretAccessKey: ${{ secrets.AWS_QA_CLOUDNATIVE_SECRET_ACCESS_KEY }}
149+
TF_VAR_region: ${{secrets.AWS_QA_MANAGED_RESOURCES_REGION }}
150+
TF_VAR_cloudtrail_s3_name: ${{ secrets.AWS_QA_MANAGED_CLOUDTRAIL_NAME }}
151+
AWS_REGION: ${{ secrets.AWS_REGION }}
152+
if: ${{ failure() }}
153+
run: bundle exec kitchen destroy "organizational-k8s-aws"

‎examples-internal/organizational-k8s-threat-reuse_cloudtrail/README.md

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,7 @@ Minimum requirements:
2424
4. S3 event-notification subscribed SNS topic(s).<br/>see `modules/infrastructure/cloudtrail_s3-sns-sqs` for guidance<br/><br/>
2525
5. **SQS topic** subscribed to the S3-SNS event notifications.<br/>The ARN of this SQS will be used as an input parameter to the module.<br/>
2626
see `modules/infrastructure/sqs-sns-subscription` for guidance`<br/><br/>
27-
6. If the module is to be deployed on an AWS Organization **member account** which is not the same where the Cloudtrail-S3 events are located,
28-
the `organization_managed_role_arn` input variable must be used<br/>
29-
This will provide the **ARN of a role** that `cloud-connector` module will use to fetch the events from the S3 bucket.<br/>
30-
see `modules/infrastructure/permissions/eks-org-role` for guidance`<br/><br/>
27+
3128
3229
## Usage
3330
@@ -50,7 +47,6 @@ module "org_k8s_threat_reuse_cloudtrail" {
5047
5148
region = "CLOUDTRAIL_SNS_SQS_REGION"
5249
cloudtrail_s3_sns_sqs_url = "SQS-URL"
53-
organization_managed_role_arn = "ARN_ROLE_FOR_MEMBER_ACCOUNT_PERMISSIONS"
5450
5551
aws_access_key_id = "AWS_ACCESSK_KEY"
5652
aws_secret_access_key = "AWS_SECRET_ACCESS_KEY"
@@ -108,7 +104,6 @@ Notice that:
108104
| <a name="input_cloudtrail_s3_sns_sqs_url"></a> [cloudtrail\_s3\_sns\_sqs\_url](#input\_cloudtrail\_s3\_sns\_sqs\_url) | Organization cloudtrail event notification S3-SNS-SQS URL to listen to | `string` | n/a | yes |
109105
| <a name="input_sysdig_secure_api_token"></a> [sysdig\_secure\_api\_token](#input\_sysdig\_secure\_api\_token) | Sysdig Secure API token | `string` | n/a | yes |
110106
| <a name="input_name"></a> [name](#input\_name) | Name to be assigned to all child resources. A suffix may be added internally when required. Use default value unless you need to install multiple instances | `string` | `"sfc"` | no |
111-
| <a name="input_organization_managed_role_arn"></a> [organization\_managed\_role\_arn](#input\_organization\_managed\_role\_arn) | for cloud-connector assumeRole in order to read cloudtrail s3 events | `string` | `"none"` | no |
112107
| <a name="input_region"></a> [region](#input\_region) | Default region for resource creation in both organization master and secure-for-cloud member account | `string` | `"eu-central-1"` | no |
113108
| <a name="input_sysdig_secure_endpoint"></a> [sysdig\_secure\_endpoint](#input\_sysdig\_secure\_endpoint) | Sysdig Secure API endpoint | `string` | `"https://secure.sysdig.com"` | no |
114109
| <a name="input_tags"></a> [tags](#input\_tags) | sysdig secure-for-cloud tags | `map(string)` | <pre>{<br> "product": "sysdig-secure-for-cloud"<br>}</pre> | no |

‎examples-internal/organizational-k8s-threat-reuse_cloudtrail/cloud-connector.tf

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,6 @@ logging: info
4646
ingestors:
4747
- aws-cloudtrail-s3-sns-sqs:
4848
queueURL: ${var.cloudtrail_s3_sns_sqs_url}
49-
%{if var.organization_managed_role_arn != "none"}assumeRole: ${var.organization_managed_role_arn}
50-
%{endif~}
5149
CONFIG
5250
]
5351
}

‎examples-internal/organizational-k8s-threat-reuse_cloudtrail/variables.tf

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,6 @@ variable "aws_secret_access_key" {
2727
# optionals - with defaults
2828
#---------------------------------
2929

30-
variable "organization_managed_role_arn" {
31-
type = string
32-
description = "for cloud-connector assumeRole in order to read cloudtrail s3 events"
33-
default = "none"
34-
}
35-
3630

3731
#
3832
# general

‎modules/infrastructure/permissions/cloud-connector/main.tf

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,11 @@ resource "aws_iam_user_policy" "cloud_connector" {
44
policy = data.aws_iam_policy_document.cloud_connector.json
55
}
66

7+
locals {
8+
# required for single vs. org management
9+
s3_resources_list = var.cloudtrail_s3_bucket_arn == "*" ? [var.cloudtrail_s3_bucket_arn] : [var.cloudtrail_s3_bucket_arn, "${var.cloudtrail_s3_bucket_arn}/*"]
10+
}
11+
712
data "aws_iam_policy_document" "cloud_connector" {
813
statement {
914
sid = "AllowReadCloudtrailS3"
@@ -12,10 +17,7 @@ data "aws_iam_policy_document" "cloud_connector" {
1217
"s3:ListBucket",
1318
"s3:GetObject"
1419
]
15-
resources = [var.cloudtrail_s3_bucket_arn]
16-
# var.cloudtrail_s3_bucket_arn,
17-
# "${var.cloudtrail_s3_bucket_arn}/*"
18-
20+
resources = local.s3_resources_list
1921
}
2022

2123
statement {

‎test/fixtures/organizational-k8s/main.tf

Lines changed: 5 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -41,19 +41,12 @@ module "org_user" {
4141
cloudtrail_subscribed_sqs_arn = module.cloudtrail_s3_sns_sqs.cloudtrail_subscribed_sqs_arn
4242
}
4343

44-
module "org_role" {
45-
providers = {
46-
aws = aws.admin
47-
}
48-
source = "../../../modules/infrastructure/permissions/eks-org-role"
4944

50-
user_arn = module.org_user.sfc_user_arn
51-
cloudtrail_s3_arn = module.cloudtrail_s3_sns_sqs.cloudtrail_s3_arn
52-
enable_cloud_scanning = false
45+
resource "time_sleep" "wait" {
46+
depends_on = [module.org_user]
47+
create_duration = "5s"
5348
}
5449

55-
56-
5750
# -------------------
5851
# actual use case
5952
# -------------------
@@ -63,7 +56,7 @@ module "org_k8s_threat_reuse_cloudtrail" {
6356
aws = aws.cloudnative
6457
}
6558
source = "../../../examples-internal/organizational-k8s-threat-reuse_cloudtrail"
66-
name = var.name
59+
name = "${var.name}-orgk8s"
6760
region = var.region
6861

6962
sysdig_secure_api_token = var.sysdig_secure_api_token
@@ -73,6 +66,5 @@ module "org_k8s_threat_reuse_cloudtrail" {
7366
aws_access_key_id = module.org_user.sfc_user_access_key_id
7467
aws_secret_access_key = module.org_user.sfc_user_secret_access_key
7568

76-
organization_managed_role_arn = module.org_role.sysdig_secure_for_cloud_role_arn
77-
69+
depends_on = [module.org_user.sfc_user_arn, time_sleep.wait]
7870
}

0 commit comments

Comments
 (0)