Skip to content

Commit d5578ac

Browse files
author
iru
authored
chore: remove sns member policy when not-required (#116)
1 parent 72392e5 commit d5578ac

File tree

24 files changed

+37
-38
lines changed

24 files changed

+37
-38
lines changed

‎examples/organizational/README.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -145,9 +145,9 @@ $ terraform apply
145145

146146
| Name | Version |
147147
|------|---------|
148-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
149-
| <a name="provider_aws.member"></a> [aws.member](#provider\_aws.member) | 4.21.0 |
150-
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.37 |
148+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
149+
| <a name="provider_aws.member"></a> [aws.member](#provider\_aws.member) | 4.22.0 |
150+
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.39 |
151151

152152
## Modules
153153

‎examples/single-account-apprunner/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ $ terraform apply
7272

7373
| Name | Version |
7474
|------|---------|
75-
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.37 |
75+
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.39 |
7676

7777
## Modules
7878

‎examples/single-account-ecs/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ $ terraform apply
7272

7373
| Name | Version |
7474
|------|---------|
75-
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.37 |
75+
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.39 |
7676

7777
## Modules
7878

‎examples/single-account-k8s/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,9 +84,9 @@ $ terraform apply
8484

8585
| Name | Version |
8686
|------|---------|
87-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
87+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
8888
| <a name="provider_helm"></a> [helm](#provider\_helm) | 2.6.0 |
89-
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.37 |
89+
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.39 |
9090

9191
## Modules
9292

‎examples/trigger-events/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ $ terraform apply
4949

5050
| Name | Version |
5151
|------|---------|
52-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
52+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
5353

5454
## Modules
5555

‎modules/infrastructure/cloudtrail/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
| Name | Version |
1414
|------|---------|
15-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
15+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
1616

1717
## Modules
1818

‎modules/infrastructure/cloudtrail/data.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
data "aws_caller_identity" "me" {}

‎modules/infrastructure/cloudtrail/main.tf

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,5 +23,3 @@ resource "aws_cloudtrail" "cloudtrail" {
2323
aws_sns_topic_policy.allow_cloudtrail_publish
2424
]
2525
}
26-
27-
data "aws_caller_identity" "me" {}

‎modules/infrastructure/cloudtrail/sns_permissions.tf

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
locals {
2+
cross_account = data.aws_caller_identity.me.account_id != var.organizational_config.sysdig_secure_for_cloud_member_account_id
3+
}
4+
5+
16
resource "aws_sns_topic_policy" "allow_cloudtrail_publish" {
27
arn = aws_sns_topic.cloudtrail.arn
38
policy = data.aws_iam_policy_document.cloudtrail_sns.json
@@ -20,18 +25,13 @@ data "aws_iam_policy_document" "cloudtrail_sns" {
2025
# Organizational Requirements
2126
# note; this statement is required to be on the SNS creation, don't move to other module as policies cannot be overriten/exteneded after creation
2227
dynamic "statement" {
23-
for_each = var.is_organizational ? [1] : []
28+
for_each = var.is_organizational && local.cross_account ? [1] : []
2429
content {
2530
sid = "AllowSysdigSecureForCloudSubscribe"
2631
effect = "Allow"
2732
principals {
28-
identifiers = [
29-
"arn:aws:iam::${var.organizational_config.sysdig_secure_for_cloud_member_account_id}:role/${var.organizational_config.organizational_role_per_account}"
30-
]
31-
type = "AWS"
32-
# more open policy but without requiring aws provider role
33-
# identifiers = ["sqs.amazonaws.com"]
34-
# type = "Service"
33+
identifiers = ["arn:aws:iam::${var.organizational_config.sysdig_secure_for_cloud_member_account_id}:role/${var.organizational_config.organizational_role_per_account}"]
34+
type = "AWS"
3535
}
3636
actions = ["sns:Subscribe"]
3737
resources = [aws_sns_topic.cloudtrail.arn]

‎modules/infrastructure/cloudtrail_s3-sns-sqs/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ EVENT FILTER/fine-tunning, regarding what we want to send to Sysdig Cloud-Connec
4646

4747
| Name | Version |
4848
|------|---------|
49-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
49+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
5050

5151
## Modules
5252

‎modules/infrastructure/codebuild/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
| Name | Version |
1414
|------|---------|
15-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
15+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
1616

1717
## Modules
1818

‎modules/infrastructure/ecs-vpc/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313

1414
| Name | Version |
1515
|------|---------|
16-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
16+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
1717

1818
## Modules
1919

‎modules/infrastructure/permissions/cloud-connector/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
| Name | Version |
1414
|------|---------|
15-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
15+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
1616

1717
## Modules
1818

‎modules/infrastructure/permissions/cloud-scanning/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
| Name | Version |
1414
|------|---------|
15-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
15+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
1616

1717
## Modules
1818

‎modules/infrastructure/permissions/general/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ General permissions that apply to both cloud-connector and cloud-scanning module
1515

1616
| Name | Version |
1717
|------|---------|
18-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
18+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
1919

2020
## Modules
2121

‎modules/infrastructure/permissions/iam-user/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ Note: Contact us if this authentication system does not match your requirement.
4545

4646
| Name | Version |
4747
|------|---------|
48-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
48+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
4949

5050
## Modules
5151

‎modules/infrastructure/permissions/org-role-ecs/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,8 @@ The aim of this module is to manage the organizational **managed account** requi
3131

3232
| Name | Version |
3333
|------|---------|
34-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
35-
| <a name="provider_aws.member"></a> [aws.member](#provider\_aws.member) | 4.21.0 |
34+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
35+
| <a name="provider_aws.member"></a> [aws.member](#provider\_aws.member) | 4.22.0 |
3636

3737
## Modules
3838

‎modules/infrastructure/permissions/org-role-eks/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ The aim of this module is to manage the organizational **managed account** requi
2929

3030
| Name | Version |
3131
|------|---------|
32-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
32+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
3333

3434
## Modules
3535

‎modules/infrastructure/resource-group/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313

1414
| Name | Version |
1515
|------|---------|
16-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
16+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
1717

1818
## Modules
1919

‎modules/infrastructure/sqs-sns-subscription/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
| Name | Version |
1414
|------|---------|
15-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
15+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
1616

1717
## Modules
1818

‎modules/infrastructure/ssm/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ and pass it, in a safe way, to all the modules that require it.
1616

1717
| Name | Version |
1818
|------|---------|
19-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
19+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
2020

2121
## Modules
2222

‎modules/services/cloud-bench/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,9 @@ Deployed on **Sysdig Backend**
2626

2727
| Name | Version |
2828
|------|---------|
29-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
29+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
3030
| <a name="provider_random"></a> [random](#provider\_random) | 3.3.2 |
31-
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.37 |
31+
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.39 |
3232

3333
## Modules
3434

‎modules/services/cloud-connector-ecs/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@ A task deployed on an **ECS deployment** will detect events in your infrastructu
1515

1616
| Name | Version |
1717
|------|---------|
18-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
19-
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.37 |
18+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
19+
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.39 |
2020

2121
## Modules
2222

‎use-cases/_questionnaire.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,9 @@ modules, and we also offer [AWS Cloudformation templates](https://github.com/sys
2929
- if so, does that S3 bucket already have any "Event Notification System"? Is it an SNS we could subscribe to?
3030
- if so, does that S3 bucket already have an "Amazon EventBridge" system activated?
3131
- whether it's organizational or not, could you give us a quick picture of the account setup in terms of purpose?
32-
- how many **regions** do you work with?
32+
- how many **regions** do you work with?
3333
- is secure for cloud to be deployed on the same region as your existing resources?
34-
- (aws-only) if in previous point you said you have a cloudtrail, cloudtrail-sns, or cloudtrail-s3, in which region is it?
34+
- (aws-only) if in previous point you said you have a cloudtrail, cloudtrail-sns, or cloudtrail-s3, in which region is it?
3535
- how do you handle **IAM permissions**? would you let our Terraform scripts set them up for you, or you want to set them yourself manually? any restriction we may be aware of?
3636
- how do you handle **outbound newtwork connection** securization? does your infrastructure have any customized VPC/firewally setup?
3737
- **Deployment** type

0 commit comments

Comments
 (0)