You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+18-13Lines changed: 18 additions & 13 deletions
Original file line number
Diff line number
Diff line change
@@ -184,25 +184,20 @@ When scanning is activated, should see following lines on the cloud-connector co
184
184
185
185
## Troubleshooting
186
186
187
-
### Q-General: Need to modify cloud-connector config (to troubleshoot with `debug` loglevel, modify ingestors for testing, ...)
187
+
### Q-Debug: Need to modify cloud-connector config (to troubleshoot with `debug` loglevel, modify ingestors for testing, ...)
188
188
A: both in ECS and AppRunner workload types, cloud-connector configuration is passed as a base64-encoded string through the env var `CONFIG`
189
189
<br/>S: Get current value, decode it, edit the desired (ex.:`logging: debug` value), encode it again, and spin it again with this new definition.
190
190
<br/>For information on all the modifyable configuration see [Cloud-Connector Chart](https://charts.sysdig.com/charts/cloud-connector/#configuration-detail) reference
191
191
192
-
### Q-General: Getting error "Error: cannot verify credentials" on "sysdig_secure_trusted_cloud_identity" data
193
-
A: This happens when Sysdig credentials are not working correctly.
194
-
<br/>S: Check sysdig provider block is correctly configured with the `sysdig_secure_url` and `sysdig_secure_api_token` variables
195
-
with the correct values. Check [Sysdig SaaS per-region URLs if required](https://docs.sysdig.com/en/docs/administration/saas-regions-and-ip-ranges)
192
+
### Q-General: I'm not able to see any data
193
+
A: Solution is based on Cloudtrail delivery times
194
+
S: Wait at least 15 minutes [as specified in the official AWS documentation](https://aws.amazon.com/cloudtrail/faqs/#Event_payload.2C_Timeliness.2C_and_Delivery_Frequency)
195
+
<br/>For Identity and Access Management, when connected it will be in the [learning mode](https://docs.sysdig.com/en/docs/sysdig-secure/posture/identity-and-access/#understanding-learning-mode-and-disconnected-states)
196
196
197
-
### Q-General: I'm not able to see Cloud Infrastructure Entitlements Management (CIEM) results
197
+
### Q-CIEM: I'm not able to see Cloud Infrastructure Entitlements Management (CIEM) results
198
198
A: Make sure you installed both [cloud-bench](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/modules/services/cloud-bench) and [cloud-connector](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/modules/services/cloud-connector) modules
199
199
200
-
201
-
### Q-General-Networking: What's the requirements for the inbound/outbound connection?
202
-
A: Refer to [Sysdig SASS Region and IP Ranges Documentation](https://docs.sysdig.com/en/docs/administration/saas-regions-and-ip-ranges/) to get Sysdig SaaS endpoint and allow both outbound (for compute vulnerability report) and inbound (for scheduled compliance checkups)
203
-
<br/>ECS type deployment will create following [security-group setup](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/blob/master/modules/services/cloud-connector-ecs/sec-group.tf)
204
-
205
-
### Q-Scanning: I'm not seeing any image scanning results
200
+
### Q-Scanning: I'm not able to see any image scanning results
206
201
A: Need to check several steps
207
202
<br/>S: First, image scanning is not activated by default. Ensure you have the [required scanning enablers](https://docs.sysdig.com/en/docs/installation/sysdig-secure-for-cloud/deploy-sysdig-secure-for-cloud-on-aws/#enabling-image-scanner) in place.
208
203
<br/>Currently, images are scanned on registry/repository push events, and on the supported compute services on deployment. Make sure these events are triggered.
@@ -242,6 +237,16 @@ A: We don’t scan images from the management account ECR because is [not a best
242
237
]
243
238
}
244
239
```
240
+
241
+
### Q-General: Getting error "Error: cannot verify credentials" on "sysdig_secure_trusted_cloud_identity" data
242
+
A: This happens when Sysdig credentials are not working correctly.
243
+
<br/>S: Check sysdig provider block is correctly configured with the `sysdig_secure_url` and `sysdig_secure_api_token` variables
244
+
with the correct values. Check [Sysdig SaaS per-region URLs if required](https://docs.sysdig.com/en/docs/administration/saas-regions-and-ip-ranges)
245
+
246
+
### Q-General-Networking: What's the requirements for the inbound/outbound connection?
247
+
A: Refer to [Sysdig SASS Region and IP Ranges Documentation](https://docs.sysdig.com/en/docs/administration/saas-regions-and-ip-ranges/) to get Sysdig SaaS endpoint and allow both outbound (for compute vulnerability report) and inbound (for scheduled compliance checkups)
248
+
<br/>ECS type deployment will create following [security-group setup](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/blob/master/modules/services/cloud-connector-ecs/sec-group.tf)
A: This happens when a previous installation of secure-for-cloud exists. On each account where Sysdig has to create resources, it will create a grouping resource-group using the `name` variable (defaulted to `sfc` on main examples).
247
252
<br/>S: Remove previous installation, or if multiple setups are required, use the `name` varible to change the resource-group name.
@@ -301,7 +306,7 @@ This error happens when the ECS `TaskRole` has no permissions to assume this rol
301
306
A: Probably you or someone in the same environment you're using, already deployed a resource with the sysdig terraform module and a naming collision is happening.
302
307
<br/>S: If you want to maintain several versions, make use of the [`name` input var of the examples](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/examples/single-account-ecs#input_name)
303
308
304
-
### Q-AWS-Datasources: I cannot see my acccount alias in the `Data Sources > Cloud page`
309
+
### Q-AWS-Datasources: I'm not able to see my acccount alias in the `Data Sources > Cloud page`
305
310
A: There are several causes to this.
306
311
<br/>Check that your aws account has an alias set-up. It's not the same as the account name.
0 commit comments