|
| 1 | +# Sysdig Secure for Cloud in AWS<br/>[ Example :: App Runner ] |
| 2 | + |
| 3 | +Deploy Sysdig Secure for Cloud in a single AWS account using App Runner.<br/> |
| 4 | +All the required resources and workloads will be run under the same account. |
| 5 | + |
| 6 | +## Prerequisites |
| 7 | + |
| 8 | +Minimum requirements: |
| 9 | + |
| 10 | +1. Configure [Terraform **AWS** Provider](https://registry.terraform.io/providers/hashicorp/aws/latest/docs) |
| 11 | +1. Secure requirements, as input variable value |
| 12 | + ``` |
| 13 | + sysdig_secure_api_token=<SECURE_API_TOKEN> |
| 14 | + ``` |
| 15 | +
|
| 16 | +## Notice |
| 17 | +
|
| 18 | +* **Resource creation inventory** Find all the resources created by Sysdig examples in the resource-group `sysdig-secure-for-cloud` (AWS Resource Group & Tag Editor) <br/><br/> |
| 19 | +* **Deployment cost** This example will create resources that cost money.<br/>Run `terraform destroy` when you don't need them anymore <br/><br/> |
| 20 | +* **AppRunner enabled zones** AppRunner isn't available in all AWS zones, check [AppRunner Service endpoints](https://docs.aws.amazon.com/general/latest/gr/apprunner.html) for enabled zones. |
| 21 | +
|
| 22 | +
|
| 23 | +## Usage |
| 24 | +
|
| 25 | +For quick testing, use this snippet on your terraform files |
| 26 | +
|
| 27 | +```terraform |
| 28 | +terraform { |
| 29 | + required_providers { |
| 30 | + sysdig = { |
| 31 | + source = "sysdiglabs/sysdig" |
| 32 | + version = ">=0.5.33" |
| 33 | + } |
| 34 | + } |
| 35 | +} |
| 36 | +
|
| 37 | +provider "sysdig" { |
| 38 | + sysdig_secure_api_token = "<SYSDIG_SECURE_URL>" |
| 39 | + sysdig_secure_url = "<SYSDIG_SECURE_API_TOKEN" |
| 40 | +} |
| 41 | +
|
| 42 | +provider "aws" { |
| 43 | + region = "<AWS_REGION> Take care of AppRunner available zones: https://docs.aws.amazon.com/general/latest/gr/apprunner.html" |
| 44 | +} |
| 45 | +
|
| 46 | +module "cloudvision_aws_apprunner_single_account" { |
| 47 | + source = "sysdiglabs/secure-for-cloud/aws//examples/single-account-apprunner" |
| 48 | + name = "<APPRUNNER_SERVICE_NAME>" |
| 49 | +} |
| 50 | +``` |
| 51 | + |
| 52 | +See [inputs summary](#inputs) or module module [`variables.tf`](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/blob/master/examples/single-account/variables.tf) file for more optional configuration. |
| 53 | + |
| 54 | +To run this example you need have your [aws account profile configured in CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html) and to execute: |
| 55 | +```terraform |
| 56 | +$ terraform init |
| 57 | +$ terraform plan |
| 58 | +$ terraform apply |
| 59 | +``` |
| 60 | + |
| 61 | +<!-- BEGIN_TF_DOCS --> |
| 62 | +## Requirements |
| 63 | + |
| 64 | +| Name | Version | |
| 65 | +|------|---------| |
| 66 | +| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.15.0 | |
| 67 | +| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.0.0 | |
| 68 | +| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | >= 0.5.33 | |
| 69 | + |
| 70 | +## Providers |
| 71 | + |
| 72 | +| Name | Version | |
| 73 | +|------|---------| |
| 74 | +| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | >= 0.5.33 | |
| 75 | + |
| 76 | +## Modules |
| 77 | + |
| 78 | +| Name | Source | Version | |
| 79 | +|------|--------|---------| |
| 80 | +| <a name="module_cloud_bench"></a> [cloud\_bench](#module\_cloud\_bench) | ../../modules/services/cloud-bench | n/a | |
| 81 | +| <a name="module_cloud_connector"></a> [cloud\_connector](#module\_cloud\_connector) | ../../modules/services/cloud-connector | n/a | |
| 82 | +| <a name="module_cloudtrail"></a> [cloudtrail](#module\_cloudtrail) | ../../modules/infrastructure/cloudtrail | n/a | |
| 83 | +| <a name="module_codebuild"></a> [codebuild](#module\_codebuild) | ../../modules/infrastructure/codebuild | n/a | |
| 84 | +| <a name="module_ecs_vpc"></a> [ecs\_vpc](#module\_ecs\_vpc) | ../../modules/infrastructure/ecs-vpc | n/a | |
| 85 | +| <a name="module_resource_group"></a> [resource\_group](#module\_resource\_group) | ../../modules/infrastructure/resource-group | n/a | |
| 86 | +| <a name="module_ssm"></a> [ssm](#module\_ssm) | ../../modules/infrastructure/ssm | n/a | |
| 87 | + |
| 88 | +## Resources |
| 89 | + |
| 90 | +| Name | Type | |
| 91 | +|------|------| |
| 92 | +| [sysdig_secure_connection.current](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_connection) | data source | |
| 93 | + |
| 94 | +## Inputs |
| 95 | + |
| 96 | +| Name | Description | Type | Default | Required | |
| 97 | +|------|-------------|------|---------|:--------:| |
| 98 | +| <a name="input_benchmark_regions"></a> [benchmark\_regions](#input\_benchmark\_regions) | List of regions in which to run the benchmark. If empty, the task will contain all aws regions by default. | `list(string)` | `[]` | no | |
| 99 | +| <a name="input_cloudtrail_is_multi_region_trail"></a> [cloudtrail\_is\_multi\_region\_trail](#input\_cloudtrail\_is\_multi\_region\_trail) | true/false whether cloudtrail will ingest multiregional events | `bool` | `true` | no | |
| 100 | +| <a name="input_cloudtrail_kms_enable"></a> [cloudtrail\_kms\_enable](#input\_cloudtrail\_kms\_enable) | true/false whether cloudtrail delivered events to S3 should persist encrypted | `bool` | `true` | no | |
| 101 | +| <a name="input_cloudtrail_sns_arn"></a> [cloudtrail\_sns\_arn](#input\_cloudtrail\_sns\_arn) | ARN of a pre-existing cloudtrail\_sns. If defaulted, a new cloudtrail will be created | `string` | `"create"` | no | |
| 102 | +| <a name="input_deploy_benchmark"></a> [deploy\_benchmark](#input\_deploy\_benchmark) | Whether to deploy or not the cloud benchmarking | `bool` | `true` | no | |
| 103 | +| <a name="input_deploy_image_scanning_ecr"></a> [deploy\_image\_scanning\_ecr](#input\_deploy\_image\_scanning\_ecr) | true/false whether to deploy the image scanning on ECR pushed images | `bool` | `true` | no | |
| 104 | +| <a name="input_deploy_image_scanning_ecs"></a> [deploy\_image\_scanning\_ecs](#input\_deploy\_image\_scanning\_ecs) | true/false whether to deploy the image scanning on ECS running images | `bool` | `true` | no | |
| 105 | +| <a name="input_ecs_cluster_name"></a> [ecs\_cluster\_name](#input\_ecs\_cluster\_name) | Name of a pre-existing ECS (elastic container service) cluster. If defaulted, a new ECS cluster/VPC/Security Group will be created | `string` | `"create"` | no | |
| 106 | +| <a name="input_ecs_task_cpu"></a> [ecs\_task\_cpu](#input\_ecs\_task\_cpu) | Amount of CPU (in CPU units) to reserve for cloud-connector task | `string` | `"256"` | no | |
| 107 | +| <a name="input_ecs_task_memory"></a> [ecs\_task\_memory](#input\_ecs\_task\_memory) | Amount of memory (in megabytes) to reserve for cloud-connector task | `string` | `"512"` | no | |
| 108 | +| <a name="input_ecs_vpc_id"></a> [ecs\_vpc\_id](#input\_ecs\_vpc\_id) | ID of the VPC where the workload is to be deployed. Defaulted to be created when 'ecs\_cluster\_name' is not provided. | `string` | `"create"` | no | |
| 109 | +| <a name="input_ecs_vpc_region_azs"></a> [ecs\_vpc\_region\_azs](#input\_ecs\_vpc\_region\_azs) | List of Availability Zones for ECS VPC creation. e.g.: ["apne1-az1", "apne1-az2"]. If defaulted, two of the default 'aws\_availability\_zones' datasource will be taken | `list(string)` | `[]` | no | |
| 110 | +| <a name="input_ecs_vpc_subnets_private_ids"></a> [ecs\_vpc\_subnets\_private\_ids](#input\_ecs\_vpc\_subnets\_private\_ids) | List of VPC subnets where workload is to be deployed. Defaulted to be created when 'ecs\_cluster\_name' is not provided. | `list(string)` | `[]` | no | |
| 111 | +| <a name="input_name"></a> [name](#input\_name) | Name to be assigned to all child resources. A suffix may be added internally when required. Use default value unless you need to install multiple instances | `string` | `"sfc"` | no | |
| 112 | +| <a name="input_tags"></a> [tags](#input\_tags) | sysdig secure-for-cloud tags | `map(string)` | <pre>{<br> "product": "sysdig-secure-for-cloud"<br>}</pre> | no | |
| 113 | + |
| 114 | +## Outputs |
| 115 | + |
| 116 | +| Name | Description | |
| 117 | +|------|-------------| |
| 118 | +| <a name="output_cloudtrail_sns_topic_arn"></a> [cloudtrail\_sns\_topic\_arn](#output\_cloudtrail\_sns\_topic\_arn) | ARN of cloudtrail\_sns topic | |
| 119 | +<!-- END_TF_DOCS --> |
| 120 | + |
| 121 | + |
| 122 | +## Authors |
| 123 | + |
| 124 | +Module is maintained and supported by [Sysdig](https://sysdig.com). |
| 125 | + |
| 126 | +## License |
| 127 | + |
| 128 | +Apache 2 Licensed. See LICENSE for full details. |
0 commit comments