Skip to content

Commit e982926

Browse files
author
iru
authored
doc: use-case for no terraform org three-way k8s threat compliance (#122)
1 parent b9ae053 commit e982926

File tree

24 files changed

+463
-100
lines changed

24 files changed

+463
-100
lines changed

‎.github/workflows/ci-pull-request.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,12 @@ on:
66
- '**.tf'
77
- '**.md'
88
- '.pre-commit-config.yaml'
9+
# only direct-push to master for small tasks such as markdown modifications and such
910
push:
1011
branches:
1112
- master
1213
paths:
1314
- '**.tf'
14-
- '**.md'
1515
env:
1616
GO_VERSION: "^1.17"
1717

‎README.md

Lines changed: 9 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -56,81 +56,15 @@ For other Cloud providers check: [GCP](https://github.com/sysdiglabs/terraform-g
5656
If you're unsure about what/how to use this module, please fill the [questionnaire](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/blob/master/use-cases/_questionnaire.md) report as an issue and let us know your context, we will be happy to help and improve our module.
5757

5858
- There are several ways to deploy this in you AWS infrastructure, gathered under **[`/examples`](./examples)**
59-
- [Single Account on ECS](#--single-account-on-ecs)
60-
- [Single Account on AppRunner](#--single-account-on-apprunner)
61-
- [Single-Account with a pre-existing Kubernetes Cluster](#--single-account-with-a-pre-existing-kubernetes-cluster)
62-
- [Organizational](#--organizational)
63-
- Many module,examples and use-cases provide ways to **re-use existing resources (as optionals)** in your infrastructure (cloudtrail, ecs, vpc, k8s cluster,...)
64-
- Find some real self-baked **use-case scenarios** under [`/use-cases`](./use-cases)
59+
- [Single Account on ECS](./examples/single-account-ecs/README.md)
60+
- [Single Account on AppRunner](./examples/single-account-apprunner/README.md)
61+
- [Single-Account with a pre-existing Kubernetes Cluster](./examples/single-account-k8s/README.md)
62+
- [Organizational](./examples/organizational/README.md)
63+
- Many module,examples and use-cases, we provide ways to **re-use existing resources (as optionals)** in your
64+
infrastructure. Check input summary on each example/module.
65+
- Find some real self-baked **use-case scenarios** under [`/use-cases`](./use-cases)
6566

6667

67-
### - Single-Account on ECS
68-
69-
Sysdig workload will be deployed in the same account where user's resources will be watched.<br/>
70-
More info in [`./examples/single-account-ecs`](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/examples/single-account-ecs)
71-
72-
![single-account diagram](https://raw.githubusercontent.com/sysdiglabs/terraform-aws-secure-for-cloud/master/examples/single-account-ecs/diagram-single.png)
73-
74-
### - Single-Account on AppRunner
75-
76-
Sysdig workload will be deployed using AppRunner in the same account where user's resources will be watched.<br/>
77-
More info in [`./examples/single-account-apprunner`](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/examples/single-account-apprunner)
78-
79-
![single-account diagram on apprunner](https://raw.githubusercontent.com/sysdiglabs/terraform-aws-secure-for-cloud/master/examples/single-account-apprunner/diagram-single.png)
80-
81-
### - Single-Account with a pre-existing Kubernetes Cluster
82-
83-
If you already own a Kubernetes Cluster on AWS, you can use it to deploy Sysdig Secure for Cloud, instead of default ECS cluster.<br/>
84-
More info in [`./examples/single-account-k8s`](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/examples/single-account-k8s)
85-
86-
![single-account with pre-existing kubernetes cluster](https://raw.githubusercontent.com/sysdiglabs/terraform-aws-secure-for-cloud/master/examples/single-account-k8s/diagram.png)
87-
88-
### - Organizational
89-
90-
Secure all the accounts from your organization<br/>
91-
More info in [`./examples/organizational`](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/examples/organizational)
92-
93-
![organizational diagram](https://raw.githubusercontent.com/sysdiglabs/terraform-aws-secure-for-cloud/master/examples/organizational/diagram-org.png)
94-
95-
### - Self-Baked
96-
97-
If no [examples](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/examples) fit your use-case, be free to call desired modules directly.
98-
99-
In this use-case we will ONLY deploy cloud-bench, into the target account, calling modules directly.
100-
101-
```terraform
102-
terraform {
103-
required_providers {
104-
aws = {}
105-
sysdig = {
106-
source = "sysdiglabs/sysdig"
107-
}
108-
}
109-
}
110-
111-
provider "aws" {
112-
region = "AWS-REGION"
113-
}
114-
115-
provider "sysdig" {
116-
sysdig_secure_url = "<SYSDIG_SECURE_URL>"
117-
sysdig_secure_api_token = "<SYSDIG_SECURE_API_TOKEN>"
118-
}
119-
120-
module "cloud_bench" {
121-
source = "sysdiglabs/secure-for-cloud/aws//modules/services/cloud-bench"
122-
}
123-
124-
```
125-
See [inputs summary](#inputs) or main [module `variables.tf`](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/variables.tf) file for more optional configuration.
126-
127-
To run this example you need have your [aws master-account profile configured in CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html) and to execute:
128-
```terraform
129-
$ terraform init
130-
$ terraform plan
131-
$ terraform apply
132-
```
133-
13468
## Required Permissions
13569

13670
### Provisioning Permissions
@@ -234,7 +168,7 @@ and a CodeBuild project being launched successfully
234168

235169
## Troubleshooting
236170

237-
## Q-General: Need to modify cloud-connector config (to troubleshoot with `debug` loglevel, modify ingestors for testing, ...)
171+
### Q-General: Need to modify cloud-connector config (to troubleshoot with `debug` loglevel, modify ingestors for testing, ...)
238172
A: both in ECS and AppRunner workload types, cloud-connector configuration is passed as a base64-encoded string through the env var `CONFIG`
239173
<br/>S: Get current value, decode it, edit the desired (ex.:`logging: debug` value), encode it again, and spin it again with this new definition.
240174
<br/>For information on all the modifyable configuration see [Cloud-Connector Chart](https://charts.sysdig.com/charts/cloud-connector/#configuration-detail) reference
@@ -248,7 +182,7 @@ with the correct values. Check [Sysdig SaaS per-region URLs if required](https:/
248182
A: Make sure you installed both [cloud-bench](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/modules/services/cloud-bench) and [cloud-connector](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/modules/services/cloud-connector) modules
249183

250184

251-
## Q-General-Networking: What's the requirements for the inbound/outbound connection?
185+
### Q-General-Networking: What's the requirements for the inbound/outbound connection?
252186
A: Refer to [Sysdig SASS Region and IP Ranges Documentation](https://docs.sysdig.com/en/docs/administration/saas-regions-and-ip-ranges/) to get Sysdig SaaS endpoint and allow both outbound (for compute vulnerability report) and inbound (for scheduled compliance checkups)
253187
<br/>ECS type deployment will create following [security-group setup](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/blob/master/modules/services/cloud-connector-ecs/sec-group.tf)
254188

‎examples/organizational/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -145,8 +145,8 @@ $ terraform apply
145145

146146
| Name | Version |
147147
|------|---------|
148-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.25.0 |
149-
| <a name="provider_aws.member"></a> [aws.member](#provider\_aws.member) | 4.25.0 |
148+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.26.0 |
149+
| <a name="provider_aws.member"></a> [aws.member](#provider\_aws.member) | 4.26.0 |
150150
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.39 |
151151

152152
## Modules

‎examples/single-account-k8s/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ $ terraform apply
8484

8585
| Name | Version |
8686
|------|---------|
87-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.25.0 |
87+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.26.0 |
8888
| <a name="provider_helm"></a> [helm](#provider\_helm) | 2.6.0 |
8989
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.39 |
9090

‎examples/trigger-events/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ $ terraform apply
4949

5050
| Name | Version |
5151
|------|---------|
52-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.25.0 |
52+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.26.0 |
5353

5454
## Modules
5555

‎modules/infrastructure/cloudtrail/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
| Name | Version |
1414
|------|---------|
15-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.25.0 |
15+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.26.0 |
1616

1717
## Modules
1818

‎modules/infrastructure/cloudtrail_s3-sns-sqs/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ EVENT FILTER/fine-tunning, regarding what we want to send to Sysdig Cloud-Connec
4646

4747
| Name | Version |
4848
|------|---------|
49-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.25.0 |
49+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.26.0 |
5050

5151
## Modules
5252

‎modules/infrastructure/codebuild/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
| Name | Version |
1414
|------|---------|
15-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.25.0 |
15+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.26.0 |
1616

1717
## Modules
1818

‎modules/infrastructure/ecs-vpc/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313

1414
| Name | Version |
1515
|------|---------|
16-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.25.0 |
16+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.26.0 |
1717

1818
## Modules
1919

‎modules/infrastructure/eks/README.md

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,17 @@
11
## usage
22

3-
- populate `.envrc.template` > `.envrc`
3+
```terraform
4+
module "eks"{
5+
source = "sysdiglabs/secure-for-cloud/aws//modules/infrastructure/eks"
6+
default_vpc_subnets = ["<SUBNET_1>", "<SUBNET_2>"]
7+
name = "<IDENTIFYING_NAME>"
8+
}
9+
10+
```
11+
412
- connect to eks
5-
```
6-
aws eks --region $(terraform output -raw k8s_region) update-kubeconfig --name $(terraform output -raw k8s_name)
7-
```
13+
```
14+
aws eks --region <REGION> update-kubeconfig --name <IDENTIFYING_NAME>
15+
```
16+
17+
- kubectx; select the cluster and enjoy

0 commit comments

Comments
 (0)