|
| 1 | +# Secure for Cloud for AWS Use-Cases |
| 2 | + |
| 3 | + |
| 4 | + |
| 5 | +Current examples were developed for simple use-case scenarios. |
| 6 | + |
| 7 | +New use-cases are appearing and once we consolidate an standard scenario, we will create new examples to accommodate new requirements. |
| 8 | + |
| 9 | +Check [current use-case list](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/use-cases), or use the [questionnaire](./_questionnaire.md) to let us know your needs |
| 10 | + |
| 11 | + |
| 12 | + |
| 13 | +## Use-Case summary |
| 14 | + |
| 15 | +### Examples |
| 16 | + |
| 17 | +| | `/examples/single-*` | `/examples/organizational-*` | |
| 18 | +| --| -- | -- | |
| 19 | +| Deployment Type | all Sysdig resources will be deployed within the selected account | Most Sysdig resources will be deployed within the selected account (just one), but some features, require resources to be deployed on all of the member-accounts (for Compliance and Image Scanning) . <br />One role is needed on the management account for cloudtrail event access | |
| 20 | +| Target | will only analyse current account | handles all accounts (managed and member)| |
| 21 | +| Drawbacks | cannot re-use another account Cloudtrail data (unless its deployed on the same account where the sns/s3 bucket is) | for scanning, a per-member-account access role is required | |
| 22 | +| More Info | [single-ecs](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/examples/single-account-ecs), [single-apprunner](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/examples/single-account-apprunner), [single-k8s](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/examples/single-account-k8s) | [organizational](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/examples/organizational) | |
| 23 | + |
| 24 | +With both examples `single` and `org`, you can customize the desired features to de deployed with the `deploy_*` input vars to avoid deploying more than wanted. |
| 25 | + |
| 26 | + |
| 27 | +<br/> |
| 28 | + |
| 29 | +### Compute Workload Type |
| 30 | + |
| 31 | +| Cloud | Example Options | |
| 32 | +| - | - | |
| 33 | +| AWS | K8S `-k8s`, ECS `-ecs`, AppRunner `-apprunner` | |
| 34 | +| GCP | K8S `-k8s`, CloudRun | |
| 35 | +| Azure | K8S `-k8s`, AzureContainerInstances | |
| 36 | + |
| 37 | +<br/><br/> |
| 38 | + |
| 39 | + |
| 40 | +## Available Optionals |
| 41 | + |
| 42 | +Make use of optionals to allow the re-use of pre-existing resources, and avoid incurring in more costs. |
| 43 | + |
| 44 | +| Cloud | Optionals | Related Input Vars | Other | |
| 45 | +| -- | --| -- | -- | |
| 46 | +| AWS | Cloudtrail | single: [`cloudtrail_sns_arn`](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/examples/single-account-ecs#input_cloudtrail_sns_arn)<br/>organizational: [`existing_cloudtrail_config`](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/examples/organizational#input_existing_cloudtrail_config) | - | |
| 47 | +| | ECS, VPC, Subnet | `ecs_cluster_name`, `ecs_vpc_id`, `ecs_vpc_subnets_private_ids` | if used, the three are mandatory | |
| 48 | +| GCP | - | - | - | |
| 49 | +| Azure | ResourceGroup | `resource_group_name` | - | |
| 50 | +| | ACR | `registry_name`, `registry_resource_group_name` | - | |
| 51 | +| * | Compute Workload | - | All clouds allow Sysdig Secure for cloud to be deployed on a pre-existing K8S cluster| |
0 commit comments