diff --git a/.terraform-registry b/.terraform-registry deleted file mode 100644 index 6ee08926..00000000 --- a/.terraform-registry +++ /dev/null @@ -1,3 +0,0 @@ -Request: Please transfer ownership of the Terraform Registry module published from this repository from @wideawakening to @sysdig-terraform (Support request #118442) -Registry Link: https://registry.terraform.io/modules/sysdiglabs/secure-for-cloud/aws/latest -Request by: @nkraemer-sysdig diff --git a/CODEOWNERS b/CODEOWNERS index b06a3f1a..668aee68 100644 --- a/CODEOWNERS +++ b/CODEOWNERS @@ -1,4 +1 @@ * @sysdiglabs/cloud-native - -# compliance -/modules/services/cloud-bench/ @haresh-suresh @nkraemer-sysdig @sysdiglabs/cloud-native diff --git a/CONTRIBUTE.md b/CONTRIBUTE.md index 2d1a8bfd..2ec65bda 100644 --- a/CONTRIBUTE.md +++ b/CONTRIBUTE.md @@ -3,7 +3,6 @@ - Use **conventional commits** | https://www.conventionalcommits.org/en/v1.0.0 - Current suggested **scopes** to be used within feat(scope), fix(scope), ... - threat - - bench - scan - docs - tests diff --git a/README.md b/README.md index 6a849f63..184a3d7d 100644 --- a/README.md +++ b/README.md @@ -1,54 +1,19 @@ -# Sysdig Secure for Cloud in AWS - -Terraform module that deploys the [**Sysdig Secure for Cloud** stack in **AWS**](https://docs.sysdig.com/en/docs/installation/sysdig-secure-for-cloud/deploy-sysdig-secure-for-cloud-on-aws). -
- -Provides unified threat-detection, compliance, forensics and analysis through these major components: - -* **[Threat Detection](https://docs.sysdig.com/en/docs/sysdig-secure/insights/)**: Tracks abnormal and suspicious activities in your cloud environment based on Falco language. Managed through `cloud-connector` module.
- -* **[Compliance](https://docs.sysdig.com/en/docs/sysdig-secure/posture/compliance/compliance-unified-/)**: Enables the evaluation of standard compliance frameworks. Requires just `cloud-bench` module.
- -* **[Identity and Access Management](https://docs.sysdig.com/en/docs/sysdig-secure/posture/identity-and-access/)**: Analyses user access overly permissive policies. Requires both modules `cloud-connector` and `cloud-bench`.
- -* **[Image Scanning](https://docs.sysdig.com/en/docs/sysdig-secure/scanning/)**: Automatically scans all container images pushed to the registry (ECR) and the images that run on the AWS workload (currently ECS). Managed through `cloud-connector`.
Disabled by Default, can be enabled through `deploy_image_scanning_ecr` and `deploy_image_scanning_ecs` input variable parameters.
- -For other Cloud providers check: [GCP](https://github.com/sysdiglabs/terraform-google-secure-for-cloud), [Azure](https://github.com/sysdiglabs/terraform-azurerm-secure-for-cloud) - -
+# Sunset Notice +> [!CAUTION] +> Sysdig released a new onboarding experience for AWS in September 2024. We recommend connecting your cloud accounts by [following these instructions](https://docs.sysdig.com/en/docs/sysdig-secure/connect-cloud-accounts/). +> +> This repository should be used solely in cases where Agentless Threat Detection cannot be used. ## Usage -There are several ways to deploy Secure for Cloud in you AWS infrastructure, -- **[`/examples`](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/examples)** for the most common scenarios +There are several ways to deploy Agent based Cloud Detection and Response (CDR) in your AWS infrastructure: - [Single Account on ECS](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/examples/single-account-ecs/) - [Single Account on AppRunner](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/examples/single-account-apprunner/) - [Single-Account with a pre-existing Kubernetes Cluster](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/examples/single-account-k8s/) - [Organizational](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/examples/organizational/) - - Many module,examples and use-cases, we provide ways to **re-use existing resources (as optionals)** in your - infrastructure. Check input summary on each example/module. - -- **[`/use-cases`](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/use-cases)** with self-baked customer-specific alternative scenarios. -
- -Find specific overall service arquitecture diagrams attached to each example/use-case. -In the long-term our purpose is to evaluate those use-cases and if they're common enough, convert them into examples to make their usage easier. - -If you're unsure about what/how to use this module, please fill the [questionnaire](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/blob/master/use-cases/_questionnaire.md) report as an issue and let us know your context, we will be happy to help. - -### Notice - -* [AWS regions](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints) -* **Resource creation inventory** Find all the resources created by Sysdig examples in the resource-group `sysdig-secure-for-cloud` (AWS Resource Group & Tag Editor)
-* All Sysdig Secure for Cloud features but [Image Scanning](https://docs.sysdig.com/en/docs/sysdig-secure/scanning/) are enabled by default. You can enable it through `deploy_scanning` input variable parameters.
- - **Management Account ECR image scanning** is not support since it's [not a best practice](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_best-practices_mgmt-acct.html#best-practices_mgmt-use) to have an ECR in the management account. However, we have a workaround to [solve this problem](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud#q-aws-scanning-images-pushed-to-management-account-ecr-are-not-scanned) in case you need to scan images pushed to the management account ECR. -* **Deployment cost** This example will create resources that cost money.
Run `terraform destroy` when you don't need them anymore -* For **free subscription** users, beware that organizational examples may not deploy properly due to the [1 cloud-account limitation](https://docs.sysdig.com/en/docs/administration/administration-settings/subscription/#cloud-billing-free-tier). Open an Issue so we can help you here! - - -
+If you're unsure about how to use this module, please contact your Sysdig representative. Our experts will guide you through the process and assist you in setting up your account securely and correctly. ## Required Permissions @@ -333,22 +298,6 @@ $ curl -v https:///api/cloud/v2/accounts/' ``` -### Q-Benchmark: Getting Error: Not enough privileges to complete the action, Access is denied - -``` -Error: Not enough privileges to complete the action, Access is denied -│ -│ with module.secure -for-cloud_organizational.module.cloud_bench_org[0].sysdig_secure_benchmark_task.benchmark_task, -│ on.terraform / modules / secure -for-cloud_organizational / modules / services / cloud - bench / main.tf line 55, in resource "sysdig_secure_benchmark_task" "benchmark_task": - -│ Error: error waiting for CloudFormation StackSet(sysdig - secure - cloudbench) update: unexpected state 'FAILED', wanted target 'SUCCEEDED'.last error: Operation(terraform - 20221130212414336200000001) Results: 6 errors occurred: -│ * Account(***) Region(us - east - 1) Status(SUCCEEDED) Status Reason: No updates are to be performed. -│ * Account(***) Region(us - east - 1) Status(FAILED) Status Reason: Account *** should have -'stacksets-exec-70e2f8a88d368a5d3df60f4eb8c247dc' role with trust relationship to Role 'aws-service-role/stacksets.cloudformation.amazonaws.com/AWSServiceRoleForCloudFormationStackSetsOrgAdmin -``` - -A: For **Organizational** Setup for cloudbench (deployed through management account / delegated administrator vía stackset) make sure it's being deployed in the management account. [enable organizational trusted access to stackset](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-enable-trusted-access.html) as part of the [prerequisites for stackset operations](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs.html) - ### Q-RuntimeThreat Detection: Getting error 403 `"could not load rule set from Sysdig Secure: ruleprovider#newPartialRuleSet | error loading default-rules: error from Sysdig Secure API: 403` A: The Sysdig User that deployed the components is a standard user within the Sysdig Platform. Only administrator users are given permissions to read falco rule sets. Once this permission is changed, you should no longer get this error and CSPM Cloud events should start populating. diff --git a/examples/organizational/README.md b/examples/organizational/README.md index 51e4d44e..37333c14 100644 --- a/examples/organizational/README.md +++ b/examples/organizational/README.md @@ -74,14 +74,12 @@ Role usage for this example comes as follows. Check [permissions](../../README.m - used by Sysdig to subscribe to cloudtrail events - used by Sysdig, for image scanning feature, to `assumeRole` on `OrganizationAccountAccessRole` to be able to fetch image data from ECS Tasks and scan ECR hosted images - - `SysdigCloudBench` role will be created for SecurityAudit read-only purpose, used by Sysdig to benchmark - **member accounts** - terraform aws provider: 'member' aliased - this provider can be configured as desired, we just provide a default option - by default, we suggest using an assumeRole to the [AWS created default role `OrganizationAccountAccessRole`](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html) - if this role does not exist provide input var `organizational_member_default_admin_role` with the role - - `SysdigCloudBench` role will be created for SecurityAudit read-only purpose, used by Sysdig to benchmark - **sysdig workload member account** - if ECS workload is deployed, `ECSTaskRole` will be used to define its permissions @@ -160,8 +158,6 @@ $ terraform apply | Name | Source | Version | |------|--------|---------| -| [cloud\_bench\_org](#module\_cloud\_bench\_org) | ../../modules/services/cloud-bench | n/a | -| [cloud\_bench\_single](#module\_cloud\_bench\_single) | ../../modules/services/cloud-bench | n/a | | [cloud\_connector](#module\_cloud\_connector) | ../../modules/services/cloud-connector-ecs | n/a | | [cloudtrail](#module\_cloudtrail) | ../../modules/infrastructure/cloudtrail | n/a | | [codebuild](#module\_codebuild) | ../../modules/infrastructure/codebuild | n/a | @@ -178,7 +174,6 @@ $ terraform apply | [aws_iam_role.connector_ecs_task](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | | [aws_caller_identity.me](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | | [aws_iam_policy_document.task_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | | [sysdig_secure_connection.current](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_connection) | data source | ## Inputs @@ -191,8 +186,6 @@ $ terraform apply | [cloudtrail\_kms\_enable](#input\_cloudtrail\_kms\_enable) | true/false whether the created cloudtrail should deliver encrypted events to s3 | `bool` | `true` | no | | [cloudtrail\_s3\_bucket\_expiration\_days](#input\_cloudtrail\_s3\_bucket\_expiration\_days) | Number of days that the logs will persist in the bucket | `number` | `5` | no | | [connector\_ecs\_task\_role\_name](#input\_connector\_ecs\_task\_role\_name) | Name for the ecs task role. This is only required to resolve cyclic dependency with organizational approach | `string` | `"organizational-ECSTaskRole"` | no | -| [deploy\_benchmark](#input\_deploy\_benchmark) | Whether to deploy or not the cloud benchmarking | `bool` | `true` | no | -| [deploy\_benchmark\_organizational](#input\_deploy\_benchmark\_organizational) | true/false whether benchmark module should be deployed on organizational or single-account mode (1 role per org accounts if true, 1 role in default aws provider account if false) | `bool` | `true` | no | | [deploy\_beta\_image\_scanning\_ecr](#input\_deploy\_beta\_image\_scanning\_ecr) | true/false whether to deploy the beta image scanning on ECR pushed images (experimental and unsupported) | `bool` | `false` | no | | [deploy\_image\_scanning\_ecr](#input\_deploy\_image\_scanning\_ecr) | true/false whether to deploy the image scanning on ECR pushed images | `bool` | `false` | no | | [deploy\_image\_scanning\_ecs](#input\_deploy\_image\_scanning\_ecs) | true/false whether to deploy the image scanning on ECS running images | `bool` | `false` | no | diff --git a/examples/organizational/cloud-bench.tf b/examples/organizational/cloud-bench.tf deleted file mode 100644 index bdd6c887..00000000 --- a/examples/organizational/cloud-bench.tf +++ /dev/null @@ -1,29 +0,0 @@ -# note; had to split cloud_bench module due to not being able to use dynamics on provider -# https://github.com/hashicorp/terraform/issues/25244 - -module "cloud_bench_org" { - count = var.deploy_benchmark && var.deploy_benchmark_organizational ? 1 : 0 - - source = "../../modules/services/cloud-bench" - - name = "${var.name}-cloudbench" - is_organizational = true - region = data.aws_region.current.name - - tags = var.tags -} - -module "cloud_bench_single" { - count = var.deploy_benchmark && !var.deploy_benchmark_organizational ? 1 : 0 - providers = { - aws = aws.member - } - - source = "../../modules/services/cloud-bench" - - name = "${var.name}-cloudbench" - is_organizational = false - region = data.aws_region.current.name - - tags = var.tags -} diff --git a/examples/organizational/data.tf b/examples/organizational/data.tf index c5d0d394..31da1f10 100644 --- a/examples/organizational/data.tf +++ b/examples/organizational/data.tf @@ -1,3 +1,2 @@ -data "aws_region" "current" {} data "sysdig_secure_connection" "current" {} data "aws_caller_identity" "me" {} diff --git a/examples/organizational/variables.tf b/examples/organizational/variables.tf index 55043c5b..7ef42e35 100644 --- a/examples/organizational/variables.tf +++ b/examples/organizational/variables.tf @@ -110,23 +110,6 @@ variable "deploy_image_scanning_ecs" { } -# -# benchmark configuration -# - -variable "deploy_benchmark" { - type = bool - description = "Whether to deploy or not the cloud benchmarking" - default = true -} - -variable "deploy_benchmark_organizational" { - type = bool - default = true - description = "true/false whether benchmark module should be deployed on organizational or single-account mode (1 role per org accounts if true, 1 role in default aws provider account if false)" -} - - #--------------------------------- # ecs, security group, vpc #--------------------------------- diff --git a/examples/single-account-apprunner/README.md b/examples/single-account-apprunner/README.md index ead476fd..f6085a4e 100644 --- a/examples/single-account-apprunner/README.md +++ b/examples/single-account-apprunner/README.md @@ -79,7 +79,6 @@ $ terraform apply | Name | Source | Version | |------|--------|---------| -| [cloud\_bench](#module\_cloud\_bench) | ../../modules/services/cloud-bench | n/a | | [cloud\_connector](#module\_cloud\_connector) | ../../modules/services/cloud-connector-apprunner | n/a | | [cloudtrail](#module\_cloudtrail) | ../../modules/infrastructure/cloudtrail | n/a | | [codebuild](#module\_codebuild) | ../../modules/infrastructure/codebuild | n/a | @@ -100,7 +99,6 @@ $ terraform apply | [cloudtrail\_is\_multi\_region\_trail](#input\_cloudtrail\_is\_multi\_region\_trail) | true/false whether cloudtrail will ingest multiregional events | `bool` | `true` | no | | [cloudtrail\_kms\_enable](#input\_cloudtrail\_kms\_enable) | true/false whether cloudtrail delivered events to S3 should persist encrypted | `bool` | `true` | no | | [cloudtrail\_sns\_arn](#input\_cloudtrail\_sns\_arn) | ARN of a pre-existing cloudtrail\_sns. If defaulted, a new cloudtrail will be created. ARN of a pre-existing cloudtrail\_sns. If defaulted, a new cloudtrail will be created. If specified, sysdig deployment account and region must match with the specified SNS | `string` | `"create"` | no | -| [deploy\_benchmark](#input\_deploy\_benchmark) | Whether to deploy or not the cloud benchmarking | `bool` | `true` | no | | [deploy\_beta\_image\_scanning\_ecr](#input\_deploy\_beta\_image\_scanning\_ecr) | true/false whether to deploy the beta image scanning on ECR pushed images (experimental and unsupported) | `bool` | `false` | no | | [deploy\_image\_scanning\_ecr](#input\_deploy\_image\_scanning\_ecr) | true/false whether to deploy the image scanning on ECR pushed images | `bool` | `false` | no | | [deploy\_image\_scanning\_ecs](#input\_deploy\_image\_scanning\_ecs) | true/false whether to deploy the image scanning on ECS running images | `bool` | `false` | no | diff --git a/examples/single-account-apprunner/benchmark.tf b/examples/single-account-apprunner/benchmark.tf deleted file mode 100644 index 91577a08..00000000 --- a/examples/single-account-apprunner/benchmark.tf +++ /dev/null @@ -1,7 +0,0 @@ -module "cloud_bench" { - source = "../../modules/services/cloud-bench" - count = var.deploy_benchmark ? 1 : 0 - - name = "${var.name}-cloudbench" - tags = var.tags -} diff --git a/examples/single-account-apprunner/variables.tf b/examples/single-account-apprunner/variables.tf index 37a5b4ee..7c2f0522 100644 --- a/examples/single-account-apprunner/variables.tf +++ b/examples/single-account-apprunner/variables.tf @@ -48,16 +48,6 @@ variable "deploy_image_scanning_ecs" { default = false } -# -# benchmark configuration -# - -variable "deploy_benchmark" { - type = bool - description = "Whether to deploy or not the cloud benchmarking" - default = true -} - # # general # diff --git a/examples/single-account-ecs/README.md b/examples/single-account-ecs/README.md index 60124922..9880c169 100644 --- a/examples/single-account-ecs/README.md +++ b/examples/single-account-ecs/README.md @@ -79,7 +79,6 @@ $ terraform apply | Name | Source | Version | |------|--------|---------| -| [cloud\_bench](#module\_cloud\_bench) | ../../modules/services/cloud-bench | n/a | | [cloud\_connector](#module\_cloud\_connector) | ../../modules/services/cloud-connector-ecs | n/a | | [cloudtrail](#module\_cloudtrail) | ../../modules/infrastructure/cloudtrail | n/a | | [codebuild](#module\_codebuild) | ../../modules/infrastructure/codebuild | n/a | @@ -103,7 +102,6 @@ $ terraform apply | [cloudtrail\_kms\_enable](#input\_cloudtrail\_kms\_enable) | true/false whether cloudtrail delivered events to S3 should persist encrypted | `bool` | `true` | no | | [cloudtrail\_s3\_bucket\_expiration\_days](#input\_cloudtrail\_s3\_bucket\_expiration\_days) | Number of days that the logs will persist in the bucket | `number` | `5` | no | | [cloudtrail\_sns\_arn](#input\_cloudtrail\_sns\_arn) | ARN of a pre-existing cloudtrail\_sns. If defaulted, a new cloudtrail will be created. If specified, sysdig deployment account and region must match with the specified SNS | `string` | `"create"` | no | -| [deploy\_benchmark](#input\_deploy\_benchmark) | Whether to deploy or not the cloud benchmarking | `bool` | `true` | no | | [deploy\_beta\_image\_scanning\_ecr](#input\_deploy\_beta\_image\_scanning\_ecr) | true/false whether to deploy the beta image scanning on ECR pushed images (experimental and unsupported) | `bool` | `false` | no | | [deploy\_image\_scanning\_ecr](#input\_deploy\_image\_scanning\_ecr) | true/false whether to deploy the image scanning on ECR pushed images | `bool` | `false` | no | | [deploy\_image\_scanning\_ecs](#input\_deploy\_image\_scanning\_ecs) | true/false whether to deploy the image scanning on ECS running images | `bool` | `false` | no | diff --git a/examples/single-account-ecs/benchmark.tf b/examples/single-account-ecs/benchmark.tf deleted file mode 100644 index 91577a08..00000000 --- a/examples/single-account-ecs/benchmark.tf +++ /dev/null @@ -1,7 +0,0 @@ -module "cloud_bench" { - source = "../../modules/services/cloud-bench" - count = var.deploy_benchmark ? 1 : 0 - - name = "${var.name}-cloudbench" - tags = var.tags -} diff --git a/examples/single-account-ecs/variables.tf b/examples/single-account-ecs/variables.tf index 6c2ee3d7..cd28ddd7 100644 --- a/examples/single-account-ecs/variables.tf +++ b/examples/single-account-ecs/variables.tf @@ -99,17 +99,6 @@ variable "deploy_image_scanning_ecs" { default = false } - -# -# benchmark configuration -# - -variable "deploy_benchmark" { - type = bool - description = "Whether to deploy or not the cloud benchmarking" - default = true -} - # # cloud connector connector configuration # diff --git a/examples/single-account-k8s/README.md b/examples/single-account-k8s/README.md index 101dff7f..b1c44307 100644 --- a/examples/single-account-k8s/README.md +++ b/examples/single-account-k8s/README.md @@ -94,7 +94,6 @@ $ terraform apply | Name | Source | Version | |------|--------|---------| -| [cloud\_bench](#module\_cloud\_bench) | ../../modules/services/cloud-bench | n/a | | [cloud\_connector\_sqs](#module\_cloud\_connector\_sqs) | ../../modules/infrastructure/sqs-sns-subscription | n/a | | [cloudtrail](#module\_cloudtrail) | ../../modules/infrastructure/cloudtrail | n/a | | [codebuild](#module\_codebuild) | ../../modules/infrastructure/codebuild | n/a | @@ -118,7 +117,6 @@ $ terraform apply | [cloudtrail\_kms\_enable](#input\_cloudtrail\_kms\_enable) | true/false whether s3 should be encrypted. testing/economization purpose. | `bool` | `true` | no | | [cloudtrail\_sns\_arn](#input\_cloudtrail\_sns\_arn) | ARN of a pre-existing cloudtrail\_sns. If defaulted, a new cloudtrail will be created. If specified, deployment region must match Cloudtrail S3 bucket region | `string` | `"create"` | no | | [deploy\_aws\_iam\_user](#input\_deploy\_aws\_iam\_user) | true/false whether to deploy an iam user. if set to false, check [required role permissions](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/blob/master/resources/policy-single-account-k8s-aws.json) | `bool` | `true` | no | -| [deploy\_benchmark](#input\_deploy\_benchmark) | Whether to deploy or not the cloud benchmarking | `bool` | `true` | no | | [deploy\_beta\_image\_scanning\_ecr](#input\_deploy\_beta\_image\_scanning\_ecr) | true/false whether to deploy the beta image scanning on ECR pushed images (experimental and unsupported) | `bool` | `false` | no | | [deploy\_image\_scanning\_ecr](#input\_deploy\_image\_scanning\_ecr) | true/false whether to deploy the image scanning on ECR pushed images | `bool` | `false` | no | | [deploy\_image\_scanning\_ecs](#input\_deploy\_image\_scanning\_ecs) | true/false whether to deploy the image scanning on ECS running images | `bool` | `false` | no | diff --git a/examples/single-account-k8s/benchmark.tf b/examples/single-account-k8s/benchmark.tf deleted file mode 100644 index 91577a08..00000000 --- a/examples/single-account-k8s/benchmark.tf +++ /dev/null @@ -1,7 +0,0 @@ -module "cloud_bench" { - source = "../../modules/services/cloud-bench" - count = var.deploy_benchmark ? 1 : 0 - - name = "${var.name}-cloudbench" - tags = var.tags -} diff --git a/examples/single-account-k8s/variables.tf b/examples/single-account-k8s/variables.tf index 2509bc56..bd38aa62 100644 --- a/examples/single-account-k8s/variables.tf +++ b/examples/single-account-k8s/variables.tf @@ -61,15 +61,6 @@ variable "deploy_image_scanning_ecs" { } -# -# benchmark configuration -# -variable "deploy_benchmark" { - type = bool - description = "Whether to deploy or not the cloud benchmarking" - default = true -} - # # aws iam user configuration # diff --git a/modules/services/cloud-bench/README.md b/modules/services/cloud-bench/README.md deleted file mode 100644 index 0733cdc8..00000000 --- a/modules/services/cloud-bench/README.md +++ /dev/null @@ -1,73 +0,0 @@ -# Cloud Bench deploy in AWS Module - - -Deployed on the **target AWS account(s)**: - -- The required IAM Role and IAM Policies (`arn:aws:iam::aws:policy/SecurityAudit`) to allow Sysdig to run AWS Benchmarks on your behalf. - - A Sysdig provided `ExternalId` will be used. - - This is done using `aws_cloudformation_stack_set`. - -Deployed on **Sysdig Backend** -- The required provisioning on Sysdig Backend to use the `ExternalId`-basedIAM Role with an AssumeRole. -- An `aws_foundations_bench-1.3.0` benchmak task schedule on a random hour of the day `rand rand * * *` - -This module will be deployed as a StackSet and it will take into account newly member accounts added to the Organization. - - - -## Requirements - -| Name | Version | -|------|---------| -| [terraform](#requirement\_terraform) | >= 1.0.0 | -| [aws](#requirement\_aws) | >= 3.62.0 | -| [sysdig](#requirement\_sysdig) | >= 0.5.29 | - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | >= 3.62.0 | -| [sysdig](#provider\_sysdig) | >= 0.5.29 | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [aws_cloudformation_stack_set.stackset](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudformation_stack_set) | resource | -| [aws_cloudformation_stack_set_instance.stackset_instance](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudformation_stack_set_instance) | resource | -| [aws_iam_role.cloudbench_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | -| [aws_iam_role_policy_attachment.cloudbench_security_audit](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | -| [sysdig_secure_cloud_account.cloud_account](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/resources/secure_cloud_account) | resource | -| [aws_caller_identity.me](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | -| [aws_iam_policy.security_audit](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source | -| [aws_iam_policy_document.trust_relationship](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_organizations_organization.org](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/organizations_organization) | data source | -| [sysdig_secure_trusted_cloud_identity.trusted_identity](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_trusted_cloud_identity) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [is\_organizational](#input\_is\_organizational) | true/false whether secure-for-cloud should be deployed in an organizational setup (all accounts of org) or not (only on default aws provider account) | `bool` | `false` | no | -| [name](#input\_name) | The name of the IAM Role that will be created. | `string` | `"sfc-cloudbench"` | no | -| [provision\_caller\_account](#input\_provision\_caller\_account) | true/false whether to provision the aws provider account (if is\_organizational=true management account, if is\_organizational=false it will depend on the provider setup on the caller module | `bool` | `true` | no | -| [region](#input\_region) | Default region for resource creation in organization mode | `string` | `"eu-central-1"` | no | -| [tags](#input\_tags) | customization of tags to be assigned to all resources.
always include 'product' default tag for resource-group proper functioning.
can also make use of the [provider-level `default-tags`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags) | `map(string)` | 
{
  "product": "sysdig-secure-for-cloud"
}
| no | - -## Outputs - -No outputs. - - -## Authors - -Module is maintained by [Sysdig](https://sysdig.com). - -## License - -Apache 2 Licensed. See LICENSE for full details. diff --git a/modules/services/cloud-bench/main.tf b/modules/services/cloud-bench/main.tf deleted file mode 100644 index 6f962e66..00000000 --- a/modules/services/cloud-bench/main.tf +++ /dev/null @@ -1,140 +0,0 @@ -#---------------------------------------------------------- -# Fetch & compute required data -#---------------------------------------------------------- - -data "aws_caller_identity" "me" {} - -data "aws_organizations_organization" "org" { - count = var.is_organizational ? 1 : 0 -} - -data "sysdig_secure_trusted_cloud_identity" "trusted_identity" { - cloud_provider = "aws" -} - -locals { - caller_account = data.aws_caller_identity.me.account_id - member_account_ids = var.is_organizational ? [for a in data.aws_organizations_organization.org[0].non_master_accounts : a.id] : [] - account_ids_to_deploy = var.is_organizational && var.provision_caller_account ? concat(local.member_account_ids, [data.aws_organizations_organization.org[0].master_account_id]) : local.member_account_ids -} - -#---------------------------------------------------------- -# Configure Sysdig Backend -#---------------------------------------------------------- - -resource "sysdig_secure_cloud_account" "cloud_account" { - for_each = var.is_organizational ? toset(local.account_ids_to_deploy) : [local.caller_account] - - account_id = each.value - cloud_provider = "aws" - role_enabled = "true" - role_name = var.name - - lifecycle { - ignore_changes = [alias] - } -} - -locals { - external_id = try( - sysdig_secure_cloud_account.cloud_account[local.account_ids_to_deploy[0]].external_id, - sysdig_secure_cloud_account.cloud_account[local.caller_account].external_id, - ) -} - -#---------------------------------------------------------- -# If this is not an Organizational deploy, create role/polices directly -#---------------------------------------------------------- - -data "aws_iam_policy" "security_audit" { - arn = "arn:aws:iam::aws:policy/SecurityAudit" -} - -data "aws_iam_policy_document" "trust_relationship" { - statement { - effect = "Allow" - actions = ["sts:AssumeRole"] - principals { - type = "AWS" - identifiers = [data.sysdig_secure_trusted_cloud_identity.trusted_identity.identity] - } - condition { - test = "StringEquals" - variable = "sts:ExternalId" - values = [local.external_id] - } - } -} - -resource "aws_iam_role" "cloudbench_role" { - count = var.is_organizational && !var.provision_caller_account ? 0 : 1 - - name = var.name - assume_role_policy = data.aws_iam_policy_document.trust_relationship.json - tags = var.tags -} - - -resource "aws_iam_role_policy_attachment" "cloudbench_security_audit" { - count = var.is_organizational && !var.provision_caller_account ? 0 : 1 - - role = aws_iam_role.cloudbench_role[0].id - policy_arn = data.aws_iam_policy.security_audit.arn -} - - -#---------------------------------------------------------- -# If this is an Organizational deploy, use a CloudFormation StackSet -#---------------------------------------------------------- - -resource "aws_cloudformation_stack_set" "stackset" { - count = var.is_organizational ? 1 : 0 - - name = var.name - tags = var.tags - permission_model = "SERVICE_MANAGED" - capabilities = ["CAPABILITY_NAMED_IAM"] - - auto_deployment { - enabled = true - retain_stacks_on_account_removal = false - } - - template_body = <