Skip to content

Commit 80a654a

Browse files
miguelpaismiguelpais
authored
[SSPROD-48175] VM Workload Scanning Component with Azure AKS discovery sub-module (#67)
* First version of AKS sub-module * Some fixes * Adding component for aks-discovery * Making sure that AKS discovery is baked into the vm workload scanning component * Fixing path * Comments from code review * nitpick
1 parent 84e15de commit 80a654a

File tree

11 files changed

+236
-4
lines changed

11 files changed

+236
-4
lines changed

‎modules/config-posture/outputs.tf

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,10 @@ output "service_principal_component_id" {
22
value = "${sysdig_secure_cloud_auth_account_component.azure_service_principal.type}/${sysdig_secure_cloud_auth_account_component.azure_service_principal.instance}"
33
description = "Component identifier of Service Principal created in Sysdig Backend for Config Posture"
44
depends_on = [ sysdig_secure_cloud_auth_account_component.azure_service_principal ]
5-
}
5+
}
6+
7+
output "sysdig_cspm_sp_object_id" {
8+
value = azuread_service_principal.sysdig_cspm_sp.object_id
9+
description = "Object ID of the CSPM SP within the client's infra"
10+
depends_on = [azuread_service_principal.sysdig_cspm_sp]
11+
}

‎modules/vm-workload-scanning/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ No modules.
7676

7777
| Name | Description | Type | Default | Required |
7878
|------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------|---------|:--------:|
79-
| <a name="input_sysdig_secure_account_id"></a> [sysdig\_secure\_account\_id](#input\_sysdig\_secure\_account\_id) | ID of the Sysdig Cloud Account to enable VM Workload Scanning for (incase of organization, ID of the Sysdig management account) | `string` | n/a | yes |
79+
| <a name="input_sysdig_secure_account_id"></a> [sysdig\_secure\_account\_id](#input\_sysdig\_secure\_account\_id) | ID of the Sysdig Cloud Account to enable VM Workload Scanning with optional AKS discovery | `string` | n/a | yes |
8080
| <a name="input_subscription_id"></a> [subscription\_id](#input\_subscription\_id) | The identifier of the Azure Subscription in which to create secure-for-cloud vm workload scanning resources | `string` | n/a | yes |
8181
| <a name="input_is_organizational"></a> [is\_organizational](#input\_is\_organizational) | true/false whether vm workload scanning resources should be deployed in an organizational setup (all subscriptions of tenant) or not (only on default azure provider subscription) | `bool` | `false` | no |
8282
| <a name="input_management_group_ids"></a> [management\_group\_ids](#input\_management\_group\_ids) | List of Azure Management Group IDs. vm workload scanning will be deployed to all the subscriptions under these management groups. | `set(string)` | `[]` | no |

‎modules/vm-workload-scanning/aks-discovery/README.md

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# Azure AKS Discovery Submodule
2+
3+
This module create a custom role definition with full Kubernetes management permissions and assign it to the service principal created within the client's infrastructure for secure-posture.
4+
5+
These permissions are required in order to enable CSPM to fully discover AKS clusters within Azure.
6+
7+
If instrumenting an Azure subscription, the following resources will be created:
8+
- A custom role for full kubernetes cluster management
9+
- A role assignment for the above role against secure-posture Service principal created during foundational onboarding
10+
11+
If instrumenting an Azure Tenant, the following resources will be created:
12+
- Role definitions for full kubernetes cluster management for each management group selected
13+
- Role assignments for the above roles against secure-posture Service principal created during foundational onboarding
14+
15+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
16+
## Requirements
17+
18+
| Name | Version |
19+
|------|-----------|
20+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
21+
| <a name="requirement_azurerm"></a> [azurerm](#requirement\_azurerm) | >= 3.76.0 |
22+
| <a name="requirement_azuread"></a> [azuread](#requirement\_azuread) | >= 2.43.0 |
23+
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | >= 1.29.2 |
24+
25+
## Providers
26+
27+
| Name | Version |
28+
|------|---------|
29+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | >= 3.76.0 |
30+
31+
## Modules
32+
33+
No modules.
34+
35+
## Resources
36+
37+
| Name | Type |
38+
|------|------|
39+
| [azurerm_role_definition.sysdig_cspm_aks_discovery_role](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/service_principal) | resource |
40+
| [azurerm_role_assignment.sysdig_cspm_role_aks_discovery_assignment](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_definition) | resource |
41+
| [azurerm_role_definition.sysdig_cspm_role_aks_discovery_for_tenant](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_definition) | resource |
42+
| [azurerm_role_assignment.sysdig_cspm_role_assignment_for_tenant](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_definition) | resource |
43+
44+
## Inputs
45+
46+
| Name | Description | Type | Default | Required |
47+
|------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------|---------|:--------:|
48+
| <a name="input_sysdig_secure_account_id"></a> [sysdig\_secure\_account\_id](#input\_sysdig\_secure\_account\_id) | ID of the Sysdig Cloud Account to enable Config Posture for (incase of organization, ID of the Sysdig management account) | `string` | n/a | yes |
49+
| <a name="input_subscription_id"></a> [subscription\_id](#input\_subscription\_id) | Subscription ID in which to create secure-for-cloud onboarding resources | `string` | n/a | yes |
50+
| <a name="input_is_organizational"></a> [is\_organizational](#input\_is\_organizational) | (Optional) Set this field to 'true' to deploy secure-for-cloud to an Azure Tenant | `bool` | `false` | no |
51+
| <a name="input_management_group_ids"></a> [management\_group\_ids](#input\_management\_group\_ids) | (Optional) List of Azure Management Group IDs. secure-for-cloud will be deployed to all the subscriptions under these management groups | `set(string)` | `[]` | no |
52+
| <a name="sysdig_cspm_sp_object_id"></a> [management\_group\_ids](#input\_management\_group\_ids) | Object ID of the CSPM SP within the client's infra | `string` | `[]` | yes |
53+
54+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
55+
56+
## Authors
57+
58+
Module is maintained by [Sysdig](https://sysdig.com).
59+
60+
## License
61+
62+
Apache 2 Licensed. See LICENSE for full details.

‎modules/vm-workload-scanning/aks-discovery/main.tf

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
#---------------------------------------------------------------------------------------------
2+
# Fetch the subscription data
3+
#---------------------------------------------------------------------------------------------
4+
data "azurerm_subscription" "primary" {
5+
subscription_id = var.subscription_id
6+
}
7+
8+
locals {
9+
agentless_aks_connection_permissions_actions = "Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action"
10+
}
11+
12+
#---------------------------------------------------------------------------------------------
13+
# Create a Custom role for collecting authsettings
14+
#---------------------------------------------------------------------------------------------
15+
resource "azurerm_role_definition" "sysdig_cspm_aks_discovery_role" {
16+
count = var.is_organizational ? 0 : 1
17+
18+
name = "sysdig-cspm-role-aks-discovery-${var.subscription_id}"
19+
scope = data.azurerm_subscription.primary.id
20+
description = "Custom role for AKS Discovery"
21+
22+
permissions {
23+
actions = local.agentless_aks_connection_permissions_actions
24+
not_actions = []
25+
}
26+
27+
assignable_scopes = [
28+
data.azurerm_subscription.primary.id,
29+
]
30+
}
31+
32+
#---------------------------------------------------------------------------------------------
33+
# Custom role assignment for AKS Discovery
34+
#---------------------------------------------------------------------------------------------
35+
resource "azurerm_role_assignment" "sysdig_cspm_role_aks_discovery_assignment" {
36+
count = var.is_organizational ? 0 : 1
37+
38+
scope = data.azurerm_subscription.primary.id
39+
role_definition_id = azurerm_role_definition.sysdig_cspm_aks_discovery_role.role_definition_resource_id
40+
principal_id = var.sysdig_cspm_sp_object_id
41+
}
42+
43+
resource "sysdig_secure_cloud_auth_account_component" "azure_aks_discovery_component" {
44+
account_id = var.sysdig_secure_account_id
45+
type = "COMPONENT_UNSPECIFIED"
46+
instance = "secure-aks-discovery"
47+
48+
depends_on = [azurerm_role_definition.sysdig_cspm_aks_discovery_role,
49+
azurerm_role_assignment.sysdig_cspm_role_aks_discovery_assignment,
50+
azurerm_role_definition.sysdig_cspm_role_aks_discovery_for_tenant,
51+
azurerm_role_assignment.sysdig_cspm_role_assignment_for_tenant,
52+
]
53+
}

‎modules/vm-workload-scanning/aks-discovery/organizational.tf

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
#---------------------------------------------------------------------------------------------
2+
# Fetch the management groups for customer tenant and onboard subscriptions under them
3+
#---------------------------------------------------------------------------------------------
4+
data "azurerm_management_group" "root_management_group" {
5+
count = var.is_organizational && length(var.management_group_ids) == 0 ? 1 : 0
6+
display_name = "Tenant Root Group"
7+
}
8+
9+
locals {
10+
# when empty, this will be the root management group whose default display name is "Tenant root group"
11+
management_groups = var.is_organizational && length(var.management_group_ids) == 0 ? [data.azurerm_management_group.root_management_group[0].id] : toset(
12+
[for m in var.management_group_ids : format("%s/%s", "/providers/Microsoft.Management/managementGroups", m)])
13+
}
14+
15+
resource "azurerm_role_definition" "sysdig_cspm_role_aks_discovery_for_tenant" {
16+
for_each = var.is_organizational ? local.management_groups : []
17+
18+
name = "sysdig_cspm_role_for_tenant_${each.key}"
19+
scope = each.key
20+
description = "Custom role for collecting Authsettings for CIS Benchmark"
21+
22+
permissions {
23+
actions = local.agentless_aks_connection_permissions_actions
24+
not_actions = []
25+
}
26+
27+
assignable_scopes = [
28+
each.key,
29+
]
30+
}
31+
32+
#---------------------------------------------------------------------------------------------
33+
# Custom role assignment for collecting authsettings
34+
#---------------------------------------------------------------------------------------------
35+
resource "azurerm_role_assignment" "sysdig_cspm_role_assignment_for_tenant" {
36+
for_each = var.is_organizational ? local.management_groups : []
37+
38+
scope = each.key
39+
role_definition_id = azurerm_role_definition.sysdig_cspm_role_aks_discovery_for_tenant[each.key].role_definition_resource_id
40+
principal_id = var.sysdig_cspm_sp_object_id
41+
}

‎modules/vm-workload-scanning/aks-discovery/outputs.tf

Whitespace-only changes.

‎modules/vm-workload-scanning/aks-discovery/variables.tf

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
variable "sysdig_secure_account_id" {
2+
type = string
3+
description = "ID of the Sysdig Cloud Account to enable Config Posture for (incase of organization, ID of the Sysdig management account)"
4+
}
5+
6+
variable "subscription_id" {
7+
type = string
8+
description = "Subscription ID in which to create secure-for-cloud onboarding resources"
9+
}
10+
11+
variable "is_organizational" {
12+
description = "(Optional) Set this field to 'true' to deploy secure-for-cloud to an Azure Tenant."
13+
type = bool
14+
default = false
15+
}
16+
17+
variable "management_group_ids" {
18+
description = "(Optional) List of Azure Management Group IDs. secure-for-cloud will be deployed to all the subscriptions under these management groups."
19+
type = set(string)
20+
default = []
21+
}
22+
23+
variable "sysdig_cspm_sp_object_id" {
24+
description = "Object ID of the CSPM SP within the client's infra"
25+
type = string
26+
}

‎modules/vm-workload-scanning/aks-discovery/versions.tf

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
terraform {
2+
required_version = ">= 1.0.0"
3+
4+
required_providers {
5+
azurerm = {
6+
source = "hashicorp/azurerm"
7+
version = ">= 3.76.0"
8+
}
9+
azuread = {
10+
source = "hashicorp/azuread"
11+
version = ">= 2.43.0"
12+
}
13+
sysdig = {
14+
source = "sysdiglabs/sysdig"
15+
version = "~> 1.29.2"
16+
}
17+
}
18+
}

‎modules/vm-workload-scanning/main.tf

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,15 @@
1+
module "aks_discovery" {
2+
count = var.aks_discovery_permission_grant ? 1 : 0
3+
4+
source = "sysdiglabs/secure/azurerm//modules/vm-workload-scanning/aks-discovery"
5+
6+
sysdig_secure_account_id = var.sysdig_secure_account_id
7+
subscription_id = var.subscription_id
8+
is_organizational = var.is_organizational
9+
management_group_ids = var.management_group_ids
10+
sysdig_cspm_sp_object_id = var.sysdig_cspm_sp_object_id
11+
}
12+
113
data "azurerm_subscription" "primary" {
214
subscription_id = var.subscription_id
315
}
@@ -121,10 +133,13 @@ resource "sysdig_secure_cloud_auth_account_component" "azure_workload_scanning_c
121133
app_id = azuread_service_principal.sysdig_vm_workload_scanning_sp.client_id
122134
app_owner_organization_id = azuread_service_principal.sysdig_vm_workload_scanning_sp.application_tenant_id
123135
}
136+
137+
aks_discovery_permission_grant = var.aks_discovery_permission_grant
124138
}
125139
})
126140

127141
depends_on = [
142+
module.aks_discovery,
128143
azurerm_role_assignment.sysdig_vm_workload_scanning_func_app_config_role_assignment,
129144
azurerm_role_assignment.sysdig_vm_workload_scanning_file_reader_role_assignment,
130145
azurerm_role_assignment.sysdig_vm_workload_scanning_blob_reader_role_assignment,

‎modules/vm-workload-scanning/variables.tf

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
variable "sysdig_secure_account_id" {
22
type = string
3-
description = "Sysdig Secure Account ID within cloudAuth"
3+
description = "ID of the Sysdig Cloud Account to enable VM Workload Scanning with optional AKS discovery"
44
}
55

66
variable "subscription_id" {
@@ -19,3 +19,14 @@ variable "management_group_ids" {
1919
type = set(string)
2020
default = []
2121
}
22+
23+
variable "aks_discovery_permission_grant" {
24+
description = "(Optional) Set this field to 'true' to grant AKS discovery permissions to the secure-posture service principal."
25+
type = bool
26+
default = false
27+
}
28+
29+
variable "sysdig_cspm_sp_object_id" {
30+
description = "Object ID of the CSPM SP within the client's infra"
31+
type = string
32+
}

0 commit comments

Comments
 (0)