single-existing-cloudtrail.md

SingleAccount - Existing Cloudtrail

Use-Case explanation

Client Setup

• single-account setup
• pre-existing resources
  • cloudtrail
  • k8s cluster we want to use to deploy Sysdig for Cloud workload
  • ecs cluster/vpc/subnet we want to use to deploy Sysdig for Cloud workload

Sysdig Secure For Cloud Features

• Threat Detection
  • all accounts of the organization (management account included)
• Image Scanning (WIP?)
  • ECR pushed images
  • ECS running images
• CSPM/Compliance (WIP?)
• CIEM (WIP?)

Suggested setup

For this use-case we're going to use the ./examples/single-account-ecs setup. In order for this setup to work, all resources must be in the same AWS account and region. Before proceeding, please read the example README and check whether you comply with requirements.

Please contact us if something requires to be adjusted.

Step by Step Example Guide

Use single-account example with cloudtrail_sns_arn parameter

Terraform Manifest Snippet

terraform {
  required_providers {
    sysdig = {
      source  = "sysdiglabs/sysdig"
    }
  }
}

provider "sysdig" {
  sysdig_secure_url         = "<SYSDIG_SECURE_URL>"
  sysdig_secure_api_token   = "<SYSDIG_SECURE_API_TOKEN>"
}

provider "aws" {
  region = "<AWS_REGION>"
}

module "sysdig-sfc" {
  source = "sysdiglabs/secure-for-cloud/aws//examples/single-account-ecs"
  name   = "sysdig-sfc"

  cloudtrail_sns_arn  = "<CLOUDRAIL_SNS_TOPIC_ARN>"
}