Skip to content

Commit 2e6a72f

Browse files
hayk99hayk99
authored
fix: Add ECR ECS scanning on apprunner (#97)
1 parent 17b1409 commit 2e6a72f

File tree

20 files changed

+35
-21
lines changed

20 files changed

+35
-21
lines changed

‎examples/organizational/README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -143,8 +143,8 @@ $ terraform apply
143143

144144
| Name | Version |
145145
|------|---------|
146-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.15.1 |
147-
| <a name="provider_aws.member"></a> [aws.member](#provider\_aws.member) | 4.15.1 |
146+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.16.0 |
147+
| <a name="provider_aws.member"></a> [aws.member](#provider\_aws.member) | 4.16.0 |
148148
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.37 |
149149

150150
## Modules

‎examples/single-account-apprunner/main.tf

+2
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,8 @@ module "cloud_connector" {
4343
build_project_name = length(module.codebuild) == 1 ? module.codebuild[0].project_name : "na"
4444

4545
cloudconnector_ecr_image_uri = var.cloudconnector_ecr_image_uri
46+
deploy_image_scanning_ecr = var.deploy_image_scanning_ecr
47+
deploy_image_scanning_ecs = var.deploy_image_scanning_ecs
4648

4749
cloudtrail_sns_arn = local.cloudtrail_sns_arn
4850
tags = var.tags

‎examples/single-account-k8s/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ $ terraform apply
8484

8585
| Name | Version |
8686
|------|---------|
87-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.15.1 |
87+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.16.0 |
8888
| <a name="provider_helm"></a> [helm](#provider\_helm) | 2.5.1 |
8989
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.37 |
9090

‎examples/trigger-events/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ $ terraform apply
4949

5050
| Name | Version |
5151
|------|---------|
52-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.15.1 |
52+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.16.0 |
5353

5454
## Modules
5555

‎modules/infrastructure/cloudtrail/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
| Name | Version |
1414
|------|---------|
15-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.15.1 |
15+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.16.0 |
1616

1717
## Modules
1818

‎modules/infrastructure/cloudtrail_s3-sns-sqs/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ EVENT FILTER/fine-tunning, regarding what we want to send to Sysdig Cloud-Connec
4646

4747
| Name | Version |
4848
|------|---------|
49-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.15.1 |
49+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.16.0 |
5050

5151
## Modules
5252

‎modules/infrastructure/codebuild/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
| Name | Version |
1414
|------|---------|
15-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.15.1 |
15+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.16.0 |
1616

1717
## Modules
1818

‎modules/infrastructure/ecs-vpc/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313

1414
| Name | Version |
1515
|------|---------|
16-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.15.1 |
16+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.16.0 |
1717

1818
## Modules
1919

‎modules/infrastructure/permissions/cloud-connector/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
| Name | Version |
1414
|------|---------|
15-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.15.1 |
15+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.16.0 |
1616

1717
## Modules
1818

‎modules/infrastructure/permissions/cloud-scanning/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
| Name | Version |
1414
|------|---------|
15-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.15.1 |
15+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.16.0 |
1616

1717
## Modules
1818

‎modules/infrastructure/permissions/general/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ General permissions that apply to both cloud-connector and cloud-scanning module
1515

1616
| Name | Version |
1717
|------|---------|
18-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.15.1 |
18+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.16.0 |
1919

2020
## Modules
2121

‎modules/infrastructure/permissions/iam-user/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ Note: Contact us if this authentication system does not match your requirement.
4545

4646
| Name | Version |
4747
|------|---------|
48-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.15.1 |
48+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.16.0 |
4949

5050
## Modules
5151

‎modules/infrastructure/permissions/org-role-ecs/README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,8 @@ The aim of this module is to manage the organizational **managed account** requi
3131

3232
| Name | Version |
3333
|------|---------|
34-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.15.1 |
35-
| <a name="provider_aws.member"></a> [aws.member](#provider\_aws.member) | 4.15.1 |
34+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.16.0 |
35+
| <a name="provider_aws.member"></a> [aws.member](#provider\_aws.member) | 4.16.0 |
3636

3737
## Modules
3838

‎modules/infrastructure/permissions/org-role-eks/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ The aim of this module is to manage the organizational **managed account** requi
2929

3030
| Name | Version |
3131
|------|---------|
32-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.15.1 |
32+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.16.0 |
3333

3434
## Modules
3535

‎modules/infrastructure/resource-group/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313

1414
| Name | Version |
1515
|------|---------|
16-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.15.1 |
16+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.16.0 |
1717

1818
## Modules
1919

‎modules/infrastructure/sqs-sns-subscription/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
| Name | Version |
1414
|------|---------|
15-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.15.1 |
15+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.16.0 |
1616

1717
## Modules
1818

‎modules/infrastructure/ssm/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ and pass it, in a safe way, to all the modules that require it.
1616

1717
| Name | Version |
1818
|------|---------|
19-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.15.1 |
19+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.16.0 |
2020

2121
## Modules
2222

‎modules/services/cloud-bench/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ Deployed on **Sysdig Backend**
2626

2727
| Name | Version |
2828
|------|---------|
29-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.15.1 |
29+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.16.0 |
3030
| <a name="provider_random"></a> [random](#provider\_random) | 3.2.0 |
3131
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.37 |
3232

‎modules/services/cloud-connector-apprunner/apprunner.tf

+13-1
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ data "aws_iam_policy_document" "cloud_connector" {
8181
}
8282

8383
dynamic "statement" {
84-
for_each = var.deploy_image_scanning_ecr || var.deploy_image_scanning_ecs ? [1] : []
84+
for_each = var.deploy_image_scanning_ecr ? [1] : []
8585
content {
8686
sid = "AllowECR"
8787
effect = "Allow"
@@ -108,4 +108,16 @@ data "aws_iam_policy_document" "cloud_connector" {
108108
resources = [var.build_project_arn]
109109
}
110110
}
111+
112+
dynamic "statement" {
113+
for_each = var.deploy_image_scanning_ecs ? [1] : []
114+
content {
115+
sid = "AllowECS"
116+
effect = "Allow"
117+
actions = [
118+
"ecs:DescribeTaskDefinition"
119+
]
120+
resources = ["*"]
121+
}
122+
}
111123
}

‎modules/services/cloud-connector-ecs/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ A task deployed on an **ECS deployment** will detect events in your infrastructu
1515

1616
| Name | Version |
1717
|------|---------|
18-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.15.1 |
18+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.16.0 |
1919
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.37 |
2020

2121
## Modules

0 commit comments

Comments
 (0)