Skip to content

Commit 36762e8

Browse files
authored
fix: Solve pre-commit issues (#104)
1 parent 8602356 commit 36762e8

File tree

1 file changed

+9
-11
lines changed

1 file changed

+9
-11
lines changed

use-cases/org-three-cross-account-setup.md

+9-11
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
- AWS Organizational Cloudtrail within the managed account, with Cloudtrail-SNS activation + reporting to another member-account S3 bucket
99
- This setup is popular with user that are under AWS Control Tower Setup
1010
- Existing VPC network setup.
11-
11+
1212
**Sysdig Secure For Cloud [Features](https://docs.sysdig.com/en/docs/installation/sysdig-secure-for-cloud/)**
1313

1414
- Threat-Detection
@@ -22,7 +22,7 @@ We're going to use existing use case [/use-cases/org-existing-cloudtrail-ecs-vpc
2222

2323
Final scenario would be:
2424

25-
- Management Account
25+
- Management Account
2626
- Cloudtrail-SNS
2727
- Log-Archive Account
2828
- Cloudtrail-S3 bucket
@@ -69,7 +69,7 @@ Please contact us if something requires to be adjusted.
6969
3. Permissions - SNS
7070

7171
- Before running Terraform, we need to give permissions to the role of the `member`-aliased terraform aws provider, to be able to create an SQS queue
72-
and subscribe it to the provided SNS. Otherwise, Terraform will fail with an error such as
72+
and subscribe it to the provided SNS. Otherwise, Terraform will fail with an error such as
7373
> AuthorizationError: User: *** is not authorized to perform: SNS:Subscribe on resource <SNS_ARN>: because no resource-based policy allows the SNS:Subscribe action
7474
- We'll need to add following permissions to the SNS queue
7575
```text
@@ -80,16 +80,16 @@ Please contact us if something requires to be adjusted.
8080
"AWS": "<TERRAFORM_AWS_PROVIDER_MEMBER_ACCOUNT_ROLE_ARN>"
8181
},
8282
"Action": "SNS:Subscribe",
83-
"Resource": "<CLOUDTRAIL_SNS_ARN>"
83+
"Resource": "<CLOUDTRAIL_SNS_ARN>"
8484
}
8585
```
8686
- Check [`./modules/infrastructure/cloudtrail/sns_permissions.tf`](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/blob/master/modules/infrastructure/cloudtrail/sns_permissions.tf#L22) for more insight
87-
87+
8888
4. Use `organizational` example snippet with following parameters
8989
9090
- General
9191
- `AWS_REGION` Same region is to be used for both organizational managed account and Sysdig workload member account resources.<br/>
92-
- **Region MUST match both S3 bucket and SNS Cloudtrail**.
92+
- **Region MUST match both S3 bucket and SNS Cloudtrail**.
9393
- `SYSDIG_SECURE_FOR_CLOUD_MEMBER_ACCOUNT_ID` where Sysdig Workload is to be deployed under the pre-existing ECS
9494
9595
- Existing Organizational Cloudtrail Setup
@@ -108,7 +108,7 @@ Please contact us if something requires to be adjusted.
108108
- We cannot prepare this beforehand, as S3 will throw following error if the referenced Role does not exist yet.
109109
> Invalid principal in policy
110110
- For cross-account S3 access, we will provision permissions on both management-account role and s3 bucket
111-
- For Terraform provisioned role in the management account, `<ARN_SYSDIG_S3_ACCESS_ROLE>`,<br/> in form of `arn:aws:iam::<SYSDIG_SECURE_FOR_CLOUD_MEMBER_ACCOUNT_ID>:role/sysdig-sfc-SysdigSecureForCloudRole`, <br/>
111+
- For Terraform provisioned role in the management account, `<ARN_SYSDIG_S3_ACCESS_ROLE>`,<br/> in form of `arn:aws:iam::<SYSDIG_SECURE_FOR_CLOUD_MEMBER_ACCOUNT_ID>:role/sysdig-sfc-SysdigSecureForCloudRole`, <br/>
112112
```text
113113
{
114114
"Sid": "AllowSysdigReadS3",
@@ -134,7 +134,7 @@ Please contact us if something requires to be adjusted.
134134
]
135135
}
136136
```
137-
- We shouldn't need to restart ECS Task for these roles to be effective and logs should show no errors at this point.
137+
- We shouldn't need to restart ECS Task for these roles to be effective and logs should show no errors at this point.
138138
139139
### Permission Setup Guidance
140140
@@ -186,10 +186,8 @@ module "sysdig-sfc" {
186186
187187
cloudtrail_sns_arn = "<CLOUDTRAIL_SNS_ARN>"
188188
cloudtrail_s3_arn = "<CLOUDTRAIL_S3_ARN>"
189-
189+
190190
ecs_cluster_name = "<ECS_CLUSTER_NAME>"
191191
ecs_vpc_id = "<ECS_VPC_ID>"
192192
ecs_vpc_subnets_private_ids = ["<ECS_VPC_SUBNET_PRIVATE_ID_1>","<ECS_VPC_SUBNET_PRIVATE_ID_2>"]}
193193
```
194-
195-

0 commit comments

Comments
 (0)