You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: use-cases/org-three-cross-account-setup.md
+9-11
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@
8
8
- AWS Organizational Cloudtrail within the managed account, with Cloudtrail-SNS activation + reporting to another member-account S3 bucket
9
9
- This setup is popular with user that are under AWS Control Tower Setup
10
10
- Existing VPC network setup.
11
-
11
+
12
12
**Sysdig Secure For Cloud [Features](https://docs.sysdig.com/en/docs/installation/sysdig-secure-for-cloud/)**
13
13
14
14
- Threat-Detection
@@ -22,7 +22,7 @@ We're going to use existing use case [/use-cases/org-existing-cloudtrail-ecs-vpc
22
22
23
23
Final scenario would be:
24
24
25
-
- Management Account
25
+
- Management Account
26
26
- Cloudtrail-SNS
27
27
- Log-Archive Account
28
28
- Cloudtrail-S3 bucket
@@ -69,7 +69,7 @@ Please contact us if something requires to be adjusted.
69
69
3. Permissions - SNS
70
70
71
71
- Before running Terraform, we need to give permissions to the role of the `member`-aliased terraform aws provider, to be able to create an SQS queue
72
-
and subscribe it to the provided SNS. Otherwise, Terraform will fail with an error such as
72
+
and subscribe it to the provided SNS. Otherwise, Terraform will fail with an error such as
73
73
> AuthorizationError: User: *** is not authorized to perform: SNS:Subscribe on resource <SNS_ARN>: because no resource-based policy allows the SNS:Subscribe action
74
74
- We'll need to add following permissions to the SNS queue
75
75
```text
@@ -80,16 +80,16 @@ Please contact us if something requires to be adjusted.
- Check [`./modules/infrastructure/cloudtrail/sns_permissions.tf`](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/blob/master/modules/infrastructure/cloudtrail/sns_permissions.tf#L22) for more insight
87
-
87
+
88
88
4. Use `organizational` example snippet with following parameters
89
89
90
90
- General
91
91
- `AWS_REGION` Same region is to be used for both organizational managed account and Sysdig workload member account resources.<br/>
92
-
- **Region MUST match both S3 bucket and SNS Cloudtrail**.
92
+
- **Region MUST match both S3 bucket and SNS Cloudtrail**.
93
93
- `SYSDIG_SECURE_FOR_CLOUD_MEMBER_ACCOUNT_ID` where Sysdig Workload is to be deployed under the pre-existing ECS
94
94
95
95
- Existing Organizational Cloudtrail Setup
@@ -108,7 +108,7 @@ Please contact us if something requires to be adjusted.
108
108
- We cannot prepare this beforehand, as S3 will throw following error if the referenced Role does not exist yet.
109
109
> Invalid principal in policy
110
110
- For cross-account S3 access, we will provision permissions on both management-account role and s3 bucket
111
-
- For Terraform provisioned role in the management account, `<ARN_SYSDIG_S3_ACCESS_ROLE>`,<br/> in form of `arn:aws:iam::<SYSDIG_SECURE_FOR_CLOUD_MEMBER_ACCOUNT_ID>:role/sysdig-sfc-SysdigSecureForCloudRole`, <br/>
111
+
- For Terraform provisioned role in the management account, `<ARN_SYSDIG_S3_ACCESS_ROLE>`,<br/> in form of `arn:aws:iam::<SYSDIG_SECURE_FOR_CLOUD_MEMBER_ACCOUNT_ID>:role/sysdig-sfc-SysdigSecureForCloudRole`, <br/>
112
112
```text
113
113
{
114
114
"Sid": "AllowSysdigReadS3",
@@ -134,7 +134,7 @@ Please contact us if something requires to be adjusted.
134
134
]
135
135
}
136
136
```
137
-
- We shouldn't need to restart ECS Task for these roles to be effective and logs should show no errors at this point.
137
+
- We shouldn't need to restart ECS Task for these roles to be effective and logs should show no errors at this point.
0 commit comments