Skip to content

Commit a16d6b1

Browse files
miketnthayk99iru
authored
feat: new beta scanning ecr (#131)
⚠️ currently for testing purpose only. not supported yet available examples - ✅ single and org ecs - ✅ single k8s, apprunner --- to be tested with snippet (for org) ``` terraform { required_providers { sysdig = { source = "sysdiglabs/sysdig" } } } provider "sysdig" { sysdig_secure_url = var.url sysdig_secure_api_token = var.api_token } provider "aws" { region = var.region } provider "aws" { alias = "member" region = var.region assume_role { role_arn = var.assume_role_arn } } module "secure-for-cloud_example_organizational" { providers = { aws.member = aws.member } source = "github.com/sysdiglabs/terraform-aws-cloudvision//examples/organizational?ref=new-beta-scanning-ecr" name = var.name deploy_beta_image_scanning_ecr = true sysdig_secure_for_cloud_member_account_id = var.member_account_id } --- before merging - ✅ [revert the tag before merge and rollback to `quay.io/sysdig/cloud-connector:latest`](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/compare/new-beta-scanning-ecr?expand=1#diff-ce830ac4b16a540ab381428ae0ff9d043ceae7063638ff36a93ef3daf2b7a82eR128) - this has been partially released already ``` <!-- Thank you for your contribution! ## General recommendations Check contribution guidelines at https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/blob/master/CONTRIBUTE.md#contribution-checklist For a cleaner PR make sure you follow these recommendations: - Review modified files and delete small changes that were not intended and maybe slip the commit. - Use Pull Request Drafts for visibility on Work-In-Progress branches and use them on daily mob/pairing for team review - Unless an external revision is desired, in order to validate or gather some feedback, you are free to merge as long as **validation checks are green-lighted** ## Checklist - [ ] If `test/fixtures/*/main.tf` files are modified. I have updated: - [ ] the snippets in the README.md file under root folder. - [ ] the snippets in the README.md file for the corresponding example. - [ ] If `examples` folder are modified. I have updated: - [ ] README.md file with pertinent changes. - [ ] `test/fixtures/*/main.tf` in case the snippet needs modifications. - [ ] If any architectural change has been made, I have updated the diagrams. --> Co-authored-by: Hayk Kocharyan <[email protected]> Co-authored-by: iru <[email protected]>
1 parent 36840d3 commit a16d6b1

File tree

22 files changed

+97
-34
lines changed

22 files changed

+97
-34
lines changed

‎examples/organizational/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,7 @@ $ terraform apply
187187
| <a name="input_connector_ecs_task_role_name"></a> [connector\_ecs\_task\_role\_name](#input\_connector\_ecs\_task\_role\_name) | Name for the ecs task role. This is only required to resolve cyclic dependency with organizational approach | `string` | `"organizational-ECSTaskRole"` | no |
188188
| <a name="input_deploy_benchmark"></a> [deploy\_benchmark](#input\_deploy\_benchmark) | Whether to deploy or not the cloud benchmarking | `bool` | `true` | no |
189189
| <a name="input_deploy_benchmark_organizational"></a> [deploy\_benchmark\_organizational](#input\_deploy\_benchmark\_organizational) | true/false whether benchmark module should be deployed on organizational or single-account mode (1 role per org accounts if true, 1 role in default aws provider account if false)</li></ul> | `bool` | `true` | no |
190+
| <a name="input_deploy_beta_image_scanning_ecr"></a> [deploy\_beta\_image\_scanning\_ecr](#input\_deploy\_beta\_image\_scanning\_ecr) | true/false whether to deploy the beta image scanning on ECR pushed images (experimental and unsupported) | `bool` | `false` | no |
190191
| <a name="input_deploy_image_scanning_ecr"></a> [deploy\_image\_scanning\_ecr](#input\_deploy\_image\_scanning\_ecr) | true/false whether to deploy the image scanning on ECR pushed images | `bool` | `false` | no |
191192
| <a name="input_deploy_image_scanning_ecs"></a> [deploy\_image\_scanning\_ecs](#input\_deploy\_image\_scanning\_ecs) | true/false whether to deploy the image scanning on ECS running images | `bool` | `false` | no |
192193
| <a name="input_ecs_cluster_name"></a> [ecs\_cluster\_name](#input\_ecs\_cluster\_name) | Name of a pre-existing ECS (elastic container service) cluster. If defaulted, a new ECS cluster/VPC/Security Group will be created. If specified all three parameters `ecs_cluster_name`, `ecs_vpc_id` and `ecs_vpc_subnets_private_ids` are required. ECS location will/must be within the `sysdig_secure_for_cloud_member_account_id` parameter accountID | `string` | `"create"` | no |

‎examples/organizational/main.tf

+6-4
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@
33
# with default provider
44
#-------------------------------------
55
locals {
6-
deploy_same_account = data.aws_caller_identity.me.account_id == var.sysdig_secure_for_cloud_member_account_id
6+
deploy_same_account = data.aws_caller_identity.me.account_id == var.sysdig_secure_for_cloud_member_account_id
7+
deploy_old_image_scanning_with_codebuild = (var.deploy_image_scanning_ecr && !var.deploy_beta_image_scanning_ecr) || var.deploy_image_scanning_ecs
78
}
89

910
module "resource_group" {
@@ -40,7 +41,7 @@ module "ssm" {
4041
# cloud-connector
4142
#-------------------------------------
4243
module "codebuild" {
43-
count = var.deploy_image_scanning_ecr || var.deploy_image_scanning_ecs ? 1 : 0
44+
count = local.deploy_old_image_scanning_with_codebuild ? 1 : 0
4445

4546
providers = {
4647
aws = aws.member
@@ -64,8 +65,9 @@ module "cloud_connector" {
6465

6566
secure_api_token_secret_name = module.ssm.secure_api_token_secret_name
6667

67-
deploy_image_scanning_ecr = var.deploy_image_scanning_ecr
68-
deploy_image_scanning_ecs = var.deploy_image_scanning_ecs
68+
deploy_beta_image_scanning_ecr = var.deploy_beta_image_scanning_ecr
69+
deploy_image_scanning_ecr = var.deploy_image_scanning_ecr
70+
deploy_image_scanning_ecs = var.deploy_image_scanning_ecs
6971

7072
#
7173
# note;

‎examples/organizational/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,12 @@ variable "existing_cloudtrail_config" {
8282
# scanning configuration
8383
#
8484

85+
variable "deploy_beta_image_scanning_ecr" {
86+
type = bool
87+
description = "true/false whether to deploy the beta image scanning on ECR pushed images (experimental and unsupported)"
88+
default = false
89+
}
90+
8591
variable "deploy_image_scanning_ecr" {
8692
type = bool
8793
description = "true/false whether to deploy the image scanning on ECR pushed images"

‎examples/single-account-apprunner/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,7 @@ $ terraform apply
101101
| <a name="input_cloudtrail_kms_enable"></a> [cloudtrail\_kms\_enable](#input\_cloudtrail\_kms\_enable) | true/false whether cloudtrail delivered events to S3 should persist encrypted | `bool` | `true` | no |
102102
| <a name="input_cloudtrail_sns_arn"></a> [cloudtrail\_sns\_arn](#input\_cloudtrail\_sns\_arn) | ARN of a pre-existing cloudtrail\_sns. If defaulted, a new cloudtrail will be created. ARN of a pre-existing cloudtrail\_sns. If defaulted, a new cloudtrail will be created. If specified, sysdig deployment account and region must match with the specified SNS | `string` | `"create"` | no |
103103
| <a name="input_deploy_benchmark"></a> [deploy\_benchmark](#input\_deploy\_benchmark) | Whether to deploy or not the cloud benchmarking | `bool` | `true` | no |
104+
| <a name="input_deploy_beta_image_scanning_ecr"></a> [deploy\_beta\_image\_scanning\_ecr](#input\_deploy\_beta\_image\_scanning\_ecr) | true/false whether to deploy the beta image scanning on ECR pushed images (experimental and unsupported) | `bool` | `false` | no |
104105
| <a name="input_deploy_image_scanning_ecr"></a> [deploy\_image\_scanning\_ecr](#input\_deploy\_image\_scanning\_ecr) | true/false whether to deploy the image scanning on ECR pushed images | `bool` | `false` | no |
105106
| <a name="input_deploy_image_scanning_ecs"></a> [deploy\_image\_scanning\_ecs](#input\_deploy\_image\_scanning\_ecs) | true/false whether to deploy the image scanning on ECS running images | `bool` | `false` | no |
106107
| <a name="input_name"></a> [name](#input\_name) | Name to be assigned to all child resources. A suffix may be added internally when required. Use default value unless you need to install multiple instances | `string` | `"sfc"` | no |

‎examples/single-account-apprunner/main.tf

+5-2
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,11 @@ module "cloud_connector" {
4343
build_project_name = length(module.codebuild) == 1 ? module.codebuild[0].project_name : "na"
4444

4545
cloudconnector_ecr_image_uri = var.cloudconnector_ecr_image_uri
46-
deploy_image_scanning_ecr = var.deploy_image_scanning_ecr
47-
deploy_image_scanning_ecs = var.deploy_image_scanning_ecs
46+
47+
48+
deploy_beta_image_scanning_ecr = var.deploy_beta_image_scanning_ecr
49+
deploy_image_scanning_ecr = var.deploy_image_scanning_ecr
50+
deploy_image_scanning_ecs = var.deploy_image_scanning_ecs
4851

4952
cloudtrail_sns_arn = local.cloudtrail_sns_arn
5053
tags = var.tags

‎examples/single-account-apprunner/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,12 @@ variable "cloudtrail_kms_enable" {
3030
# scanning configuration
3131
#
3232

33+
variable "deploy_beta_image_scanning_ecr" {
34+
type = bool
35+
description = "true/false whether to deploy the beta image scanning on ECR pushed images (experimental and unsupported)"
36+
default = false
37+
}
38+
3339
variable "deploy_image_scanning_ecr" {
3440
type = bool
3541
description = "true/false whether to deploy the image scanning on ECR pushed images"

‎examples/single-account-ecs/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,7 @@ $ terraform apply
102102
| <a name="input_cloudtrail_s3_bucket_expiration_days"></a> [cloudtrail\_s3\_bucket\_expiration\_days](#input\_cloudtrail\_s3\_bucket\_expiration\_days) | Number of days that the logs will persist in the bucket | `number` | `5` | no |
103103
| <a name="input_cloudtrail_sns_arn"></a> [cloudtrail\_sns\_arn](#input\_cloudtrail\_sns\_arn) | ARN of a pre-existing cloudtrail\_sns. If defaulted, a new cloudtrail will be created. If specified, sysdig deployment account and region must match with the specified SNS | `string` | `"create"` | no |
104104
| <a name="input_deploy_benchmark"></a> [deploy\_benchmark](#input\_deploy\_benchmark) | Whether to deploy or not the cloud benchmarking | `bool` | `true` | no |
105+
| <a name="input_deploy_beta_image_scanning_ecr"></a> [deploy\_beta\_image\_scanning\_ecr](#input\_deploy\_beta\_image\_scanning\_ecr) | true/false whether to deploy the beta image scanning on ECR pushed images (experimental and unsupported) | `bool` | `false` | no |
105106
| <a name="input_deploy_image_scanning_ecr"></a> [deploy\_image\_scanning\_ecr](#input\_deploy\_image\_scanning\_ecr) | true/false whether to deploy the image scanning on ECR pushed images | `bool` | `false` | no |
106107
| <a name="input_deploy_image_scanning_ecs"></a> [deploy\_image\_scanning\_ecs](#input\_deploy\_image\_scanning\_ecs) | true/false whether to deploy the image scanning on ECS running images | `bool` | `false` | no |
107108
| <a name="input_ecs_cluster_name"></a> [ecs\_cluster\_name](#input\_ecs\_cluster\_name) | Name of a pre-existing ECS (elastic container service) cluster. If defaulted, a new ECS cluster/VPC/Security Group will be created. If specified all three parameters `ecs_cluster_name`, `ecs_vpc_id` and `ecs_vpc_subnets_private_ids` are required. | `string` | `"create"` | no |

‎examples/single-account-ecs/main.tf

+3-2
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,9 @@ module "cloud_connector" {
4343

4444
secure_api_token_secret_name = module.ssm.secure_api_token_secret_name
4545

46-
deploy_image_scanning_ecr = var.deploy_image_scanning_ecr
47-
deploy_image_scanning_ecs = var.deploy_image_scanning_ecs
46+
deploy_beta_image_scanning_ecr = var.deploy_beta_image_scanning_ecr
47+
deploy_image_scanning_ecr = var.deploy_image_scanning_ecr
48+
deploy_image_scanning_ecs = var.deploy_image_scanning_ecs
4849

4950
is_organizational = false
5051

‎examples/single-account-ecs/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,12 @@ variable "ecs_task_memory" {
7777
# scanning configuration
7878
#
7979

80+
variable "deploy_beta_image_scanning_ecr" {
81+
type = bool
82+
description = "true/false whether to deploy the beta image scanning on ECR pushed images (experimental and unsupported)"
83+
default = false
84+
}
85+
8086
variable "deploy_image_scanning_ecr" {
8187
type = bool
8288
description = "true/false whether to deploy the image scanning on ECR pushed images"

‎examples/single-account-k8s/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,7 @@ $ terraform apply
120120
| <a name="input_cloudtrail_sns_arn"></a> [cloudtrail\_sns\_arn](#input\_cloudtrail\_sns\_arn) | ARN of a pre-existing cloudtrail\_sns. If defaulted, a new cloudtrail will be created. If specified, deployment region must match Cloudtrail S3 bucket region | `string` | `"create"` | no |
121121
| <a name="input_deploy_aws_iam_user"></a> [deploy\_aws\_iam\_user](#input\_deploy\_aws\_iam\_user) | true/false whether to deploy an iam user. if set to false, check [required role permissions](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/blob/master/resources/policy-single-account-k8s-aws.json) | `bool` | `true` | no |
122122
| <a name="input_deploy_benchmark"></a> [deploy\_benchmark](#input\_deploy\_benchmark) | Whether to deploy or not the cloud benchmarking | `bool` | `true` | no |
123+
| <a name="input_deploy_beta_image_scanning_ecr"></a> [deploy\_beta\_image\_scanning\_ecr](#input\_deploy\_beta\_image\_scanning\_ecr) | true/false whether to deploy the beta image scanning on ECR pushed images (experimental and unsupported) | `bool` | `false` | no |
123124
| <a name="input_deploy_image_scanning_ecr"></a> [deploy\_image\_scanning\_ecr](#input\_deploy\_image\_scanning\_ecr) | true/false whether to deploy the image scanning on ECR pushed images | `bool` | `false` | no |
124125
| <a name="input_deploy_image_scanning_ecs"></a> [deploy\_image\_scanning\_ecs](#input\_deploy\_image\_scanning\_ecs) | true/false whether to deploy the image scanning on ECS running images | `bool` | `false` | no |
125126
| <a name="input_name"></a> [name](#input\_name) | Name to be assigned to all child resources. A suffix may be added internally when required. Use default value unless you need to install multiple instances | `string` | `"sfc"` | no |

‎examples/single-account-k8s/cloud-connector.tf

+11-7
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
locals {
2-
deploy_image_scanning = var.deploy_image_scanning_ecr || var.deploy_image_scanning_ecs
2+
deploy_image_scanning = var.deploy_image_scanning_ecr || var.deploy_image_scanning_ecs || var.deploy_beta_image_scanning_ecr
33
}
44

55
#-------------------------------------
@@ -14,7 +14,7 @@ module "cloud_connector_sqs" {
1414
}
1515

1616
module "codebuild" {
17-
count = local.deploy_image_scanning ? 1 : 0
17+
count = var.deploy_image_scanning_ecr || var.deploy_image_scanning_ecs ? 1 : 0
1818
source = "../../modules/infrastructure/codebuild"
1919

2020
name = var.name
@@ -82,11 +82,15 @@ resource "helm_release" "cloud_connector" {
8282
}
8383
]
8484
scanners = local.deploy_image_scanning ? [
85-
merge(var.deploy_image_scanning_ecr ? {
86-
aws-ecr = {
87-
codeBuildProject = module.codebuild[0].project_name
88-
secureAPITokenSecretName = module.ssm.secure_api_token_secret_name
89-
}
85+
merge(
86+
var.deploy_beta_image_scanning_ecr ? {
87+
aws-ecr-inline = {}
88+
} : {},
89+
var.deploy_image_scanning_ecr ? {
90+
aws-ecr = {
91+
codeBuildProject = module.codebuild[0].project_name
92+
secureAPITokenSecretName = module.ssm.secure_api_token_secret_name
93+
}
9094
} : {},
9195
var.deploy_image_scanning_ecs ? {
9296
aws-ecs = {

‎examples/single-account-k8s/credentials.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ module "iam_user" {
33
count = var.deploy_aws_iam_user ? 1 : 0
44
name = var.name
55

6-
deploy_image_scanning = local.deploy_image_scanning
6+
deploy_image_scanning = var.deploy_image_scanning_ecr || var.deploy_image_scanning_ecs
77

88
ssm_secure_api_token_arn = module.ssm.secure_api_token_secret_arn
99
cloudtrail_s3_bucket_arn = length(module.cloudtrail) > 0 ? module.cloudtrail[0].s3_bucket_arn : "*"

‎examples/single-account-k8s/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,12 @@ variable "tags" {
4242
# scanning configuration
4343
#
4444

45+
variable "deploy_beta_image_scanning_ecr" {
46+
type = bool
47+
description = "true/false whether to deploy the beta image scanning on ECR pushed images (experimental and unsupported)"
48+
default = false
49+
}
50+
4551
variable "deploy_image_scanning_ecr" {
4652
type = bool
4753
description = "true/false whether to deploy the image scanning on ECR pushed images"

‎modules/services/cloud-connector-apprunner/apprunner.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ data "aws_iam_policy_document" "cloud_connector" {
8181
}
8282

8383
dynamic "statement" {
84-
for_each = var.deploy_image_scanning_ecr ? [1] : []
84+
for_each = var.deploy_image_scanning_ecr || var.deploy_beta_image_scanning_ecr ? [1] : []
8585
content {
8686
sid = "AllowECR"
8787
effect = "Allow"
@@ -110,7 +110,7 @@ data "aws_iam_policy_document" "cloud_connector" {
110110
}
111111

112112
dynamic "statement" {
113-
for_each = var.deploy_image_scanning_ecs ? [1] : []
113+
for_each = var.deploy_image_scanning_ecr || var.deploy_beta_image_scanning_ecr ? [1] : []
114114
content {
115115
sid = "AllowECS"
116116
effect = "Allow"

‎modules/services/cloud-connector-apprunner/cloudconnector-config.tf

+9-5
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,15 @@ locals {
1414
},
1515
{
1616
scanners = local.deploy_image_scanning ? [
17-
merge(var.deploy_image_scanning_ecr ? {
18-
aws-ecr = {
19-
codeBuildProject = var.build_project_name
20-
secureAPITokenSecretName = var.secure_api_token_secret_name
21-
}
17+
merge(
18+
var.deploy_beta_image_scanning_ecr ? {
19+
aws-ecr-inline = {}
20+
} : {},
21+
var.deploy_image_scanning_ecr ? {
22+
aws-ecr = {
23+
codeBuildProject = var.build_project_name
24+
secureAPITokenSecretName = var.secure_api_token_secret_name
25+
}
2226
} : {},
2327
var.deploy_image_scanning_ecs ? {
2428
aws-ecs = {

‎modules/services/cloud-connector-apprunner/main.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
locals {
22
verify_ssl = var.verify_ssl == "auto" ? length(regexall("https://.*?\\.sysdig(cloud)?.com/?", data.sysdig_secure_connection.current.secure_url)) == 1 : var.verify_ssl == "true"
3-
deploy_image_scanning = var.deploy_image_scanning_ecs || var.deploy_image_scanning_ecr
3+
deploy_image_scanning = var.deploy_image_scanning_ecs || var.deploy_image_scanning_ecr || var.deploy_beta_image_scanning_ecr
44
}

‎modules/services/cloud-connector-apprunner/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,12 @@ variable "cloudtrail_sns_arn" {
1818
# scanning configuration
1919
#
2020

21+
variable "deploy_beta_image_scanning_ecr" {
22+
type = bool
23+
description = "true/false whether to deploy the beta image scanning on ECR pushed images (experimental and unsupported)"
24+
default = false
25+
}
26+
2127
variable "deploy_image_scanning_ecr" {
2228
type = bool
2329
description = "true/false whether to deploy the image scanning on ECR pushed images"

‎modules/services/cloud-connector-ecs/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ A task deployed on an **ECS deployment** will detect events in your infrastructu
7171
| <a name="input_secure_api_token_secret_name"></a> [secure\_api\_token\_secret\_name](#input\_secure\_api\_token\_secret\_name) | Sysdig Secure API token SSM parameter name | `string` | n/a | yes |
7272
| <a name="input_cloudwatch_log_retention"></a> [cloudwatch\_log\_retention](#input\_cloudwatch\_log\_retention) | Days to keep logs for CloudConnector | `number` | `5` | no |
7373
| <a name="input_connector_ecs_task_role_name"></a> [connector\_ecs\_task\_role\_name](#input\_connector\_ecs\_task\_role\_name) | Default ecs cloudconnector task role name | `string` | `"ECSTaskRole"` | no |
74+
| <a name="input_deploy_beta_image_scanning_ecr"></a> [deploy\_beta\_image\_scanning\_ecr](#input\_deploy\_beta\_image\_scanning\_ecr) | true/false whether to deploy the beta image scanning on ECR pushed images (experimental and unsupported) | `bool` | `false` | no |
7475
| <a name="input_deploy_image_scanning_ecr"></a> [deploy\_image\_scanning\_ecr](#input\_deploy\_image\_scanning\_ecr) | true/false whether to deploy the image scanning on ECR pushed images | `bool` | `false` | no |
7576
| <a name="input_deploy_image_scanning_ecs"></a> [deploy\_image\_scanning\_ecs](#input\_deploy\_image\_scanning\_ecs) | true/false whether to deploy the image scanning on ECS running images | `bool` | `false` | no |
7677
| <a name="input_ecs_task_cpu"></a> [ecs\_task\_cpu](#input\_ecs\_task\_cpu) | Amount of CPU (in CPU units) to reserve for cloud-connector task | `string` | `"256"` | no |

‎modules/services/cloud-connector-ecs/cloudconnector-config.tf

+12-5
Original file line numberDiff line numberDiff line change
@@ -28,16 +28,23 @@ locals {
2828
},
2929
{
3030
scanners = local.deploy_image_scanning ? [
31-
merge(var.deploy_image_scanning_ecr ? {
32-
aws-ecr = merge({
33-
codeBuildProject = var.build_project_name
34-
secureAPITokenSecretName = var.secure_api_token_secret_name
35-
},
31+
merge(var.deploy_beta_image_scanning_ecr ? {
32+
aws-ecr-inline = merge({},
3633
var.is_organizational ? {
3734
masterOrganizationRole = var.organizational_config.sysdig_secure_for_cloud_role_arn
3835
organizationalRolePerAccount = var.organizational_config.organizational_role_per_account
3936
} : {})
4037
} : {},
38+
local.deploy_image_scanning_with_codebuild ? {
39+
aws-ecr = merge({
40+
codeBuildProject = var.build_project_name
41+
secureAPITokenSecretName = var.secure_api_token_secret_name
42+
},
43+
var.is_organizational ? {
44+
masterOrganizationRole = var.organizational_config.sysdig_secure_for_cloud_role_arn
45+
organizationalRolePerAccount = var.organizational_config.organizational_role_per_account
46+
} : {})
47+
} : {},
4148
var.deploy_image_scanning_ecs ? {
4249
aws-ecs = merge({
4350
codeBuildProject = var.build_project_name

‎modules/services/cloud-connector-ecs/locals.tf

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
locals {
2-
deploy_image_scanning = var.deploy_image_scanning_ecs || var.deploy_image_scanning_ecr
2+
deploy_image_scanning = var.deploy_image_scanning_ecs || var.deploy_image_scanning_ecr || var.deploy_beta_image_scanning_ecr
3+
deploy_image_scanning_with_codebuild = (var.deploy_image_scanning_ecs || var.deploy_image_scanning_ecr) && !var.deploy_beta_image_scanning_ecr
34
}

‎modules/services/cloud-connector-ecs/permissions.tf

+4-4
Original file line numberDiff line numberDiff line change
@@ -98,13 +98,13 @@ data "aws_iam_policy_document" "iam_role_task_assume_role" {
9898
# scan images
9999
#
100100
resource "aws_iam_role_policy" "trigger_scan" {
101-
count = local.deploy_image_scanning ? 1 : 0
101+
count = local.deploy_image_scanning_with_codebuild ? 1 : 0
102102
name = "${var.name}-TriggerScan"
103103
role = local.ecs_task_role_id
104104
policy = data.aws_iam_policy_document.trigger_scan[0].json
105105
}
106106
data "aws_iam_policy_document" "trigger_scan" {
107-
count = local.deploy_image_scanning ? 1 : 0
107+
count = local.deploy_image_scanning_with_codebuild ? 1 : 0
108108
statement {
109109
effect = "Allow"
110110
actions = [
@@ -135,14 +135,14 @@ data "aws_iam_policy_document" "task_definition_reader" {
135135

136136
# image scanning - ecr
137137
resource "aws_iam_role_policy" "ecr_reader" {
138-
count = var.deploy_image_scanning_ecr ? 1 : 0
138+
count = local.deploy_image_scanning_with_codebuild ? 1 : 0
139139
name = "ECRReader"
140140
role = local.ecs_task_role_id
141141
policy = data.aws_iam_policy_document.ecr_reader[0].json
142142
}
143143

144144
data "aws_iam_policy_document" "ecr_reader" {
145-
count = var.deploy_image_scanning_ecr ? 1 : 0
145+
count = local.deploy_image_scanning_with_codebuild ? 1 : 0
146146
statement {
147147
effect = "Allow"
148148
actions = [

0 commit comments

Comments
 (0)