Skip to content

Commit a1b0b26

Browse files
iruNéstor Salceda
iru
and
Néstor Salceda
authored
feat: add single-account-k8s (threat + scan) (#23)
* feat: Add a sample to deploy on K8s * feat: Add scanning deployment * refactor: Extract a CloudTrail Subscription SQS module This module will handle the work and permissions needed to wire cloudtrail with a SQS queue * refactor: Wire using cloudtrail-subscription-sqs * chore: remove master references * chore: * chore: cleanup * chore: * chore: doc * chore: doc * chore: replace cloudtrail-sqs on service modules * chore(sec): create aws user for helm charts usage * chore(sec): reorganize perm * chore(doc): add README and rename * chore: inherit tags on codebuild * chore(sec): wip. add missing permissions for scanning * fix(scanning): add secureAPITokenSecret besides sysdig.secureAPIToken * chore: increase kitchen test timeout * doc. * chore: add moaar time to deploy :/ maybe we should think of a retrial system with backoff if pending ecs tasks are pending * chore: moaar cowbell - 10' * chore(ci): test cleanup for tf-destroy * Update main.tf * fix: mixed-up modules * chore(ci): restore 4' sleep Co-authored-by: Néstor Salceda <[email protected]>
1 parent 4799866 commit a1b0b26

File tree

38 files changed

+803
-92
lines changed

38 files changed

+803
-92
lines changed

‎.github/workflows/ci-test-cleanup.yaml

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: CI - Test Cleanup
2+
on:
3+
workflow_dispatch
4+
5+
jobs:
6+
test_cleanup:
7+
name: Test Cleanup
8+
runs-on: ubuntu-latest
9+
env:
10+
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
11+
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
12+
AWS_REGION: ${{ secrets.AWS_REGION }}
13+
TF_VAR_sysdig_secure_endpoint: https://secure.sysdig.com
14+
TF_VAR_sysdig_secure_api_token: ${{secrets.KUBELAB_SECURE_API_TOKEN}}
15+
16+
steps:
17+
- name: Checkout
18+
uses: actions/checkout@v2
19+
20+
- uses: ruby/setup-ruby@v1
21+
with:
22+
ruby-version: 2.7
23+
bundler-cache: true
24+
25+
- name: Destroy resources
26+
if: ${{ failure() }}
27+
run: bundle exec kitchen destroy

‎README.md

+8
Original file line numberDiff line numberDiff line change
@@ -20,11 +20,19 @@ For other Cloud providers check: [GCP](https://github.com/sysdiglabs/terraform-g
2020
There are several ways to deploy this in you AWS infrastructure:
2121

2222
### Single-Account
23+
2324
Sysdig workload will be deployed in the same account where user's resources will be watched.<br/>
2425
More info in [`./examples/single-account`](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/examples/single-account)
2526

2627
![single-account diagram](https://raw.githubusercontent.com/sysdiglabs/terraform-aws-secure-for-cloud/7d142829a701ce78f13691a4af4be373625e7ee2/examples/single-account/diagram-single.png)
2728

29+
30+
### Single-Account with a pre-existing Kubernetes Cluster
31+
32+
If you already own a Kubernetes Cluster on AWS, you can use it to deploy Sysdig Secure for Cloud, instead of default ECS cluster.
33+
34+
More info in [`./examples/single-account-k8s`](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/tree/master/examples/single-account-k8s)
35+
2836
### Organizational
2937

3038
Using an organizational configuration Cloudtrail.

‎examples/organizational/README.md

+3-1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22

33
Deploy Sysdig Secure for Cloud sharing the Trail within an organization.
44

5+
_Note: At this time, only the Threat Detection module is supported for organizational accounts_
6+
57
* In the **management account**
68
* An Organizational Cloutrail will be deployed (with required S3,SNS)
79
* An additional role `SysdigSecureForCloudRole` will be created
@@ -87,7 +89,7 @@ Notice that:
8789
| <a name="module_ecs_fargate_cluster"></a> [ecs\_fargate\_cluster](#module\_ecs\_fargate\_cluster) | ../../modules/infrastructure/ecs-fargate-cluster | |
8890
| <a name="module_resource_group"></a> [resource\_group](#module\_resource\_group) | ../../modules/infrastructure/resource-group | |
8991
| <a name="module_resource_group_secure_for_cloud_member"></a> [resource\_group\_secure\_for\_cloud\_member](#module\_resource\_group\_secure\_for\_cloud\_member) | ../../modules/infrastructure/resource-group | |
90-
| <a name="module_secure_for_cloud_role"></a> [secure\_for\_cloud\_role](#module\_secure\_for\_cloud\_role) | ../../modules/infrastructure/organizational/secure-for-cloud-role | |
92+
| <a name="module_secure_for_cloud_role"></a> [secure\_for\_cloud\_role](#module\_secure\_for\_cloud\_role) | ../../modules/infrastructure/permissions/org-management-role | |
9193
| <a name="module_ssm"></a> [ssm](#module\_ssm) | ../../modules/infrastructure/ssm | |
9294

9395
## Resources

‎examples/organizational/utils.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ module "resource_group_secure_for_cloud_member" {
99

1010

1111
module "secure_for_cloud_role" {
12-
source = "../../modules/infrastructure/organizational/secure-for-cloud-role"
12+
source = "../../modules/infrastructure/permissions/org-management-role"
1313
providers = {
1414
aws.member = aws.member
1515
}

‎examples/single-account-k8s/README.md

+108
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
# Sysdig Secure for Cloud in AWS :: Single-Account on Kubernetes Cluster
2+
3+
Deploy Sysdig Secure for Cloud in a provided existing Kubernetes Cluster.
4+
5+
- Sysdig **Helm** charts will be used to deploy threat-detection and scanning modules
6+
- [Cloud-Connector Chart](https://charts.sysdig.com/charts/cloud-connector/)
7+
- [Cloud-Scanning Chart](https://charts.sysdig.com/charts/cloud-scanning/)
8+
- Because these charts require specific AWS credentials to be passed by parameter, a new user + access key will be created within account. See [`credentials.tf`](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/blob/master/examples/single-account-k8s/credentials.tf)
9+
- Used arquitecture is similar to [single-account](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/blob/master/examples/single-account) but changing ECS <---> with an existing EKS
10+
11+
All the required resources and workloads will be run under the same AWS account.
12+
13+
## Prerequisites
14+
15+
Minimum requirements:
16+
17+
1. AWS profile credentials configuration
18+
2. A Kubernetes cluster configured within your `~/.kube/config`
19+
3. Secure requirements, as input variable value
20+
```
21+
sysdig_secure_api_token=<SECURE_API_TOKEN>
22+
```
23+
24+
## Usage
25+
26+
For quick testing, use this snippet on your terraform files
27+
28+
```terraform
29+
module "secure_for_cloud_aws_single_account" {
30+
source = "sysdiglabs/secure-for-cloud/aws//examples/single-account-k8s"
31+
32+
sysdig_secure_api_token = "00000000-1111-2222-3333-444444444444"
33+
}
34+
```
35+
36+
See [inputs summary](#inputs) or module module [`variables.tf`](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/blob/master/examples/single-account-k8s/variables.tf) file for more optional configuration.
37+
38+
To run this example you need have your [aws account profile configured in CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html) and to execute:
39+
```terraform
40+
$ terraform init
41+
$ terraform plan
42+
$ terraform apply
43+
```
44+
45+
Notice that:
46+
* This example will create resources that cost money.<br/>Run `terraform destroy` when you don't need them anymore
47+
* All created resources will be created within the tags `product:sysdig-secure-for-cloud`, within the resource-group `sysdig-secure-for-cloud`
48+
49+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
50+
## Requirements
51+
52+
| Name | Version |
53+
|------|---------|
54+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.15.0 |
55+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.50.0 |
56+
| <a name="requirement_helm"></a> [helm](#requirement\_helm) | >=2.3.0 |
57+
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | >= 0.5.19 |
58+
59+
## Providers
60+
61+
| Name | Version |
62+
|------|---------|
63+
| <a name="provider_helm"></a> [helm](#provider\_helm) | >=2.3.0 |
64+
65+
## Modules
66+
67+
| Name | Source | Version |
68+
|------|--------|---------|
69+
| <a name="module_cloud_connector_sqs"></a> [cloud\_connector\_sqs](#module\_cloud\_connector\_sqs) | ../../modules/infrastructure/cloudtrail-subscription-sqs | |
70+
| <a name="module_cloud_scanning_sqs"></a> [cloud\_scanning\_sqs](#module\_cloud\_scanning\_sqs) | ../../modules/infrastructure/cloudtrail-subscription-sqs | |
71+
| <a name="module_cloudtrail"></a> [cloudtrail](#module\_cloudtrail) | ../../modules/infrastructure/cloudtrail | |
72+
| <a name="module_codebuild"></a> [codebuild](#module\_codebuild) | ../../modules/infrastructure/codebuild | |
73+
| <a name="module_credentials"></a> [credentials](#module\_credentials) | ../../modules/infrastructure/permissions/single-account-user | |
74+
| <a name="module_resource_group"></a> [resource\_group](#module\_resource\_group) | ../../modules/infrastructure/resource-group | |
75+
| <a name="module_ssm"></a> [ssm](#module\_ssm) | ../../modules/infrastructure/ssm | |
76+
77+
## Resources
78+
79+
| Name | Type |
80+
|------|------|
81+
| [helm_release.cloud_connector](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
82+
| [helm_release.cloud_scanning](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
83+
84+
## Inputs
85+
86+
| Name | Description | Type | Default | Required |
87+
|------|-------------|------|---------|:--------:|
88+
| <a name="input_sysdig_secure_api_token"></a> [sysdig\_secure\_api\_token](#input\_sysdig\_secure\_api\_token) | Sysdig Secure API token | `string` | n/a | yes |
89+
| <a name="input_cloudtrail_is_multi_region_trail"></a> [cloudtrail\_is\_multi\_region\_trail](#input\_cloudtrail\_is\_multi\_region\_trail) | true/false whether cloudtrail will ingest multiregional events. testing/economization purpose. | `bool` | `true` | no |
90+
| <a name="input_cloudtrail_kms_enable"></a> [cloudtrail\_kms\_enable](#input\_cloudtrail\_kms\_enable) | true/false whether s3 should be encrypted. testing/economization purpose. | `bool` | `true` | no |
91+
| <a name="input_name"></a> [name](#input\_name) | Name for the Cloud Vision deployment | `string` | `"sysdig-secure-for-cloud-k8s"` | no |
92+
| <a name="input_region"></a> [region](#input\_region) | Default region for resource creation in both organization master and secure-for-cloud member account | `string` | `"eu-central-1"` | no |
93+
| <a name="input_sysdig_secure_endpoint"></a> [sysdig\_secure\_endpoint](#input\_sysdig\_secure\_endpoint) | Sysdig Secure API endpoint | `string` | `"https://secure.sysdig.com"` | no |
94+
| <a name="input_tags"></a> [tags](#input\_tags) | sysdig secure-for-cloud tags | `map(string)` | <pre>{<br> "product": "sysdig-secure-for-cloud"<br>}</pre> | no |
95+
96+
## Outputs
97+
98+
No outputs.
99+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
100+
101+
102+
## Authors
103+
104+
Module is maintained and supported by [Sysdig](https://sysdig.com).
105+
106+
## License
107+
108+
Apache 2 Licensed. See LICENSE for full details.

‎examples/single-account-k8s/cloud-connector.tf

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
#-------------------------------------
2+
# requirements
3+
#-------------------------------------
4+
module "cloud_connector_sqs" {
5+
source = "../../modules/infrastructure/cloudtrail-subscription-sqs"
6+
name = "${var.name}-cloud_connector"
7+
sns_topic_arn = module.cloudtrail.sns_topic_arn
8+
tags = var.tags
9+
}
10+
11+
12+
#-------------------------------------
13+
# cloud_connector
14+
#-------------------------------------
15+
resource "helm_release" "cloud_connector" {
16+
name = "cloud-connector"
17+
18+
repository = "https://charts.sysdig.com"
19+
chart = "cloud-connector"
20+
21+
create_namespace = true
22+
namespace = var.name
23+
24+
set_sensitive {
25+
name = "sysdig.secureAPIToken"
26+
value = var.sysdig_secure_api_token
27+
}
28+
29+
set_sensitive {
30+
name = "aws.accessKeyId"
31+
value = module.credentials.s4c_user_access_key_id
32+
}
33+
34+
set_sensitive {
35+
name = "aws.secretAccessKey"
36+
value = module.credentials.s4c_user_secret_access_key
37+
}
38+
39+
set {
40+
name = "aws.region"
41+
value = var.region
42+
}
43+
44+
set {
45+
name = "sysdig.url"
46+
value = var.sysdig_secure_endpoint
47+
}
48+
49+
values = [
50+
<<CONFIG
51+
ingestors:
52+
- cloudtrail-sns-sqs:
53+
queueURL: ${module.cloud_connector_sqs.cloudtrail_sns_subscribed_sqs_url}
54+
interval: 60s
55+
CONFIG
56+
]
57+
}

‎examples/single-account-k8s/cloud-scanning.tf

+73
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
#-------------------------------------
2+
# requirements
3+
#-------------------------------------
4+
module "cloud_scanning_sqs" {
5+
source = "../../modules/infrastructure/cloudtrail-subscription-sqs"
6+
name = "${var.name}-cloud_scanning"
7+
sns_topic_arn = module.cloudtrail.sns_topic_arn
8+
tags = var.tags
9+
}
10+
11+
12+
module "codebuild" {
13+
source = "../../modules/infrastructure/codebuild"
14+
name = var.name
15+
secure_api_token_secret_name = module.ssm.secure_api_token_secret_name
16+
17+
tags = var.tags
18+
# note. this is required to avoid race conditions
19+
depends_on = [module.ssm]
20+
}
21+
22+
#-------------------------------------
23+
# cloud_scanning
24+
#-------------------------------------
25+
resource "helm_release" "cloud_scanning" {
26+
name = "cloud-scanning"
27+
28+
repository = "https://charts.sysdig.com"
29+
chart = "cloud-scanning"
30+
31+
create_namespace = true
32+
namespace = var.name
33+
34+
set_sensitive {
35+
name = "aws.accessKeyId"
36+
value = module.credentials.s4c_user_access_key_id
37+
}
38+
39+
set_sensitive {
40+
name = "aws.secretAccessKey"
41+
value = module.credentials.s4c_user_secret_access_key
42+
}
43+
44+
set_sensitive {
45+
name = "sysdig.secureAPIToken"
46+
value = var.sysdig_secure_api_token
47+
}
48+
49+
set {
50+
name = "secureAPITokenSecret"
51+
value = module.ssm.secure_api_token_secret_name
52+
}
53+
54+
set {
55+
name = "aws.region"
56+
value = var.region
57+
}
58+
59+
set {
60+
name = "sysdig.url"
61+
value = var.sysdig_secure_endpoint
62+
}
63+
64+
set {
65+
name = "sqsQueueUrl"
66+
value = module.cloud_scanning_sqs.cloudtrail_sns_subscribed_sqs_url
67+
}
68+
69+
set {
70+
name = "codeBuildProject"
71+
value = module.codebuild.project_name
72+
}
73+
}

‎examples/single-account-k8s/credentials.tf

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
module "credentials" {
2+
source = "../../modules/infrastructure/permissions/single-account-user"
3+
name = var.name
4+
5+
secure_api_token_secret_name = module.ssm.secure_api_token_secret_name
6+
cloudtrail_s3_bucket_arn = module.cloudtrail.s3_bucket_arn
7+
cloudtrail_sns_subscribed_sqs_arns = [module.cloud_connector_sqs.cloudtrail_sns_subscribed_sqs_arn, module.cloud_scanning_sqs.cloudtrail_sns_subscribed_sqs_arn]
8+
scanning_build_project_arn = module.codebuild.project_arn
9+
10+
tags = var.tags
11+
# required to avoid ParameterNotFound on tf-plan
12+
depends_on = [module.ssm]
13+
}

‎examples/single-account-k8s/main.tf

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
provider "aws" {
2+
region = var.region
3+
}
4+
5+
# TODO review ways to pass content as input var
6+
provider "helm" {
7+
kubernetes {
8+
config_path = "~/.kube/config"
9+
}
10+
}
11+
12+
13+
#-------------------------------------
14+
# general resources
15+
#-------------------------------------
16+
17+
module "resource_group" {
18+
source = "../../modules/infrastructure/resource-group"
19+
name = var.name
20+
tags = var.tags
21+
}
22+
23+
module "ssm" {
24+
source = "../../modules/infrastructure/ssm"
25+
name = var.name
26+
sysdig_secure_api_token = var.sysdig_secure_api_token
27+
}
28+
29+
module "cloudtrail" {
30+
source = "../../modules/infrastructure/cloudtrail"
31+
name = var.name
32+
33+
is_organizational = false
34+
is_multi_region_trail = var.cloudtrail_is_multi_region_trail
35+
cloudtrail_kms_enable = var.cloudtrail_kms_enable
36+
37+
tags = var.tags
38+
}

‎examples/single-account-k8s/outputs.tf

Whitespace-only changes.

0 commit comments

Comments
 (0)