Skip to content

Commit 1b30bde

Browse files
sameer-insameer-in
authored
feat: adds org-level compliance setup (#128)
1 parent 4279ce8 commit 1b30bde

File tree

34 files changed

+1052
-9
lines changed

34 files changed

+1052
-9
lines changed

‎.github/workflows/ci-integration-test.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,14 @@ jobs:
5252
if: ${{ failure() }}
5353
run: bundle exec kitchen destroy "organization-gcp"
5454

55+
# organization-optimized-compliance
56+
# - name: Run organization test
57+
# run: bundle exec kitchen test "organization-optimized-compliance"
58+
#
59+
# - name: Destroy organization resources
60+
# if: ${{ failure() }}
61+
# run: bundle exec kitchen destroy "organization-optimized-compliance"
62+
5563
- name: Create kind cluster
5664
uses: helm/[email protected]
5765

‎.gitignore‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,4 +38,4 @@ override.tf.json
3838
#Kitchen test
3939
.kitchen/*
4040
test/fixtures/tf_module/.kitchen/
41-
examples/organization/aliased-providers.tf.json
41+
**/aliased-providers.tf.json

‎.kitchen.yml‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,15 @@ suites:
1515
- name: single-project
1616
driver:
1717
root_module_directory: test/fixtures/single-project
18-
- name: organization
19-
driver:
20-
root_module_directory: test/fixtures/organization
2118
- name: single-project-k8s
2219
driver:
2320
root_module_directory: test/fixtures/single-project-k8s
21+
- name: organization
22+
driver:
23+
root_module_directory: test/fixtures/organization
24+
25+
# this test does not make sense, since its the same as the organization
26+
# besides, with org compliance, but on both tests
27+
# - name: organization-optimized-compliance
28+
# driver:
29+
# root_module_directory: test/fixtures/organization-org_compliance

‎Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ clean:
2525
# 'missing provider provider["registry.terraform.io/hashicorp/google"].multiproject'
2626
generate-terraform-providers:
2727
./examples/organization/.generate-providers.sh
28+
./examples/organization-org_compliance/.generate-providers.sh
2829

2930
terraform-init: generate-terraform-providers
3031
find -name "*.tf" | xargs dirname | uniq | xargs -I% -P0 sh -c 'cd %; terraform init --backend=false' 1>/dev/null

‎examples/organization-org_compliance/.generate-providers.sh‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#!/usr/bin/env bash
2+
go install github.com/hashicorp/terraform-config-inspect@latest
3+
terraform-config-inspect --json ./examples/organization-org_compliance | jq -r '
4+
[.required_providers[].aliases]
5+
| flatten
6+
| del(.[] | select(. == null))
7+
| reduce .[] as $entry (
8+
{};
9+
.provider[$entry.name] //= [] | .provider[$entry.name] += [{"alias": $entry.alias}]
10+
)
11+
' | tee ./examples/organization-org_compliance/aliased-providers.tf.json

‎examples/organization-org_compliance/README.md‎

Lines changed: 229 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,229 @@
1+
# Sysdig Secure for Cloud in GCP<br/>[ Example :: Organization ]
2+
3+
This example deploys Secure for Cloud into a GCP organizational account.
4+
5+
6+
### Notice
7+
* Sysdig workload will be deployed in the `project_id` defined in the required input parameter.
8+
* This will create a single workload identity on the org-level, instead of the current project-level.
9+
* All Sysdig Secure for Cloud features but [Image Scanning](https://docs.sysdig.com/en/docs/sysdig-secure/scanning/) are enabled by default. You can enable it through `deploy_scanning` input variable parameters.<br/>
10+
* This example will create resources that **cost money**. Run `terraform destroy` when you don't need them anymore.
11+
* For **free subscription** users, beware that this example may not deploy properly due to the [1 cloud-account limitation](https://docs.sysdig.com/en/docs/administration/administration-settings/subscription/#cloud-billing-free-tier). Open an Issue so we can help you here!
12+
13+
![organizational project diagram](https://github.com/sysdiglabs/terraform-google-secure-for-cloud/blob/master/examples
14+
/organization-org_compliance/diagram-org.png?raw=true)
15+
16+
## Prerequisites
17+
18+
1. Configure [Terraform **GCP** Provider](https://registry.terraform.io/providers/hashicorp/google/latest/docs)
19+
2. Following **roles** are required in your GCP organization/project credentials
20+
* _Owner_
21+
* _Organization Admin_
22+
3. Besides, the following GCP **APIs must be enabled** to deploy resources correctly for:
23+
24+
### Cloud Connector
25+
26+
* [Cloud Pub/Sub API](https://console.cloud.google.com/marketplace/product/google/pubsub.googleapis.com)
27+
* [Cloud Run API](https://console.cloud.google.com/marketplace/product/google/run.googleapis.com)
28+
* [Eventarc API](https://console.cloud.google.com/marketplace/product/google/eventarc.googleapis.com)
29+
30+
### Cloud Scanning
31+
32+
* [Cloud Pub/Sub API](https://console.cloud.google.com/marketplace/product/google/pubsub.googleapis.com)
33+
* [Cloud Run API](https://console.cloud.google.com/marketplace/product/google/run.googleapis.com)
34+
* [Eventarc API](https://console.cloud.google.com/marketplace/product/google/eventarc.googleapis.com)
35+
* [Secret Manger API](https://console.cloud.google.com/marketplace/product/google/secretmanager.googleapis.com)
36+
* [Cloud Build API](https://console.cloud.google.com/marketplace/product/google/cloudbuild.googleapis.com)
37+
* [Identity and access management API](https://console.cloud.google.com/marketplace/product/google/iam.googleapis.com)
38+
39+
### Cloud Benchmarks
40+
41+
* [Identity and access management API](https://console.cloud.google.com/marketplace/product/google/iam.googleapis.com)
42+
* [IAM Service Account Credentials API](https://console.cloud.google.com/marketplace/product/google/iamcredentials.googleapis.com)
43+
* [Cloud Resource Manager API](https://console.cloud.google.com/marketplace/product/google/cloudresourcemanager.googleapis.com)
44+
* [Security Token Service API](https://console.cloud.google.com/marketplace/product/google/sts.googleapis.com)
45+
46+
47+
## Usage
48+
49+
For quick testing, use this snippet on your terraform files and provide following parameters
50+
- `SYSDIG_SECURE_URL / SYSDIG_SECURE_API_TOKEN` Sysdig Authentication
51+
- `ORG_DOMAIN` GCP organization identification
52+
- `PROJECT_ID` GCP project where workload will be deployed
53+
- `REGION_ID` for the workload to be deployed
54+
55+
```terraform
56+
terraform {
57+
required_version = ">= 0.15.0"
58+
59+
required_providers {
60+
google = {
61+
source = "hashicorp/google"
62+
version = ">= 4.21.0"
63+
}
64+
sysdig = {
65+
source = "sysdiglabs/sysdig"
66+
version = ">= 0.5.46"
67+
}
68+
}
69+
}
70+
71+
provider "sysdig" {
72+
sysdig_secure_url = "<SYSDIG_SECURE_URL>"
73+
sysdig_secure_api_token = "<SYSDIG_SECURE_API_TOKEN>"
74+
}
75+
76+
provider "google" {
77+
project = "<PROJECT_ID>"
78+
region = "<REGION_ID>; ex. us-central1"
79+
}
80+
81+
provider "google" {
82+
alias = "multiproject"
83+
region = "<REGION_ID>; ex. us-central1"
84+
}
85+
86+
provider "google-beta" {
87+
alias = "multiproject"
88+
region = "<REGION_ID>; ex. us-central1"
89+
}
90+
91+
module "secure-for-cloud_example_organization" {
92+
providers = {
93+
google.multiproject = google.multiproject
94+
google-beta.multiproject = google-beta.multiproject
95+
}
96+
source = "../terraform-google-secure-for-cloud/examples/organization-org_compliance"
97+
98+
organization_domain = "<ORG_DOMAIN>"
99+
name = "<NAME>"
100+
}
101+
102+
```
103+
104+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
105+
## Requirements
106+
107+
| Name | Version |
108+
|------|---------|
109+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.15.0 |
110+
| <a name="requirement_google"></a> [google](#requirement\_google) | >= 4.21.0 |
111+
| <a name="requirement_google-beta"></a> [google-beta](#requirement\_google-beta) | >= 4.21.0 |
112+
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | >= 0.5.46 |
113+
114+
## Providers
115+
116+
| Name | Version |
117+
|------|---------|
118+
| <a name="provider_google"></a> [google](#provider\_google) | >= 4.21.0 |
119+
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | >= 0.5.46 |
120+
121+
## Modules
122+
123+
| Name | Source | Version |
124+
|------|--------|---------|
125+
| <a name="module_cloud_bench_workload_identity"></a> [cloud\_bench\_workload\_identity](#module\_cloud\_bench\_workload\_identity) | ../../modules/services/cloud-bench-workload-identity | n/a |
126+
| <a name="module_cloud_build_permission"></a> [cloud\_build\_permission](#module\_cloud\_build\_permission) | ../../modules/infrastructure/cloud_build_permission | n/a |
127+
| <a name="module_cloud_connector"></a> [cloud\_connector](#module\_cloud\_connector) | ../../modules/services/cloud-connector | n/a |
128+
| <a name="module_connector_organization_sink"></a> [connector\_organization\_sink](#module\_connector\_organization\_sink) | ../../modules/infrastructure/organization_sink | n/a |
129+
| <a name="module_pubsub_http_subscription"></a> [pubsub\_http\_subscription](#module\_pubsub\_http\_subscription) | ../../modules/infrastructure/pubsub_subscription | n/a |
130+
| <a name="module_secure_secrets"></a> [secure\_secrets](#module\_secure\_secrets) | ../../modules/infrastructure/secrets | n/a |
131+
132+
## Resources
133+
134+
| Name | Type |
135+
|------|------|
136+
| [google_organization_iam_custom_role.org_gcr_image_puller](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/organization_iam_custom_role) | resource |
137+
| [google_organization_iam_member.organization_image_puller](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/organization_iam_member) | resource |
138+
| [google_service_account.connector_sa](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account) | resource |
139+
| [google_client_config.current](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/client_config) | data source |
140+
| [google_organization.org](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/organization) | data source |
141+
| [google_projects.all_projects](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/projects) | data source |
142+
| [sysdig_secure_connection.current](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_connection) | data source |
143+
144+
## Inputs
145+
146+
| Name | Description | Type | Default | Required |
147+
|------|-------------|------|---------|:--------:|
148+
| <a name="input_organization_domain"></a> [organization\_domain](#input\_organization\_domain) | Organization domain. e.g. sysdig.com | `string` | n/a | yes |
149+
| <a name="input_benchmark_project_ids"></a> [benchmark\_project\_ids](#input\_benchmark\_project\_ids) | Google cloud project IDs to run Benchmarks on. It will create a trust-relationship on each, to allow Sysdig usage. If empty, all organization projects will be defaulted. | `list(string)` | `[]` | no |
150+
| <a name="input_benchmark_regions"></a> [benchmark\_regions](#input\_benchmark\_regions) | List of regions in which to run the benchmark. If empty, the task will contain all regions by default. | `list(string)` | `[]` | no |
151+
| <a name="input_benchmark_role_name"></a> [benchmark\_role\_name](#input\_benchmark\_role\_name) | The name of the Service Account that will be created. | `string` | `"sysdigcloudbench"` | no |
152+
| <a name="input_deploy_benchmark"></a> [deploy\_benchmark](#input\_deploy\_benchmark) | whether benchmark module is to be deployed | `bool` | `true` | no |
153+
| <a name="input_deploy_scanning"></a> [deploy\_scanning](#input\_deploy\_scanning) | true/false whether scanning module is to be deployed | `bool` | `false` | no |
154+
| <a name="input_max_instances"></a> [max\_instances](#input\_max\_instances) | Max number of instances for the workloads | `number` | `1` | no |
155+
| <a name="input_name"></a> [name](#input\_name) | Name to be assigned to all child resources. A suffix may be added internally when required. Use default value unless you need to install multiple instances | `string` | `"sfc"` | no |
156+
| <a name="input_repository_project_ids"></a> [repository\_project\_ids](#input\_repository\_project\_ids) | Projects were a `gcr`-named topic will be to subscribe to its repository events. If empty, all organization projects will be defaulted. | `list(string)` | `[]` | no |
157+
158+
## Outputs
159+
160+
No outputs.
161+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
162+
163+
## Authors
164+
165+
Module is maintained and supported by [Sysdig](https://github.com/sysdiglabs/terraform-google-secure-for-cloud).
166+
167+
## License
168+
169+
Apache 2 Licensed. See LICENSE for full details.
170+
171+
<!-- BEGIN_TF_DOCS -->
172+
## Requirements
173+
174+
| Name | Version |
175+
|------|---------|
176+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.15.0 |
177+
| <a name="requirement_google"></a> [google](#requirement\_google) | >= 4.21.0 |
178+
| <a name="requirement_google-beta"></a> [google-beta](#requirement\_google-beta) | >= 4.21.0 |
179+
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | >= 0.5.46 |
180+
181+
## Providers
182+
183+
| Name | Version |
184+
|------|---------|
185+
| <a name="provider_google"></a> [google](#provider\_google) | >= 4.21.0 |
186+
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | >= 0.5.46 |
187+
188+
## Modules
189+
190+
| Name | Source | Version |
191+
|------|--------|---------|
192+
| <a name="module_cloud_bench_workload_identity"></a> [cloud\_bench\_workload\_identity](#module\_cloud\_bench\_workload\_identity) | ../../modules/services/cloud-bench-workload-identity | n/a |
193+
| <a name="module_cloud_build_permission"></a> [cloud\_build\_permission](#module\_cloud\_build\_permission) | ../../modules/infrastructure/cloud_build_permission | n/a |
194+
| <a name="module_cloud_connector"></a> [cloud\_connector](#module\_cloud\_connector) | ../../modules/services/cloud-connector | n/a |
195+
| <a name="module_connector_organization_sink"></a> [connector\_organization\_sink](#module\_connector\_organization\_sink) | ../../modules/infrastructure/organization_sink | n/a |
196+
| <a name="module_pubsub_http_subscription"></a> [pubsub\_http\_subscription](#module\_pubsub\_http\_subscription) | ../../modules/infrastructure/pubsub_subscription | n/a |
197+
| <a name="module_secure_secrets"></a> [secure\_secrets](#module\_secure\_secrets) | ../../modules/infrastructure/secrets | n/a |
198+
199+
## Resources
200+
201+
| Name | Type |
202+
|------|------|
203+
| [google_organization_iam_custom_role.org_gcr_image_puller](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/organization_iam_custom_role) | resource |
204+
| [google_organization_iam_member.organization_image_puller](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/organization_iam_member) | resource |
205+
| [google_service_account.connector_sa](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account) | resource |
206+
| [google_client_config.current](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/client_config) | data source |
207+
| [google_organization.org](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/organization) | data source |
208+
| [google_projects.all_projects](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/projects) | data source |
209+
| [sysdig_secure_connection.current](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_connection) | data source |
210+
211+
## Inputs
212+
213+
| Name | Description | Type | Default | Required |
214+
|------|-------------|------|---------|:--------:|
215+
| <a name="input_benchmark_project_ids"></a> [benchmark\_project\_ids](#input\_benchmark\_project\_ids) | Google cloud project IDs to run Benchmarks on. It will create a trust-relationship on each, to allow Sysdig usage. If empty, all organization projects will be defaulted. | `list(string)` | `[]` | no |
216+
| <a name="input_benchmark_regions"></a> [benchmark\_regions](#input\_benchmark\_regions) | List of regions in which to run the benchmark. If empty, the task will contain all regions by default. | `list(string)` | `[]` | no |
217+
| <a name="input_benchmark_role_name"></a> [benchmark\_role\_name](#input\_benchmark\_role\_name) | The name of the Service Account that will be created. | `string` | `"sysdigcloudbench"` | no |
218+
| <a name="input_deploy_benchmark"></a> [deploy\_benchmark](#input\_deploy\_benchmark) | whether benchmark module is to be deployed | `bool` | `true` | no |
219+
| <a name="input_deploy_scanning"></a> [deploy\_scanning](#input\_deploy\_scanning) | true/false whether scanning module is to be deployed | `bool` | `false` | no |
220+
| <a name="input_max_instances"></a> [max\_instances](#input\_max\_instances) | Max number of instances for the workloads | `number` | `1` | no |
221+
| <a name="input_name"></a> [name](#input\_name) | Name to be assigned to all child resources. A suffix may be added internally when required. Use default value unless you need to install multiple instances | `string` | `"sfc"` | no |
222+
| <a name="input_organization_domain"></a> [organization\_domain](#input\_organization\_domain) | Organization domain. e.g. sysdig.com | `string` | n/a | yes |
223+
| <a name="input_project_id_number_map"></a> [project\_id\_number\_map](#input\_project\_id\_number\_map) | GCP project id to project number map | `map(string)` | `{}` | no |
224+
| <a name="input_repository_project_ids"></a> [repository\_project\_ids](#input\_repository\_project\_ids) | Projects were a `gcr`-named topic will be to subscribe to its repository events. If empty, all organization projects will be defaulted. | `list(string)` | `[]` | no |
225+
226+
## Outputs
227+
228+
No outputs.
229+
<!-- END_TF_DOCS -->

‎examples/organization-org_compliance/data.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
data "google_client_config" "current" {}
2+
3+
data "sysdig_secure_connection" "current" {}

‎examples/organization-org_compliance/diagram-org.png‎

156 KB
Loading

‎examples/organization-org_compliance/diagram-org.py‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
# diagrams as code vía https://diagrams.mingrammer.com
2+
3+
from diagrams.aws.general import General
4+
from diagrams import Cluster, Diagram, Edge
5+
from diagrams.gcp.analytics import PubSub
6+
from diagrams.gcp.compute import Run
7+
from diagrams.gcp.devtools import Code, Build, GCR
8+
from diagrams.gcp.storage import GCS
9+
from diagrams.gcp.security import KMS, Iam
10+
from diagrams.gcp.network import TrafficDirector
11+
from diagrams.custom import Custom
12+
13+
diagram_attr = {
14+
"pad": "0.25",
15+
}
16+
17+
color_event = "firebrick"
18+
color_scanning = "dark-green"
19+
color_permission = "red"
20+
color_non_important = "gray"
21+
color_sysdig = "lightblue"
22+
23+
with Diagram("Sysdig Secure for Cloud\n(organization)", graph_attr=diagram_attr, filename="diagram-org", show=True, direction="TB"):
24+
25+
public_registries = Custom("Public Registries","../../resources/diag-registry-icon.png")
26+
27+
with Cluster("GCP account (sysdig)", graph_attr={"bgcolor": "lightblue"}):
28+
sds = Custom("Sysdig Secure", "../../resources/diag-sysdig-icon.png")
29+
bench = General("Cloud Bench")
30+
sds >> Edge(label="schedule on rand rand * * *") >> bench
31+
32+
with Cluster("GCP organization project", graph_attr={"bgcolor": "pink"}):
33+
ccProjectSink = Custom("\nLog Router \n Sink", "../../resources/sink.png")
34+
orgBenchRole = Iam("WorkloadIdentityPool\n+ServiceAccount\n+Role")
35+
36+
with Cluster("Secure for Cloud (children project)"):
37+
ccPubSub = PubSub("CC PubSub Topic")
38+
ccEventarc = Code("CloudRun\nEventarc Trigger")
39+
ccCloudRun = Run("Cloud Connector")
40+
keys = KMS("Sysdig \n Secure Keys")
41+
42+
ccCloudRun << Edge(style="dashed") << keys
43+
ccEventarc >> ccCloudRun
44+
ccEventarc << ccPubSub
45+
ccProjectSink >> ccPubSub
46+
47+
gcrPubSub = PubSub("GCR PubSub Topic\n(gcr named)")
48+
gcrSubscription = Code("GCR PubSub\nSubscription")
49+
csCloudBuild = Build("Triggered\n Cloud Builds")
50+
gcr = GCR("Google \n Cloud Registry")
51+
52+
gcrSubscription >> ccCloudRun
53+
ccCloudRun >> csCloudBuild
54+
gcrSubscription << gcrPubSub
55+
csCloudBuild << Edge(style="dashed") << keys
56+
gcr >> gcrPubSub
57+
58+
# scanning
59+
ccCloudRun >> Edge(color=color_non_important) >> gcr
60+
ccCloudRun >> Edge(color=color_non_important) >> public_registries
61+
62+
csCloudBuild >> sds
63+
ccCloudRun >> sds
64+
65+
orgBenchRole << Edge(color=color_non_important) << bench

0 commit comments

Comments
 (0)