Skip to content

Commit 84de7bf

Browse files
SKosierSKosier
authored
feat(modules/cloud-logs): introduce cloud logs module for s3 onboarding (#16)
1 parent d78b5d0 commit 84de7bf

File tree

5 files changed

+235
-0
lines changed

5 files changed

+235
-0
lines changed

‎modules/integrations/cloud-logs/README.md

+63
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# AWS Cloud Logs Module
2+
3+
This Module creates the resources required to send CloudTrail logs to Sysdig by enabling access to the CloudTrail associated s3 bucket through a dedicated IAM role.
4+
5+
The following resources will be created in each instrumented account:
6+
- An IAM Role and associated policies that gives the ingestion component in Sysdig's account permission to list and retrieve items from it.
7+
8+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
9+
## Requirements
10+
11+
| Name | Version |
12+
|------|-----------|
13+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
14+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.60.0 |
15+
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) |
16+
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 3.1 |
17+
18+
## Providers
19+
20+
| Name | Version |
21+
|------|---------|
22+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.60.0 |
23+
24+
## Modules
25+
26+
No modules.
27+
28+
## Resources
29+
30+
| Name | Type |
31+
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------|
32+
| [random_id.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
33+
| [aws_iam_role.cloudlogs_s3_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
34+
| [aws_iam_policy_document.assume_cloudlogs_s3_access_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
35+
| [aws_iam_policy_document.cloudlogs_s3_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
36+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
37+
| [sysdig_secure_trusted_cloud_identity.trusted_identity](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_trusted_cloud_identity) | data source |
38+
| [sysdig_secure_tenant_external_id.external_id](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_tenant_external_id) | data source |
39+
| [sysdig_secure_cloud_auth_account_component.aws_cloud_logs](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/resources/secure_cloud_auth_account_component) | resource |
40+
41+
## Inputs
42+
43+
| Name | Description | Type | Default | Required |
44+
|--------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|------|-------------------------------------------------------------|:--------:|
45+
| <a name="input_sysdig_secure_account_id"></a> [sysdig\_secure\_account\_id](#input\_sysdig\_secure\_account\_id) | (Required) ID of the Sysdig Cloud Account to enable Cloud Logs integration for (in case of organization, ID of the Sysdig management account) | `string` | n/a | yes |
46+
| <a name="input_folder_arn"></a> [folder\_arn](#input\_folder\_arn) | (Required) The ARN of your CloudTrail Bucket Folder | `string` | n/a | yes |
47+
| <a name="input_tags"></a> [tags](#input\_tags) | (Optional) Name to be assigned to all child resources. A suffix may be added internally when required. | `map(string)` | <pre>{<br> "product": "sysdig-secure-for-cloud"<br>}</pre> | no |
48+
| <a name="input_name"></a> [name](#input\_name) | (Optional) Sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning | `string` | sysdig-secure-cloudlogs | no |
49+
50+
## Outputs
51+
52+
| Name | Description |
53+
|-----------------------------------------------------------------------------------------------------------------|-------------|
54+
| <a name="output_cloud_logs_component_id"></a> [cloud\_logs\_component\_id](#output\_cloud\_logs\_component\_id) | Component identifier of Cloud Logs integration created in Sysdig Backend for Log Ingestion |
55+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
56+
57+
## Authors
58+
59+
Module is maintained by [Sysdig](https://sysdig.com).
60+
61+
## License
62+
63+
Apache 2 Licensed. See LICENSE for full details.

‎modules/integrations/cloud-logs/main.tf

+126
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
#-----------------------------------------------------------------------------------------------------------------------
2+
# The only resource needed to make Sysdig's backend start to fetch data from the CloudTrail associated s3 bucket is a
3+
# properly set AWS IAM Role. Sysdig's trusted identity act as the Principal in the assume role Policy, namely the role
4+
# that the backend will use to assume the Client's role. At that point, given the permission set granted to the newly
5+
# created Role in the Client's account, Sysdig's backend will be able to perform all the required actions in order to
6+
# retrieve the log files that are automatically published in the target s3 bucket.
7+
#
8+
# Note: this setup assumes that the Customer has already properly set up an AWS CloudTrail Trail and the associated bucket.
9+
# Sysdig's Secure UI provides the necessary information to make the Customer perform the
10+
# required setup operations before applying the Terraform module.
11+
#-----------------------------------------------------------------------------------------------------------------------
12+
13+
#-----------------------------------------------------------------------------------------
14+
# Fetch the data sources
15+
#-----------------------------------------------------------------------------------------
16+
data "aws_caller_identity" "current" {}
17+
18+
data "sysdig_secure_trusted_cloud_identity" "trusted_identity" {
19+
cloud_provider = "aws"
20+
}
21+
22+
data "sysdig_secure_tenant_external_id" "external_id" {}
23+
24+
#-----------------------------------------------------------------------------------------
25+
# Generate a unique name for resources using random suffix and account ID hash
26+
#-----------------------------------------------------------------------------------------
27+
locals {
28+
account_id_hash = substr(md5(data.aws_caller_identity.current.account_id), 0, 4)
29+
role_name = "${var.name}-${random_id.suffix.hex}-${local.account_id_hash}"
30+
31+
bucket_arn = regex("^([^/]+)", var.folder_arn)[0]
32+
}
33+
34+
#-----------------------------------------------------------------------------------------------------------------------
35+
# A random resource is used to generate unique role name suffix.
36+
# This prevents conflicts when recreating an role with the same name.
37+
#-----------------------------------------------------------------------------------------------------------------------
38+
resource "random_id" "suffix" {
39+
byte_length = 3
40+
}
41+
42+
# AWS IAM Role that will be used by CloudIngestion to access the CloudTrail-associated s3 bucket
43+
resource "aws_iam_role" "cloudlogs_s3_access" {
44+
name = local.role_name
45+
tags = var.tags
46+
47+
assume_role_policy = data.aws_iam_policy_document.assume_cloudlogs_s3_access_role.json
48+
inline_policy {
49+
name = "cloudlogs_s3_access_policy"
50+
policy = data.aws_iam_policy_document.cloudlogs_s3_access.json
51+
}
52+
}
53+
54+
# IAM Policy Document used for the assume role policy
55+
data "aws_iam_policy_document" "assume_cloudlogs_s3_access_role" {
56+
statement {
57+
effect = "Allow"
58+
59+
principals {
60+
type = "AWS"
61+
identifiers = [data.sysdig_secure_trusted_cloud_identity.trusted_identity.identity]
62+
}
63+
64+
actions = ["sts:AssumeRole"]
65+
66+
condition {
67+
test = "StringEquals"
68+
variable = "sts:ExternalId"
69+
values = [data.sysdig_secure_tenant_external_id.external_id.external_id]
70+
}
71+
}
72+
}
73+
74+
# IAM Policy Document used for the bucket access policy
75+
data "aws_iam_policy_document" "cloudlogs_s3_access" {
76+
statement {
77+
sid = "CloudlogsS3AccessGet"
78+
79+
effect = "Allow"
80+
81+
actions = [
82+
"s3:Get*",
83+
]
84+
85+
resources = [
86+
local.bucket_arn,
87+
"${local.bucket_arn}/*"
88+
]
89+
}
90+
91+
statement {
92+
sid = "CloudlogsS3AccessList"
93+
94+
effect = "Allow"
95+
96+
actions = [
97+
"s3:List*"
98+
]
99+
100+
resources = [
101+
local.bucket_arn,
102+
"${local.bucket_arn}/*"
103+
]
104+
}
105+
}
106+
107+
#-----------------------------------------------------------------------------------------------------------------------------------------
108+
# Call Sysdig Backend to add the cloud logs integration to the Sysdig Cloud Account
109+
#
110+
# Note (optional): To ensure this gets called after all cloud resources are created, add
111+
# explicit dependency using depends_on
112+
#-----------------------------------------------------------------------------------------------------------------------------------------
113+
resource "sysdig_secure_cloud_auth_account_component" "aws_cloud_logs" {
114+
account_id = var.sysdig_secure_account_id
115+
type = "COMPONENT_CLOUD_LOGS"
116+
instance = "secure-runtime"
117+
version = "v0.1.0"
118+
cloud_logs_metadata = jsonencode({
119+
aws = {
120+
cloudtrailS3Bucket = {
121+
folder_arn = var.folder_arn
122+
role_name = local.role_name
123+
}
124+
}
125+
})
126+
}

‎modules/integrations/cloud-logs/outputs.tf

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
output "cloud_logs_component_id" {
2+
value = "${sysdig_secure_cloud_auth_account_component.aws_cloud_logs.type}/${sysdig_secure_cloud_auth_account_component.aws_cloud_logs.instance}"
3+
description = "Component identifier of Cloud Logs integration created in Sysdig Backend for Log Ingestion"
4+
depends_on = [ sysdig_secure_cloud_auth_account_component.aws_cloud_logs ]
5+
}

‎modules/integrations/cloud-logs/variables.tf

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
variable "sysdig_secure_account_id" {
2+
type = string
3+
description = "ID of the Sysdig Cloud Account to enable Cloud Logs integration for (in case of organization, ID of the Sysdig management account)"
4+
}
5+
6+
variable "folder_arn" {
7+
description = "(Required) The ARN of your CloudTrail Bucket Folder"
8+
type = string
9+
}
10+
11+
variable "tags" {
12+
type = map(string)
13+
description = "(Optional) Sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning"
14+
15+
default = {
16+
"product" = "sysdig-secure-for-cloud"
17+
}
18+
}
19+
20+
variable "name" {
21+
description = "(Optional) Name to be assigned to all child resources. A suffix may be added internally when required. Use default value unless you need to install multiple instances"
22+
type = string
23+
default = "sysdig-secure-cloudlogs"
24+
}

‎modules/integrations/cloud-logs/versions.tf

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
terraform {
2+
required_version = ">= 1.0.0"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 5.60.0"
8+
}
9+
sysdig = {
10+
source = "sysdiglabs/sysdig"
11+
}
12+
random = {
13+
source = "hashicorp/random"
14+
version = ">= 3.1"
15+
}
16+
}
17+
}

0 commit comments

Comments
 (0)