Skip to content

Commit 14e5159

Browse files
jose-pablo-camachojose-pablo-camacho
authored
enhance(modular): handle deprecated resources in modules (#18)
1 parent 2b58df2 commit 14e5159

File tree

14 files changed

+162
-184
lines changed

14 files changed

+162
-184
lines changed

‎modules/agentless-scanning/main.tf‎

Lines changed: 55 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ data "aws_iam_session_context" "current" {
2626
data "sysdig_secure_agentless_scanning_assets" "assets" {}
2727

2828
data "sysdig_secure_trusted_cloud_identity" "trusted_identity" {
29-
cloud_provider = "aws"
29+
cloud_provider = "aws"
3030
}
3131

3232
data "sysdig_secure_tenant_external_id" "external_id" {}
@@ -64,29 +64,13 @@ resource "random_id" "suffix" {
6464
# predefined/default AWSCloudFormationStackSetAdministrationRole.
6565
#-----------------------------------------------------------------------------------------------------------------------------------------
6666

67-
# IAM Policy Document used by Stackset roles for the KMS operations policy
68-
data "aws_iam_policy_document" "kms_operations" {
69-
count = !var.auto_create_stackset_roles ? 0 : 1
70-
71-
statement {
72-
sid = "KmsOperationsAccess"
73-
effect = "Allow"
74-
actions = [
75-
"kms:*",
76-
]
77-
resources = [
78-
"*",
79-
]
80-
}
81-
}
82-
8367
resource "aws_iam_role" "scanning_stackset_admin_role" {
8468
count = !var.auto_create_stackset_roles ? 0 : 1
8569

8670
name = "AWSCloudFormationStackSetAdministrationRoleForScanning"
8771
tags = var.tags
8872

89-
assume_role_policy = <<EOF
73+
assume_role_policy = <<EOF
9074
{
9175
"Version": "2012-10-17",
9276
"Statement": [
@@ -101,10 +85,25 @@ resource "aws_iam_role" "scanning_stackset_admin_role" {
10185
}
10286
EOF
10387
managed_policy_arns = ["arn:aws:iam::aws:policy/AWSCloudFormationFullAccess"]
104-
inline_policy {
105-
name = "KmsOperationsAccess"
106-
policy = data.aws_iam_policy_document.kms_operations[0].json
107-
}
88+
}
89+
90+
resource "aws_iam_role_policy" "scanning_stackset_admin_role_policy" {
91+
count = !var.auto_create_stackset_roles ? 0 : 1
92+
93+
name = "KmsOperationsAccess"
94+
role = aws_iam_role.scanning_stackset_admin_role[0].id
95+
policy = jsonencode({
96+
Statement = [
97+
{
98+
Sid = "KmsOperationsAccess"
99+
Action = [
100+
"kms:*",
101+
]
102+
Effect = "Allow"
103+
Resource = "*"
104+
},
105+
]
106+
})
108107
}
109108

110109
#-----------------------------------------------------------------------------------------------------------------------------------------
@@ -139,10 +138,25 @@ EOF
139138
managed_policy_arns = [
140139
"arn:aws:iam::aws:policy/AWSCloudFormationFullAccess"
141140
]
142-
inline_policy {
143-
name = "KmsOperationsAccess"
144-
policy = data.aws_iam_policy_document.kms_operations[0].json
145-
}
141+
}
142+
143+
resource "aws_iam_role_policy" "scanning_stackset_execution_role_policy" {
144+
count = !var.auto_create_stackset_roles ? 0 : 1
145+
146+
name = "KmsOperationsAccess"
147+
role = aws_iam_role.scanning_stackset_execution_role[0].id
148+
policy = jsonencode({
149+
Statement = [
150+
{
151+
Sid = "KmsOperationsAccess"
152+
Action = [
153+
"kms:*",
154+
]
155+
Effect = "Allow"
156+
Resource = "*"
157+
},
158+
]
159+
})
146160
}
147161

148162
#-----------------------------------------------------------------------------------------------------------------------------------------
@@ -368,7 +382,7 @@ resource "aws_iam_policy_attachment" "scanning_policy_attachment" {
368382
# - KMS Primary Key, and
369383
# - KMS Primary alias
370384
#
371-
# Note: self-managed stacksets require pair of StackSetAdministrationRole & StackSetExecutionRole IAM roles with self-managed permissions
385+
# Note: self-managed stacksets require pair of StackSetAdministrationRole & StackSetExecutionRole IAM roles with self-managed permissions
372386
#-----------------------------------------------------------------------------------------------------------------------------------------
373387

374388
resource "aws_cloudformation_stack_set" "primary_acc_stackset" {
@@ -428,7 +442,9 @@ TEMPLATE
428442
depends_on = [
429443
aws_iam_role.scanning_role,
430444
aws_iam_role.scanning_stackset_admin_role,
431-
aws_iam_role.scanning_stackset_execution_role
445+
aws_iam_role_policy.scanning_stackset_admin_role_policy,
446+
aws_iam_role.scanning_stackset_execution_role,
447+
aws_iam_role_policy.scanning_stackset_execution_role_policy
432448
]
433449
}
434450

@@ -459,10 +475,10 @@ resource "aws_cloudformation_stack_set_instance" "primary_acc_stackset_instance"
459475
# explicit dependency using depends_on
460476
#-----------------------------------------------------------------------------------------------------------------
461477
resource "sysdig_secure_cloud_auth_account_component" "aws_scanning_role" {
462-
account_id = var.sysdig_secure_account_id
463-
type = "COMPONENT_TRUSTED_ROLE"
464-
instance = "secure-scanning"
465-
version = "v0.1.0"
478+
account_id = var.sysdig_secure_account_id
479+
type = "COMPONENT_TRUSTED_ROLE"
480+
instance = "secure-scanning"
481+
version = "v0.1.0"
466482
trusted_role_metadata = jsonencode({
467483
aws = {
468484
role_name = local.scanning_resource_name
@@ -477,16 +493,16 @@ resource "sysdig_secure_cloud_auth_account_component" "aws_scanning_role" {
477493
# explicit dependency using depends_on
478494
#-----------------------------------------------------------------------------------------------------------------
479495
resource "sysdig_secure_cloud_auth_account_component" "aws_crypto_key" {
480-
account_id = var.sysdig_secure_account_id
481-
type = "COMPONENT_CRYPTO_KEY"
482-
instance = "secure-scanning"
483-
version = "v0.1.0"
496+
account_id = var.sysdig_secure_account_id
497+
type = "COMPONENT_CRYPTO_KEY"
498+
instance = "secure-scanning"
499+
version = "v0.1.0"
484500
crypto_key_metadata = jsonencode({
485501
aws = {
486502
kms = {
487-
alias = "alias/${local.scanning_resource_name}"
488-
regions = var.regions
489-
}
503+
alias = "alias/${local.scanning_resource_name}"
504+
regions = var.regions
505+
}
490506
}
491507
})
492508
}

‎modules/agentless-scanning/outputs.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
output "scanning_role_component_id" {
22
value = "${sysdig_secure_cloud_auth_account_component.aws_scanning_role.type}/${sysdig_secure_cloud_auth_account_component.aws_scanning_role.instance}"
33
description = "Component identifier of scanning role created in Sysdig Backend for Agentless Scanning"
4-
depends_on = [ sysdig_secure_cloud_auth_account_component.aws_scanning_role ]
4+
depends_on = [sysdig_secure_cloud_auth_account_component.aws_scanning_role]
55
}
66

77
output "crypto_key_component_id" {
88
value = "${sysdig_secure_cloud_auth_account_component.aws_crypto_key.type}/${sysdig_secure_cloud_auth_account_component.aws_crypto_key.instance}"
99
description = "Component identifier of KMS crypto key created in Sysdig Backend for Agentless Scanning"
10-
depends_on = [ sysdig_secure_cloud_auth_account_component.aws_crypto_key ]
10+
depends_on = [sysdig_secure_cloud_auth_account_component.aws_crypto_key]
1111
}

‎modules/agentless-scanning/variables.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,8 @@ variable "stackset_admin_role_arn" {
5656

5757
variable "stackset_execution_role_name" {
5858
description = "(Optional) stackset execution role name to run SELF_MANAGED stackset"
59-
type = string
60-
default = ""
59+
type = string
60+
default = ""
6161
}
6262

6363
variable "timeout" {

‎modules/agentless-scanning/versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ terraform {
66
version = ">= 5.60.0"
77
}
88
sysdig = {
9-
source = "sysdiglabs/sysdig"
9+
source = "sysdiglabs/sysdig"
1010
}
1111
random = {
1212
source = "hashicorp/random"

‎modules/config-posture/main.tf‎

Lines changed: 56 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ locals {
99
}
1010

1111
data "sysdig_secure_trusted_cloud_identity" "trusted_identity" {
12-
cloud_provider = "aws"
12+
cloud_provider = "aws"
1313
}
1414

1515
data "sysdig_secure_tenant_external_id" "external_id" {}
@@ -41,103 +41,71 @@ resource "aws_iam_role" "cspm_role" {
4141
}
4242
EOF
4343
managed_policy_arns = ["arn:aws:iam::aws:policy/SecurityAudit"]
44-
inline_policy {
45-
name = local.config_posture_role_name
46-
policy = data.aws_iam_policy_document.custom_resources_policy.json
47-
}
4844
}
4945

50-
# Custom IAM Policy Document used by trust-relationship role
51-
data "aws_iam_policy_document" "custom_resources_policy" {
52-
53-
statement {
54-
sid = "DescribeEFSAccessPoints"
55-
56-
effect = "Allow"
57-
58-
actions = [
59-
"elasticfilesystem:DescribeAccessPoints",
60-
]
61-
62-
resources = [
63-
"*",
64-
]
65-
}
66-
67-
statement {
68-
sid = "ListWafRegionalRulesAndRuleGroups"
69-
70-
effect = "Allow"
71-
72-
actions = [
73-
"waf-regional:ListRules",
74-
"waf-regional:ListRuleGroups",
75-
]
76-
77-
resources = [
78-
"arn:aws:waf-regional:*:*:rule/*",
79-
"arn:aws:waf-regional:*:*:rulegroup/*"
80-
]
81-
}
82-
83-
statement {
84-
sid = "ListJobsOnConsole"
85-
86-
effect = "Allow"
87-
88-
actions = [
89-
"macie2:ListClassificationJobs",
46+
resource "aws_iam_role_policy" "cspm_role_policy" {
47+
name = local.config_posture_role_name
48+
role = aws_iam_role.cspm_role.id
49+
policy = jsonencode({
50+
Statement = [
51+
{
52+
Sid = "DescribeEFSAccessPoints"
53+
Action = [
54+
"elasticfilesystem:DescribeAccessPoints",
55+
]
56+
Effect = "Allow"
57+
Resource = "*"
58+
},
59+
{
60+
Sid = "ListWafRegionalRulesAndRuleGroups"
61+
Action = [
62+
"waf-regional:ListRules",
63+
"waf-regional:ListRuleGroups",
64+
]
65+
Effect = "Allow"
66+
Resource = [
67+
"arn:aws:waf-regional:*:*:rule/*",
68+
"arn:aws:waf-regional:*:*:rulegroup/*"
69+
]
70+
},
71+
{
72+
Sid = "ListJobsOnConsole"
73+
Action = "macie2:ListClassificationJobs"
74+
Effect = "Allow"
75+
Resource = "*"
76+
},
77+
{
78+
Sid = "GetFunctionDetails"
79+
Action = [
80+
"lambda:GetRuntimeManagementConfig",
81+
"lambda:GetFunction",
82+
]
83+
Effect = "Allow"
84+
Resource = "*"
85+
},
86+
{
87+
Sid = "AccessAccountContactInfo"
88+
Action = "account:GetContactInformation"
89+
Effect = "Allow"
90+
Resource = "*"
91+
},
9092
]
91-
92-
resources = [
93-
"*",
94-
]
95-
}
96-
97-
statement {
98-
sid = "GetFunctionDetails"
99-
100-
effect = "Allow"
101-
102-
actions = [
103-
"lambda:GetRuntimeManagementConfig",
104-
"lambda:GetFunction",
105-
]
106-
107-
resources = [
108-
"*"
109-
]
110-
}
111-
112-
statement {
113-
sid = "AccessAccountContactInfo"
114-
115-
effect = "Allow"
116-
117-
actions = [
118-
"account:GetContactInformation",
119-
]
120-
121-
resources = [
122-
"*",
123-
]
124-
}
93+
})
12594
}
126-
12795
#--------------------------------------------------------------------------------------------------------------
12896
# Call Sysdig Backend to add the trusted role for Config Posture to the Sysdig Cloud Account
12997
#
13098
# Note (optional): To ensure this gets called after all cloud resources are created, add
13199
# explicit dependency using depends_on
132100
#--------------------------------------------------------------------------------------------------------------
133101
resource "sysdig_secure_cloud_auth_account_component" "config_posture_role" {
134-
account_id = var.sysdig_secure_account_id
135-
type = "COMPONENT_TRUSTED_ROLE"
136-
instance = "secure-posture"
137-
version = "v0.1.0"
102+
account_id = var.sysdig_secure_account_id
103+
type = "COMPONENT_TRUSTED_ROLE"
104+
instance = "secure-posture"
105+
version = "v0.1.0"
138106
trusted_role_metadata = jsonencode({
139-
aws = {
140-
role_name = local.config_posture_role_name
141-
}
142-
})
107+
aws = {
108+
role_name = local.config_posture_role_name
109+
}
110+
})
143111
}

‎modules/config-posture/outputs.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
output "config_posture_component_id" {
22
value = "${sysdig_secure_cloud_auth_account_component.config_posture_role.type}/${sysdig_secure_cloud_auth_account_component.config_posture_role.instance}"
33
description = "Component identifier of trusted identity created in Sysdig Backend for Config Posture"
4-
depends_on = [ sysdig_secure_cloud_auth_account_component.config_posture_role ]
4+
depends_on = [sysdig_secure_cloud_auth_account_component.config_posture_role]
55
}

‎modules/config-posture/versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ terraform {
66
version = ">= 5.60.0"
77
}
88
sysdig = {
9-
source = "sysdiglabs/sysdig"
9+
source = "sysdiglabs/sysdig"
1010
}
1111
}
1212
}

0 commit comments

Comments
 (0)