Skip to content

feat(benchmarks) - Add Cloud Asset permissions for CSPM #118

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Aug 10, 2022
Merged

feat(benchmarks) - Add Cloud Asset permissions for CSPM #118

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
50466d1
SSPROD-15456 - Update terraform module permissions
ido-gold-apolicy Aug 10, 2022
205679f
Use specific permissions instead of a new role
ido-gold-apolicy Aug 10, 2022
c18c34b
fix diagram
ido-gold-apolicy Aug 10, 2022
e0d549f
Update gcp provider version
ido-gold-apolicy Aug 10, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,7 @@ Besides, the following GCP **APIs must be enabled** to deploy resources correctl
* [IAM Service Account Credentials API](https://console.cloud.google.com/marketplace/product/google/iamcredentials.googleapis.com)
* [Cloud Resource Manager API](https://console.cloud.google.com/marketplace/product/google/cloudresourcemanager.googleapis.com)
* [Security Token Service API](https://console.cloud.google.com/marketplace/product/google/sts.googleapis.com)
* [Cloud Asset API](https://console.cloud.google.com/marketplace/product/google/cloudasset.googleapis.com)


## Usage
Expand Down Expand Up @@ -114,8 +115,8 @@ A: On your GCP infrastructure, per-project where Comliance has been setup, check
1. there is a Workload Identity Pool and associated Workload Identity Pool Provider configured, which must have an ID of `sysdigcloud` (display name doesn't matter)
2. the pool should have a connected service account with the name `sfcsysdigcloudbench`, with the email `[email protected]`
3. this serviceaccount should allow access to the following format `principalset: principalSet://iam.googleapis.com/projects/<PROJECTID>/locations/global/workloadIdentityPools/sysdigcloud/attribute.aws_role/arn:aws:sts::***:assumed-role/***`
4. the serviceaccount should have the `viewer role` on the target project, as well as a custom role containing the "storage.buckets.getIamPolicy" and "bigquery.tables.list" permissions
5. the pool provider should allow access to Sysdig's trusted identity, retrieved through
4. the serviceaccount should have the `viewer role` on the target project, as well as a custom role containing the "storage.buckets.getIamPolicy", "bigquery.tables.list", "cloudasset.assets.listIamPolicy" and "cloudasset.assets.listResource" permissions
5. the pool provider should allow access to Sysdig's trusted identity, retrieved through
```
$ curl https://<SYSDIG_SECURE_URL>/api/cloud/v2/gcp/trustedIdentity \
--header 'Authorization: Bearer <SYSDIG_SECURE_API_TOKEN>'
Expand Down
2 changes: 1 addition & 1 deletion examples/organization/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,7 +106,7 @@ module "secure-for-cloud_example_organization" {

| Name | Version |
|------|---------|
| <a name="provider_google"></a> [google](#provider\_google) | 4.30.0 |
| <a name="provider_google"></a> [google](#provider\_google) | 4.31.0 |
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.39 |

## Modules
Expand Down
2 changes: 1 addition & 1 deletion examples/single-project-k8s/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,7 @@ See [inputs summary](#inputs) or module module [`variables.tf`](./variables.tf)

| Name | Version |
|------|---------|
| <a name="provider_google"></a> [google](#provider\_google) | 4.30.0 |
| <a name="provider_google"></a> [google](#provider\_google) | 4.31.0 |
| <a name="provider_helm"></a> [helm](#provider\_helm) | 2.6.0 |
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.39 |

Expand Down
2 changes: 1 addition & 1 deletion examples/single-project/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@ module "secure-for-cloud_example_single-project" {

| Name | Version |
|------|---------|
| <a name="provider_google"></a> [google](#provider\_google) | 4.30.0 |
| <a name="provider_google"></a> [google](#provider\_google) | 4.31.0 |
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.39 |

## Modules
Expand Down
2 changes: 1 addition & 1 deletion examples/trigger-events/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ module "secure-for-cloud_trigger_events" {

| Name | Version |
|------|---------|
| <a name="provider_google"></a> [google](#provider\_google) | 4.30.0 |
| <a name="provider_google"></a> [google](#provider\_google) | 4.31.0 |

## Modules

Expand Down
2 changes: 1 addition & 1 deletion modules/infrastructure/organization_sink/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@

| Name | Version |
|------|---------|
| <a name="provider_google"></a> [google](#provider\_google) | 4.30.0 |
| <a name="provider_google"></a> [google](#provider\_google) | 4.31.0 |

## Modules

Expand Down
2 changes: 1 addition & 1 deletion modules/infrastructure/project_sink/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@

| Name | Version |
|------|---------|
| <a name="provider_google"></a> [google](#provider\_google) | 4.30.0 |
| <a name="provider_google"></a> [google](#provider\_google) | 4.31.0 |

## Modules

Expand Down
2 changes: 1 addition & 1 deletion modules/infrastructure/pubsub_subscription/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ already exists in the project. It will create the topic if it doesn't exist.

| Name | Version |
|------|---------|
| <a name="provider_google"></a> [google](#provider\_google) | 4.30.0 |
| <a name="provider_google"></a> [google](#provider\_google) | 4.31.0 |

## Modules

Expand Down
2 changes: 1 addition & 1 deletion modules/infrastructure/secrets/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@

| Name | Version |
|------|---------|
| <a name="provider_google"></a> [google](#provider\_google) | 4.30.0 |
| <a name="provider_google"></a> [google](#provider\_google) | 4.31.0 |

## Modules

Expand Down
2 changes: 1 addition & 1 deletion modules/services/cloud-bench/trust_relationship/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ resource "google_project_iam_custom_role" "custom" {
role_id = var.role_name
title = "Sysdig Cloud Benchmark Role"
description = "A Role providing the required permissions for Sysdig Cloud Benchmarks that are not included in roles/viewer"
permissions = ["storage.buckets.getIamPolicy", "bigquery.tables.list"]
permissions = ["storage.buckets.getIamPolicy", "bigquery.tables.list", "cloudasset.assets.listIamPolicy", "cloudasset.assets.listResource"]
}

resource "google_service_account_iam_binding" "sa_pool_binding" {
Expand Down
2 changes: 1 addition & 1 deletion modules/services/cloud-connector/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ module "cloud_connector_gcp" {

| Name | Version |
|------|---------|
| <a name="provider_google"></a> [google](#provider\_google) | 4.30.0 |
| <a name="provider_google"></a> [google](#provider\_google) | 4.31.0 |

## Modules

Expand Down
2 changes: 2 additions & 0 deletions use-cases/no-terraform-org-k8s-threat-compliance.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,6 +180,8 @@ We'll need, **for each project** (`GCP_PROJECT_NUMBER`)
1. Create a **Custom Role** (ex.: 'Sysdig Cloud Benchmark Role') and assign to it following permissions
- `storage.buckets.getIamPolicy`
- `bigquery.tables.list`
- `cloudasset.assets.listIamPolicy`
- `cloudasset.assets.listResource`
- this is required to add some more permissions that are not available in GCP builtin viewer role
2. Create a **Service Account** with the name 'sysdigcloudbench'
- This role must match the `roleName` set when the project was registered with Sydig in step 1 of Compliance - Sysdig Side
Expand Down