Skip to content

Commit 91de463

Browse files
jose-pablo-camachojose-pablo-camacho
authored
SSPROD-51715 - fix(oci): add cspm user in customer tenant to support identity resources (#9)
* fix(oci): add cspm user in customer tenant to support identity resources * fix(oci): add cspm user in customer tenant to support identity resources * fix(oci): add cspm user in customer tenant to support identity resources * fix(oci): add cspm user in customer tenant to support identity resources * fix(oci): add cspm user in customer tenant to support identity resources * fix(oci): add cspm user in customer tenant to support identity resources
1 parent b0af0a9 commit 91de463

File tree

8 files changed

+88
-32
lines changed

8 files changed

+88
-32
lines changed

‎modules/config-posture/README.md

+8-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,12 @@ This module will deploy Config Posture resources in Oracle for a compartment or
44

55
The following resources will be created in each instrumented compartment/tenancy:
66

7-
- An Admit Policy on the target tenant that will allow sysdig tenant to `read` all-resources in the specified
7+
- A User on the target tenant.
8+
- A Group on the target tenant.
9+
- A Group Membership between the User and Group created on the target tenant.
10+
- If customer wants, a private and public RSA key will be generated for the user. Customer can opt to pass files for
11+
public and private keys.
12+
- An Allow Policy on the target tenant that will allow the User to `read` all-resources in the specified
813
compartment/tenancy.
914
- A cloud account component in the Sysdig Backend, associated with the specified compartment/tenant and with the
1015
required metadata to serve the Config Posture functions.
@@ -48,6 +53,8 @@ resource |
4853
| <a name="input_tenancy_ocid"></a> [tenancy\_ocid](#input\_tenancy\_ocid) | (Required) Customer tenant OCID | `string` | n/a | yes |
4954
| <a name="input_compartment_ocid"></a> [compartment\_ocid](#input\_compartment\_ocid) | (Optional) Customer compartment OCID | `string` | `""` | no |
5055
| <a name="input_sysdig_secure_account_id"></a> [sysdig\_secure\_account\_id](#input\_sysdig\_secure\_account\_id) | (Required) ID of the Sysdig Cloud Account to enable Config Posture for (in case of organization, ID of the Sysdig management account) | `string` | n/a | yes |
56+
| <a name="input_private_key_file_path"></a> [private\_key\_file\_path](#input\_private\_key\_file\_path) | (Optional) Path to the private key file | `string` | n/a | no |
57+
| <a name="input_public_key_file_path"></a> [public\_key\_file\_path](#input\_public\_key\_file\_path) | (Optional) Path to the public key file | `string` | n/a | no |
5158

5259
## Outputs
5360

‎modules/config-posture/main.tf

+48-16
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,6 @@
22
# Fetch the data sources
33
#-----------------------------------------------------------------------------------------
44

5-
data "sysdig_secure_trusted_oracle_app" "config_posture" {
6-
name = "config_posture"
7-
}
8-
95
// compartment data to populate policies if onboarding a compartment
106
data "oci_identity_compartment" "compartment" {
117
count = var.compartment_ocid != "" ? 1 : 0
@@ -19,17 +15,51 @@ resource "random_id" "suffix" {
1915
}
2016

2117
#-----------------------------------------------------------------------------------------
22-
# Admit policy to allow Sysdig Tenant to read resources
18+
# Create Group, User and Group Membership
19+
#-----------------------------------------------------------------------------------------
20+
resource "oci_identity_group" "cspm_group" {
21+
name = "SysdigSecureConfigPostureGroup-${random_id.suffix.hex}"
22+
description = "Sysdig Secure CSPM Group"
23+
compartment_id = var.tenancy_ocid
24+
}
25+
26+
resource "oci_identity_user" "cspm_user" {
27+
name = "SysdigSecureConfigPostureUser-${random_id.suffix.hex}"
28+
description = "Sysdig Secure CSPM User"
29+
compartment_id = var.tenancy_ocid
30+
email = var.email
31+
}
32+
33+
resource "oci_identity_user_group_membership" "cspm_user_to_group" {
34+
user_id = oci_identity_user.cspm_user.id
35+
group_id = oci_identity_group.cspm_group.id
36+
}
37+
38+
#-----------------------------------------------------------------------------------------
39+
# Create RSA key for user
40+
#-----------------------------------------------------------------------------------------
41+
42+
resource "tls_private_key" "rsa_key" {
43+
count = var.private_key_file_path == "" && var.public_key_file_path == "" ? 1 : 0
44+
algorithm = "RSA"
45+
rsa_bits = 2048
46+
}
47+
48+
resource "oci_identity_api_key" "cspm_user_api_key" {
49+
user_id = oci_identity_user.cspm_user.id
50+
key_value = (var.public_key_file_path == "" && var.private_key_file_path == "") ? tls_private_key.rsa_key[0].public_key_pem : file(var.public_key_file_path)
51+
}
52+
53+
#-----------------------------------------------------------------------------------------
54+
# Allow policy to allow user to read resources
2355
#-----------------------------------------------------------------------------------------
2456

25-
resource "oci_identity_policy" "admit_cspm_policy" {
26-
name = "AdmitSysdigSecureTenantConfigPosture-${random_id.suffix.hex}"
27-
description = "Config Posture admit policy to read all resources in tenant"
57+
resource "oci_identity_policy" "allow_cspm_policy" {
58+
name = "AllowSysdigSecureTenantConfigPosture-${random_id.suffix.hex}"
59+
description = "Config Posture allow policy to read all resources in tenant"
2860
compartment_id = var.tenancy_ocid
2961
statements = [
30-
"Define tenancy sysdigTenancy as ${data.sysdig_secure_trusted_oracle_app.config_posture.tenancy_ocid}",
31-
"Define group configPostureGroup as ${data.sysdig_secure_trusted_oracle_app.config_posture.group_ocid}",
32-
"Admit group configPostureGroup of tenancy sysdigTenancy to read all-resources in tenancy",
62+
"Allow group ${oci_identity_group.cspm_group.name} to read all-resources in tenancy",
3363
]
3464
}
3565

@@ -44,15 +74,17 @@ resource "sysdig_secure_cloud_auth_account_component" "oracle_service_principal"
4474
service_principal_metadata = jsonencode({
4575
oci = {
4676
api_key = {
47-
user_id = data.sysdig_secure_trusted_oracle_app.config_posture.user_ocid
48-
region = var.region
77+
user_id = oci_identity_user.cspm_user.id
78+
region = var.region
79+
fingerprint = oci_identity_api_key.cspm_user_api_key.fingerprint
80+
private_key = (var.public_key_file_path == "" && var.private_key_file_path == "") ? base64encode(tls_private_key.rsa_key[0].private_key_pem) : base64encode(file(var.private_key_file_path))
4981
}
5082
policy = {
51-
policy_id = oci_identity_policy.admit_cspm_policy.id
83+
policy_id = oci_identity_policy.allow_cspm_policy.id
5284
}
5385
}
5486
})
5587
depends_on = [
56-
oci_identity_policy.admit_cspm_policy
88+
oci_identity_policy.allow_cspm_policy
5789
]
58-
}
90+
}

‎modules/config-posture/variables.tf

+19-1
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,24 @@ variable "sysdig_secure_account_id" {
2121
}
2222

2323
variable "region" {
24-
type = string
24+
type = string
2525
description = "(Required) Customer home region"
26+
}
27+
28+
variable "private_key_file_path" {
29+
description = "Path to the private key file"
30+
type = string
31+
default = ""
32+
}
33+
34+
variable "public_key_file_path" {
35+
description = "Path to the public key file"
36+
type = string
37+
default = ""
38+
}
39+
40+
variable "email" {
41+
description = "Email for user created on customer tenant"
42+
type = string
43+
default = "[email protected]"
2644
}

‎modules/config-posture/versions.tf

+5-2
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,13 @@ terraform {
33
required_providers {
44
sysdig = {
55
source = "sysdiglabs/sysdig"
6-
version = "~> 1.43"
6+
version = "~> 1.46"
77
}
88
oci = {
9-
source = "oracle/oci"
9+
source = "oracle/oci"
10+
}
11+
tls = {
12+
source = "hashicorp/tls"
1013
}
1114
}
1215
}

‎modules/onboarding/main.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
locals {
22
home_region = [
3-
for subscription in data.oci_identity_region_subscriptions.test_region_subscriptions.region_subscriptions :
3+
for subscription in data.oci_identity_region_subscriptions.region_subscriptions.region_subscriptions :
44
subscription.region_name
55
if subscription.is_home_region == true
66
]
@@ -27,7 +27,7 @@ data "oci_identity_tenancy" "tenancy" {
2727
}
2828

2929
// tenancy region data
30-
data "oci_identity_region_subscriptions" "test_region_subscriptions" {
30+
data "oci_identity_region_subscriptions" "region_subscriptions" {
3131
tenancy_id = var.tenancy_ocid
3232
}
3333

‎modules/onboarding/versions.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,10 @@ terraform {
33
required_providers {
44
sysdig = {
55
source = "sysdiglabs/sysdig"
6-
version = "~> 1.43"
6+
version = "~> 1.46"
77
}
88
oci = {
9-
source = "oracle/oci"
9+
source = "oracle/oci"
1010
}
1111
}
1212
}

‎tests/examples/modular_organization/onboarding_cspm_compartment.tf

+2-4
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ terraform {
22
required_providers {
33
sysdig = {
44
source = "sysdiglabs/sysdig"
5-
version = "~> 1.43.0"
5+
version = "~> 1.46.0"
66
}
77
oci = {
88
source = "oracle/oci"
@@ -17,9 +17,7 @@ provider "sysdig" {
1717

1818
provider "oci" {
1919
tenancy_ocid = "<TENANCY_OCID>"
20-
user_ocid = "<USER_OCID>"
21-
fingerprint = "<FINGERPRINT>"
22-
private_key_path = "<PRIVATE_KEY_PATH>"
20+
config_file_profile = "DEFAULT"
2321
region = "<REGION>"
2422
}
2523

‎tests/examples/modular_organization/onboarding_cspm_tenancy.tf

+2-4
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ terraform {
22
required_providers {
33
sysdig = {
44
source = "sysdiglabs/sysdig"
5-
version = "~> 1.43.0"
5+
version = "~> 1.46.0"
66
}
77
oci = {
88
source = "oracle/oci"
@@ -17,9 +17,7 @@ provider "sysdig" {
1717

1818
provider "oci" {
1919
tenancy_ocid = "<TENANCY_OCID>"
20-
user_ocid = "<USER_OCID>"
21-
fingerprint = "<FINGERPRINT>"
22-
private_key_path = "<PRIVATE_KEY_PATH>"
20+
config_file_profile = "DEFAULT"
2321
region = "<REGION>"
2422
}
2523

0 commit comments

Comments
 (0)