Skip to content

Commit 81c0b1d

Browse files
lorenzo-mericilorenzo-merici
authored
feat(cloudlogs): cross account bucket support (#43)
1 parent 52d09b1 commit 81c0b1d

File tree

7 files changed

+395
-54
lines changed

7 files changed

+395
-54
lines changed

‎modules/integrations/cloud-logs/README.md‎

Lines changed: 51 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,36 @@
33
This Module creates the resources required to send CloudTrail logs to Sysdig by enabling access to the CloudTrail
44
associated s3 bucket through a dedicated IAM role.
55

6-
The following resources will be created in each instrumented account:
6+
The following resources will be created based on the deployment scenario:
77

8-
- An IAM Role and associated policies that gives the ingestion component in Sysdig's account permission to list and
9-
retrieve items from it.
8+
1. For single-account deployments:
9+
- An IAM Role in the account with permissions to access the S3 bucket directly
10+
- SNS Topic and Subscription for CloudTrail notifications
1011

11-
If instrumenting an AWS Gov account/organization, resources will be created in `aws-us-gov` region.
12+
2. For organizational deployments (same account):
13+
- An IAM Role in the management account with permissions to access the S3 bucket directly
14+
- SNS Topic and Subscription for CloudTrail notifications
15+
16+
3. For organizational cross-account deployments:
17+
- A CloudFormation StackSet that deploys an IAM role directly in the bucket account
18+
- The role in the bucket account allows Sysdig to access S3 data directly
19+
- SNS Topic and Subscription for CloudTrail notifications
20+
21+
Additional features include:
22+
- Support for KMS-encrypted S3 buckets by granting the necessary KMS decryption permissions
23+
- Support for AWS GovCloud deployments
24+
25+
## Important Notes for Cross-Account Access
26+
27+
When using this module with organizational cross-account access (where CloudTrail bucket is in a different AWS account), the module automatically deploys a StackSet to configure the role in the bucket account.
28+
The StackSet deployment requires appropriate permissions in the organization. The deploying account must have permission to create and manage StackSets in the organization.
29+
30+
### Working with KMS-encrypted S3 buckets
31+
32+
For KMS-encrypted S3 buckets, this module configures the necessary decrypt permissions on the IAM role. When using KMS encryption:
33+
1. Provide the KMS key ARN using the `kms_key_arn` variable
34+
2. For cross-account scenarios, specify the bucket account ID using the `bucket_account_id` variable
35+
3. Ensure the KMS key policy allows the created role to use the decrypt operation
1236

1337
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
1438

@@ -18,14 +42,16 @@ If instrumenting an AWS Gov account/organization, resources will be created in `
1842
|---------------------------------------------------------------------------|-----------|
1943
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
2044
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.60.0 |
21-
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | ~>1.48 |
45+
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | ~>1.52 |
2246
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 3.1 |
2347

2448
## Providers
2549

26-
| Name | Version |
27-
|---------------------------------------------------|-----------|
28-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.60.0 |
50+
| Name | Version |
51+
|-------------------------------------------------------------|-----------|
52+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.60.0 |
53+
| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | ~>1.52 |
54+
| <a name="provider_random"></a> [random](#provider\_random) | >= 3.1 |
2955

3056
## Modules
3157

@@ -38,29 +64,43 @@ No modules.
3864
| [random_id.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
3965
| [aws_iam_role.cloudlogs_s3_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
4066
| [aws_iam_role_policy.cloudlogs_s3_access_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
67+
| [aws_sns_topic.cloudtrail_notifications](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic) | resource |
68+
| [aws_sns_topic_policy.cloudtrail_notifications](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_policy) | resource |
69+
| [aws_sns_topic_subscription.cloudtrail_notifications](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_subscription) | resource |
70+
| [aws_cloudformation_stack_set.cloudlogs_s3_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudformation_stack_set) | resource |
71+
| [aws_cloudformation_stack_set_instance.cloudlogs_s3_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudformation_stack_set_instance) | resource |
4172
| [aws_iam_policy_document.assume_cloudlogs_s3_access_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
4273
| [aws_iam_policy_document.cloudlogs_s3_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
4374
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
75+
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
4476
| [sysdig_secure_trusted_cloud_identity.trusted_identity](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_trusted_cloud_identity) | data source |
4577
| [sysdig_secure_tenant_external_id.external_id](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_tenant_external_id) | data source |
78+
| [sysdig_secure_cloud_ingestion_assets.assets](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/data-sources/secure_cloud_ingestion_assets) | data source |
4679
| [sysdig_secure_cloud_auth_account_component.aws_cloud_logs](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/resources/secure_cloud_auth_account_component) | resource |
4780

4881
## Inputs
4982

5083
| Name | Description | Type | Default | Required |
5184
|------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|---------------|-------------------------------------------------------------|:--------:|
5285
| <a name="input_sysdig_secure_account_id"></a> [sysdig\_secure\_account\_id](#input\_sysdig\_secure\_account\_id) | (Required) ID of the Sysdig Cloud Account to enable Cloud Logs integration for (in case of organization, ID of the Sysdig management account) | `string` | n/a | yes |
53-
| <a name="input_folder_arn"></a> [folder\_arn](#input\_folder\_arn) | (Required) The ARN of your CloudTrail Bucket Folder | `string` | n/a | yes |
54-
| <a name="input_tags"></a> [tags](#input\_tags) | (Optional) Name to be assigned to all child resources. A suffix may be added internally when required. | `map(string)` | <pre>{<br> "product": "sysdig-secure-for-cloud"<br>}</pre> | no |
55-
| <a name="input_name"></a> [name](#input\_name) | (Optional) Sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning | `string` | sysdig-secure-cloudlogs | no |
86+
| <a name="input_bucket_arn"></a> [bucket\_arn](#input\_bucket\_arn) | (Required) The ARN of your CloudTrail Bucket | `string` | n/a | yes |
87+
| <a name="input_topic_arn"></a> [topic\_arn](#input\_topic\_arn) | SNS Topic ARN that will forward CloudTrail notifications to Sysdig Secure | `string` | n/a | yes |
88+
| <a name="input_create_topic"></a> [create\_topic](#input\_create\_topic) | true/false whether terraform should create the SNS Topic | `bool` | `false` | no |
89+
| <a name="input_kms_key_arn"></a> [kms\_key\_arn](#input\_kms\_key\_arn) | (Optional) ARN of the KMS key used to encrypt the S3 bucket. If provided, the IAM role will be granted permissions to decrypt using this key. | `string` | `null` | no |
90+
| <a name="input_bucket_account_id"></a> [bucket\_account\_id](#input\_bucket\_account\_id) | (Optional) AWS Account ID that owns the S3 bucket, if different from the account where the module is being applied. Required for cross-account organizational deployments. | `string` | `null` | no |
91+
| <a name="input_tags"></a> [tags](#input\_tags) | (Optional) Sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning | `map(string)` | <pre>{<br> "product": "sysdig-secure-for-cloud"<br>}</pre> | no |
92+
| <a name="input_name"></a> [name](#input\_name) | (Optional) Name to be assigned to all child resources. A suffix may be added internally when required. | `string` | sysdig-secure-cloudlogs | no |
5693
| <a name="input_regions"></a> [regions](#input\_regions) | (Optional) The list of AWS regions we want to scrape data from | `set(string)` | `[]` | no |
5794
| <a name="input_is_gov_cloud_onboarding"></a> [is\_gov\_cloud](#input\_is\_gov\_cloud\_onboarding) | true/false whether secure-for-cloud should be deployed in a govcloud account/org or not | `bool` | `false` | no |
95+
| <a name="input_org_units"></a> [org\_units](#input\_org\_units) | (Optional) List of AWS Organizations organizational unit (OU) IDs in which to create the StackSet instances. Required for cross-account organizational deployments. | `list(string)` | `[]` | no |
96+
| <a name="input_timeout"></a> [timeout](#input\_timeout) | (Optional) The timeout for StackSet operations | `string` | `"30m"` | no |
5897

5998
## Outputs
6099

61100
| Name | Description |
62101
|-----------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------|
63102
| <a name="output_cloud_logs_component_id"></a> [cloud\_logs\_component\_id](#output\_cloud\_logs\_component\_id) | Component identifier of Cloud Logs integration created in Sysdig Backend for Log Ingestion |
103+
| <a name="output_kms_policy_instructions"></a> [kms\_policy\_instructions](#output\_kms\_policy\_instructions) | Instructions for updating KMS key policy when KMS encryption is enabled |
64104

65105
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
66106

0 commit comments

Comments
 (0)