Skip to content

Commit f3be96e

Browse files
jameslarreajameslarrea
authored
delegated admin account (#78)
* delegated admin account * renamed variable * cleaned up stackset deployment logic * minor readme correction * formatting fixes
1 parent 662ad72 commit f3be96e

File tree

13 files changed

+78
-14
lines changed

13 files changed

+78
-14
lines changed

‎modules/services/agentless-scanning/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ No modules.
6565
| <a name="input_stackset_admin_role_arn"></a> [stackset\_admin\_role\_arn](#input\_stackset\_admin\_role\_arn) | (Optional) stackset admin role to run SELF\_MANAGED stackset | `string` | `""` | no |
6666
| <a name="input_tags"></a> [tags](#input\_tags) | sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning | `map(string)` | <pre>{<br> "product": "sysdig-secure-for-cloud"<br>}</pre> | no |
6767
| <a name="input_timeout"></a> [timeout](#input\_timeout) | Default timeout values for create, update, and delete operations | `string` | `"30m"` | no |
68+
| <a name="delegated_admin"></a> [delegated_admin](#input\_delegated\_admin) | Whether to create the resources using an delegated admin account | `bool` | `false` | no |
6869

6970
## Outputs
7071

‎modules/services/agentless-scanning/locals.tf

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,12 @@ locals {
88
account_id = data.aws_caller_identity.current.account_id
99
caller_arn = data.aws_iam_session_context.current.issuer_arn
1010
}
11+
12+
#-----------------------------------------------------------------------------------------------------------------------
13+
# Dertermine whether to deploy self-managed stacksets in the management account.
14+
# This might be disabled if using a delegated admin account or to avoid creating a stackset admin and execution role
15+
# in the management account.
16+
#-----------------------------------------------------------------------------------------------------------------------
17+
locals {
18+
deploy_stackset = var.mgt_stackset && !var.delegated_admin
19+
}

‎modules/services/agentless-scanning/main.tf

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
#-----------------------------------------------------------------------------------------------------------------------
2121

2222
data "aws_iam_policy_document" "scanning" {
23-
count = (var.deploy_global_resources || var.is_organizational && var.mgt_stackset) ? 1 : 0
23+
count = (var.deploy_global_resources || (var.is_organizational && local.deploy_stackset)) ? 1 : 0
2424

2525
# General read permission, necessary for the discovery phase.
2626
statement {
@@ -184,7 +184,7 @@ data "aws_iam_policy_document" "scanning" {
184184
}
185185

186186
resource "aws_iam_policy" "scanning" {
187-
count = (var.deploy_global_resources || var.is_organizational && var.mgt_stackset) ? 1 : 0
187+
count = (var.deploy_global_resources || (var.is_organizational && local.deploy_stackset)) ? 1 : 0
188188

189189
name = var.name
190190
description = "Grants Sysdig Secure access to volumes and snapshots"
@@ -193,7 +193,7 @@ resource "aws_iam_policy" "scanning" {
193193
}
194194

195195
data "aws_iam_policy_document" "scanning_assume_role_policy" {
196-
count = (var.deploy_global_resources || var.is_organizational && var.mgt_stackset) ? 1 : 0
196+
count = (var.deploy_global_resources || (var.is_organizational && local.deploy_stackset)) ? 1 : 0
197197

198198
statement {
199199
sid = "SysdigSecureScanning"
@@ -218,15 +218,15 @@ data "aws_iam_policy_document" "scanning_assume_role_policy" {
218218
}
219219

220220
resource "aws_iam_role" "scanning" {
221-
count = (var.deploy_global_resources || var.is_organizational && var.mgt_stackset) ? 1 : 0
221+
count = (var.deploy_global_resources || (var.is_organizational && local.deploy_stackset)) ? 1 : 0
222222

223223
name = var.name
224224
tags = var.tags
225225
assume_role_policy = data.aws_iam_policy_document.scanning_assume_role_policy[0].json
226226
}
227227

228228
resource "aws_iam_policy_attachment" "scanning" {
229-
count = (var.deploy_global_resources || var.is_organizational && var.mgt_stackset) ? 1 : 0
229+
count = (var.deploy_global_resources || (var.is_organizational && local.deploy_stackset)) ? 1 : 0
230230

231231
name = var.name
232232
roles = [aws_iam_role.scanning[0].name]

‎modules/services/agentless-scanning/organizational.tf

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,8 @@ resource "aws_cloudformation_stack_set" "scanning_role_stackset" {
4747
ignore_changes = [administration_role_arn]
4848
}
4949

50+
call_as = var.delegated_admin ? "DELEGATED_ADMIN" : "SELF"
51+
5052
template_body = <<TEMPLATE
5153
Resources:
5254
AgentlessScanningRole:
@@ -144,6 +146,8 @@ resource "aws_cloudformation_stack_set_instance" "scanning_role_stackset_instanc
144146
# Roles are not regional and hence do not need regional parallelism
145147
}
146148

149+
call_as = var.delegated_admin ? "DELEGATED_ADMIN" : "SELF"
150+
147151
timeouts {
148152
create = var.timeout
149153
update = var.timeout
@@ -159,7 +163,7 @@ resource "aws_cloudformation_stack_set_instance" "scanning_role_stackset_instanc
159163

160164
# stackset to deploy resources for agentless scanning in management account
161165
resource "aws_cloudformation_stack_set" "mgmt_acc_resources_stackset" {
162-
count = var.is_organizational && var.mgt_stackset ? 1 : 0
166+
count = var.is_organizational && local.deploy_stackset ? 1 : 0
163167
depends_on = [aws_iam_role.scanning]
164168

165169
name = join("-", [var.name, "ScanningKmsMgmtAcc"])
@@ -217,7 +221,7 @@ TEMPLATE
217221

218222
# stackset instance to deploy resources for agentless scanning, in all regions of the management account
219223
resource "aws_cloudformation_stack_set_instance" "mgmt_acc_stackset_instance" {
220-
for_each = var.mgt_stackset ? local.region_set : toset([])
224+
for_each = local.deploy_stackset ? local.region_set : toset([])
221225
region = each.key
222226

223227
stack_set_name = aws_cloudformation_stack_set.mgmt_acc_resources_stackset[0].name
@@ -263,6 +267,8 @@ resource "aws_cloudformation_stack_set" "ou_resources_stackset" {
263267
ignore_changes = [administration_role_arn]
264268
}
265269

270+
call_as = var.delegated_admin ? "DELEGATED_ADMIN" : "SELF"
271+
266272
template_body = <<TEMPLATE
267273
Resources:
268274
AgentlessScanningKmsPrimaryKey:
@@ -320,6 +326,8 @@ resource "aws_cloudformation_stack_set_instance" "ou_stackset_instance" {
320326
region_concurrency_type = "PARALLEL"
321327
}
322328

329+
call_as = var.delegated_admin ? "DELEGATED_ADMIN" : "SELF"
330+
323331
timeouts {
324332
create = var.timeout
325333
update = var.timeout

‎modules/services/agentless-scanning/variables.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,3 +86,10 @@ variable "failure_tolerance_percentage" {
8686
description = "The percentage of accounts, per Region, for which stack operations can fail before AWS CloudFormation stops the operation in that Region"
8787
default = 90
8888
}
89+
90+
91+
variable "delegated_admin" {
92+
description = "Whether a delegated admin account will be used"
93+
type = bool
94+
default = false
95+
}

‎modules/services/event-bridge/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ No modules.
6464
| <a name="input_stackset_admin_role_arn"></a> [stackset\_admin\_role\_arn](#input\_stackset\_admin\_role\_arn) | (Optional) stackset admin role to run SELF\_MANAGED stackset | `string` | `""` | no |
6565
| <a name="input_tags"></a> [tags](#input\_tags) | (Optional) Tags to be attached to all Sysdig resources. | `map(string)` | <pre>{<br> "product": "sysdig"<br>}</pre> | no |
6666
| <a name="input_timeout"></a> [timeout](#input\_timeout) | Default timeout values for create, update, and delete operations | `string` | `"30m"` | no |
67+
| <a name="delegated_admin"></a> [delegated_admin](#input\_delegated\_admin) | Whether to create the resources using an delegated admin account | `bool` | `false` | no |
6768

6869
## Outputs
6970

‎modules/services/event-bridge/main.tf

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,16 @@
1212
locals {
1313
is_role_empty = length(var.role_arn) == 0
1414
}
15+
16+
#-----------------------------------------------------------------------------------------------------------------------
17+
# Dertermine whether to deploy self-managed stacksets in the management account.
18+
# This might be disabled if using a delegated admin account or to avoid creating a stackset admin and execution role
19+
# in the management account.
20+
#-----------------------------------------------------------------------------------------------------------------------
21+
locals {
22+
deploy_stackset = var.mgt_stackset && !var.delegated_admin
23+
}
24+
1525
#-----------------------------------------------------------------------------------------------------------------------
1626
# Determine if this is an Organizational install, or a single account install. For Single Account installs, resources
1727
# are created directly using the AWS Terraform Provider (This is the default behaviour). For Organizational installs,
@@ -56,10 +66,9 @@ resource "aws_cloudwatch_event_target" "sysdig" {
5666
# Role that will be used by EventBridge when sending events to Sysdig's EventBridge Bus. The EventBridge service is
5767
# given permission to assume this role.
5868
resource "aws_iam_role" "event_bus_invoke_remote_event_bus" {
59-
count = (var.is_organizational && var.mgt_stackset || var.deploy_global_resources) ? 1 : 0
60-
61-
name = var.name
62-
tags = var.tags
69+
count = ((var.is_organizational && local.deploy_stackset) || var.deploy_global_resources) ? 1 : 0
70+
name = var.name
71+
tags = var.tags
6372

6473
assume_role_policy = <<EOF
6574
{

‎modules/services/event-bridge/organizational.tf

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,8 @@ resource "aws_cloudformation_stack_set" "eb-rule-stackset" {
3535
ignore_changes = [administration_role_arn]
3636
}
3737

38+
call_as = var.delegated_admin ? "DELEGATED_ADMIN" : "SELF"
39+
3840
template_body = templatefile("${path.module}/stackset_template_body.tpl", {
3941
name = var.name
4042
event_pattern = var.event_pattern
@@ -45,7 +47,7 @@ resource "aws_cloudformation_stack_set" "eb-rule-stackset" {
4547

4648
# stackset to deploy eventbridge rule in management account
4749
resource "aws_cloudformation_stack_set" "mgmt-stackset" {
48-
count = var.is_organizational && var.mgt_stackset ? 1 : 0
50+
count = var.is_organizational && local.deploy_stackset ? 1 : 0
4951

5052
name = join("-", [var.name, "EBRuleMgmtAcc"])
5153
tags = var.tags
@@ -91,6 +93,8 @@ resource "aws_cloudformation_stack_set" "eb-role-stackset" {
9193
ignore_changes = [administration_role_arn]
9294
}
9395

96+
call_as = var.delegated_admin ? "DELEGATED_ADMIN" : "SELF"
97+
9498
template_body = <<TEMPLATE
9599
Resources:
96100
EventBridgeRole:
@@ -143,6 +147,8 @@ resource "aws_cloudformation_stack_set_instance" "stackset_instance" {
143147
region_concurrency_type = "PARALLEL"
144148
}
145149

150+
call_as = var.delegated_admin ? "DELEGATED_ADMIN" : "SELF"
151+
146152
timeouts {
147153
create = var.timeout
148154
update = var.timeout
@@ -152,7 +158,7 @@ resource "aws_cloudformation_stack_set_instance" "stackset_instance" {
152158

153159
// stackset instance to deploy rule in all regions of management account
154160
resource "aws_cloudformation_stack_set_instance" "mgmt_acc_stackset_instance" {
155-
for_each = var.mgt_stackset ? local.region_set : toset([])
161+
for_each = local.deploy_stackset ? local.region_set : toset([])
156162
region = each.key
157163
stack_set_name = aws_cloudformation_stack_set.mgmt-stackset[0].name
158164

@@ -185,6 +191,8 @@ resource "aws_cloudformation_stack_set_instance" "eb_role_stackset_instance" {
185191
# Roles are not regional and hence do not need regional parallelism
186192
}
187193

194+
call_as = var.delegated_admin ? "DELEGATED_ADMIN" : "SELF"
195+
188196
timeouts {
189197
create = var.timeout
190198
update = var.timeout

‎modules/services/event-bridge/outputs.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
output "role_arn" {
2-
value = local.is_role_empty && var.mgt_stackset ? aws_iam_role.event_bus_invoke_remote_event_bus[0].arn : ""
2+
value = local.is_role_empty && local.deploy_stackset ? aws_iam_role.event_bus_invoke_remote_event_bus[0].arn : ""
3+
34
description = "ARN of cspm role"
45
}

‎modules/services/event-bridge/variables.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,3 +111,10 @@ variable "failure_tolerance_percentage" {
111111
description = "The percentage of accounts, per Region, for which stack operations can fail before AWS CloudFormation stops the operation in that Region"
112112
default = 90
113113
}
114+
115+
116+
variable "delegated_admin" {
117+
description = "Whether a delegated admin account will be used"
118+
type = bool
119+
default = false
120+
}

‎modules/services/trust-relationship/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ No modules.
5151
| <a name="input_role_name"></a> [role\_name](#input\_role\_name) | The name of the IAM Role that will be created. | `string` | `"sysdig-secure"` | no |
5252
| <a name="input_tags"></a> [tags](#input\_tags) | sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning | `map(string)` | <pre>{<br> "product": "sysdig-secure-for-cloud"<br>}</pre> | no |
5353
| <a name="input_timeout"></a> [timeout](#input\_timeout) | Default timeout values for create, update, and delete operations | `string` | `"30m"` | no |
54+
| <a name="delegated_admin"></a> [delegated_admin](#input\_delegated\_admin) | Whether to create the resources using an delegated admin account | `bool` | `false` | no |
5455

5556
## Outputs
5657

‎modules/services/trust-relationship/main.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ locals {
1414
# If this is not an Organizational deploy, create role/polices directly
1515
#----------------------------------------------------------
1616
resource "aws_iam_role" "cspm_role" {
17+
count = var.delegated_admin ? 0 : 1
1718
name = var.role_name
1819
tags = var.tags
1920
assume_role_policy = <<EOF
@@ -145,6 +146,8 @@ resource "aws_cloudformation_stack_set" "stackset" {
145146
ignore_changes = [administration_role_arn]
146147
}
147148

149+
call_as = var.delegated_admin ? "DELEGATED_ADMIN" : "SELF"
150+
148151
template_body = <<TEMPLATE
149152
Resources:
150153
SysdigCSPMRole:
@@ -212,6 +215,8 @@ resource "aws_cloudformation_stack_set_instance" "stackset_instance" {
212215
# Roles are not regional and hence do not need regional parallelism
213216
}
214217

218+
call_as = var.delegated_admin ? "DELEGATED_ADMIN" : "SELF"
219+
215220
timeouts {
216221
create = var.timeout
217222
update = var.timeout

‎modules/services/trust-relationship/variables.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,3 +56,10 @@ variable "failure_tolerance_percentage" {
5656
description = "The percentage of accounts, per Region, for which stack operations can fail before AWS CloudFormation stops the operation in that Region"
5757
default = 90
5858
}
59+
60+
61+
variable "delegated_admin" {
62+
description = "Whether a delegated admin account will be used"
63+
type = bool
64+
default = false
65+
}

0 commit comments

Comments
 (0)