Skip to content

Commit 3fb73e7

Browse files
matteopasamatteopasa
committed
add back some comments
1 parent 857285f commit 3fb73e7

File tree

2 files changed

+75
-6
lines changed

2 files changed

+75
-6
lines changed

‎modules/integrations/event-bridge/main.tf‎

Lines changed: 68 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,17 @@
1+
#-----------------------------------------------------------------------------------------------------------------------------------------
2+
# For both Single Account and Organizational installs, resources are created using CloudFormation StackSet.
3+
# For Organizational installs, see organizational.tf.
4+
#
5+
# For single installs, the resources in this file are used to instrument the singleton account, whether it is a management account or a
6+
# member account.
7+
#
8+
# For organizational installs, resources in this file get created for management account only. (because service-managed stacksets do not
9+
# include the management account they are created in, even if this account is within the target Organization).
10+
#-----------------------------------------------------------------------------------------------------------------------------------------
11+
12+
#-----------------------------------------------------------------------------------------
13+
# Fetch the data sources
14+
#-----------------------------------------------------------------------------------------
115
data "aws_caller_identity" "current" {}
216

317
data "sysdig_secure_cloud_ingestion_assets" "assets" {
@@ -21,10 +35,21 @@ locals {
2135
eb_resource_name = "${var.name}-${random_id.suffix.hex}-${local.account_id_hash}"
2236
}
2337

38+
#-----------------------------------------------------------------------------------------------------------------------
39+
# A random resource is used to generate unique Event Bridge name suffix for resources.
40+
# This prevents conflicts when recreating an Event Bridge resources with the same name.
41+
#-----------------------------------------------------------------------------------------------------------------------
2442
resource "random_id" "suffix" {
2543
byte_length = 3
2644
}
2745

46+
#-----------------------------------------------------------------------------------------------------------------------------------------
47+
# Self-managed stacksets require pair of StackSetAdministrationRole & StackSetExecutionRole IAM roles with self-managed permissions.
48+
#
49+
# If auto_create_stackset_roles is true, terraform will create this IAM Admin role in the source account with permissions to create
50+
# stacksets. If false, and values for stackset Admin role ARN is provided stackset will use it, else AWS will look for
51+
# predefined/default AWSCloudFormationStackSetAdministrationRoleForEBApiDest.
52+
#-----------------------------------------------------------------------------------------------------------------------------------------
2853
resource "aws_iam_role" "event_bus_stackset_admin_role" {
2954
count = !var.auto_create_stackset_roles ? 0 : 1
3055

@@ -55,6 +80,13 @@ resource "aws_iam_role_policy_attachments_exclusive" "event_bus_stackset_admin_r
5580
]
5681
}
5782

83+
#-----------------------------------------------------------------------------------------------------------------------------------------
84+
# Self-managed stacksets require pair of StackSetAdministrationRole & StackSetExecutionRole IAM roles with self-managed permissions.
85+
#
86+
# If auto_create_stackset_roles is true, terraform will create this IAM Admin role in the source account with permissions to create
87+
# stacksets, Event Bridge resources and trust relationship to CloudFormation service. If false, and values for stackset Execution role
88+
# name is provided stackset will use it, else AWS will look for predefined/default AWSCloudFormationStackSetExecutionRoleForEBApiDest.
89+
#-----------------------------------------------------------------------------------------------------------------------------------------
5890
resource "aws_iam_role" "event_bus_stackset_execution_role" {
5991
count = !var.auto_create_stackset_roles ? 0 : 1
6092

@@ -87,6 +119,13 @@ resource "aws_iam_role_policy_attachments_exclusive" "event_bus_stackset_executi
87119
]
88120
}
89121

122+
#-----------------------------------------------------------------------------------------------------------------------------------------
123+
# These resources create an IAM role in the source account with permissions to invoke API destinations.
124+
# This role is attached to the EventBridge rule that is created in the source account.
125+
#
126+
# This role will be used by EventBridge when sending events to Sysdig via API Destinations. The EventBridge service is
127+
# given permission to assume this role, and Sysdig's cloud identity is allowed to assume the role for validation purposes.
128+
#-----------------------------------------------------------------------------------------------------------------------------------------
90129
resource "aws_iam_role" "event_bridge_api_destination_role" {
91130
name = local.eb_resource_name
92131
tags = var.tags
@@ -119,6 +158,12 @@ resource "aws_iam_role" "event_bridge_api_destination_role" {
119158
EOF
120159
}
121160

161+
#-----------------------------------------------------------------------------------------------------------------------------------------
162+
# This policy grants the necessary permissions for the API destination role:
163+
# 1. InvokeApiDestination - Allows invoking the API destination to send events to Sysdig
164+
# 2. EventRuleAndDestinationAccess - Allows describing rules, targets, API destinations, and connections for validation
165+
# 3. CloudWatchMetricsAccess - Allows retrieving metrics for monitoring and validation
166+
#-----------------------------------------------------------------------------------------------------------------------------------------
122167
resource "aws_iam_role_policy" "event_bridge_api_destination_policy" {
123168
name = local.eb_resource_name
124169
role = aws_iam_role.event_bridge_api_destination_role.id
@@ -135,21 +180,23 @@ resource "aws_iam_role_policy" "event_bridge_api_destination_policy" {
135180
]
136181
},
137182
{
138-
Sid = "CloudTrailEventRuleAccess"
183+
Sid = "EventRuleAndDestinationAccess"
139184
Action = [
140185
"events:DescribeRule",
141186
"events:ListTargetsByRule",
187+
"events:DescribeApiDestination",
188+
"events:DescribeConnection"
142189
]
143190
Effect = "Allow"
144191
Resource = [
145192
"${local.arn_prefix}:events:*:*:rule/${local.eb_resource_name}",
193+
"${local.arn_prefix}:events:*:*:api-destination/${local.eb_resource_name}-destination",
194+
"${local.arn_prefix}:events:*:*:connection/${local.eb_resource_name}-connection"
146195
]
147196
},
148197
{
149-
Sid = "ValidationAccess"
198+
Sid = "CloudWatchMetricsAccess"
150199
Action = [
151-
"events:DescribeApiDestination",
152-
"events:DescribeConnection",
153200
"cloudwatch:GetMetricStatistics"
154201
]
155202
Effect = "Allow"
@@ -159,6 +206,17 @@ resource "aws_iam_role_policy" "event_bridge_api_destination_policy" {
159206
})
160207
}
161208

209+
#-----------------------------------------------------------------------------------------------------------------------------------------
210+
# This resource creates a stackset to set up an EventBridge Rule and API Destination to forward CloudTrail events from the
211+
# source account to Sysdig. CloudTrail events are sent to the default EventBridge Bus in the source account automatically.
212+
#
213+
# The stackset creates three resources in each region:
214+
# 1. API Connection - Authenticates with Sysdig's endpoint using an API key
215+
# 2. API Destination - Forwards events to Sysdig's webhook ingestion endpoint
216+
# 3. EventBridge Rule - Captures events matching the specified pattern and targets the API destination
217+
#
218+
# Note: self-managed stacksets require pair of StackSetAdministrationRole & StackSetExecutionRole IAM roles with self-managed permissions
219+
#-----------------------------------------------------------------------------------------------------------------------------------------
162220
resource "aws_cloudformation_stack_set" "eb_rule_and_api_dest_stackset" {
163221
name = join("-", [local.eb_resource_name, "EBRuleAndApiDestination"])
164222
tags = var.tags
@@ -211,6 +269,12 @@ resource "aws_cloudformation_stack_set_instance" "eb_rule_and_api_dest_stackset_
211269
}
212270
}
213271

272+
#-----------------------------------------------------------------------------------------------------------------------------------------
273+
# Call Sysdig Backend to add the event-bridge integration to the Sysdig Cloud Account
274+
#
275+
# Note (optional): To ensure this gets called after all cloud resources are created, add
276+
# explicit dependency using depends_on
277+
#-----------------------------------------------------------------------------------------------------------------------------------------
214278
resource "sysdig_secure_cloud_auth_account_component" "aws_event_bridge" {
215279
account_id = var.sysdig_secure_account_id
216280
type = local.component_type

‎modules/integrations/event-bridge/organizational.tf‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
#-----------------------------------------------------------------------------------------------------------------------
2+
# These resources set up an EventBridge Rule and Target to forward all CloudTrail events from the source account to
3+
# Sysdig in all accounts in an AWS Organization via service-managed CloudFormation StackSets.
4+
# For a single account installation, see main.tf.
5+
#-----------------------------------------------------------------------------------------------------------------------
16
resource "aws_cloudformation_stack_set" "eb_rule_api_dest_stackset" {
27
count = var.is_organizational ? 1 : 0
38

@@ -65,7 +70,7 @@ resource "aws_cloudformation_stack_set_instance" "eb_rule_api_dest_instance" {
6570

6671
stack_set_name = aws_cloudformation_stack_set.eb_rule_api_dest_stackset[0].name
6772
deployment_targets {
68-
organizational_unit_ids = local.deployment_targets_ous.org_units_to_deploy
73+
organizational_unit_ids = local.deployment_targets_org_units
6974
accounts = local.check_old_ouid_param ? null : (local.deployment_targets_accounts_filter == "NONE" ? null : local.deployment_targets_accounts.accounts_to_deploy)
7075
account_filter_type = local.check_old_ouid_param ? null : local.deployment_targets_accounts_filter
7176
}
@@ -88,7 +93,7 @@ resource "aws_cloudformation_stack_set_instance" "eb_role_stackset_instance" {
8893

8994
stack_set_name = aws_cloudformation_stack_set.eb_role_stackset[0].name
9095
deployment_targets {
91-
organizational_unit_ids = local.deployment_targets_ous.org_units_to_deploy
96+
organizational_unit_ids = local.deployment_targets_org_units
9297
accounts = local.check_old_ouid_param ? null : (local.deployment_targets_accounts_filter == "NONE" ? null : local.deployment_targets_accounts.accounts_to_deploy)
9398
account_filter_type = local.check_old_ouid_param ? null : local.deployment_targets_accounts_filter
9499
}

0 commit comments

Comments
 (0)