Add migration support for Orgs and bump sysdig versions

modules/agentless-scanning/locals.tf

@@ -7,11 +7,34 @@ data "aws_organizations_organization" "org" {
 }
 
 locals {
+  # check if both old and new org parameters are used, fail early
+  check_org_configuration_params = var.is_organizational && length(var.organizational_unit_ids) > 0 && (
+  length(var.include_ouids) > 0 ||
+  length(var.exclude_ouids) > 0 ||
+  length(var.include_accounts) > 0 ||
+  length(var.exclude_accounts) > 0
+  )
+
+  # check if old org units parameter is used
+  check_old_ouid_param = var.is_organizational && length(var.organizational_unit_ids) > 0 && (
+  length(var.include_ouids) == 0 &&
+  length(var.exclude_ouids) == 0 &&
+  length(var.include_accounts) == 0 &&
+  length(var.exclude_accounts) == 0
+  )
+
   # fetch the AWS Root OU under org
   # As per https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html#organization-structure, there can be only one root
   root_org_unit = var.is_organizational ? [for root in data.aws_organizations_organization.org[0].roots : root.id] : []
 }
 
+check "validate_org_configuration_params" {
+  assert {
+    condition     = !local.check_org_configuration_params
+    error_message = "Error: If organizational_unit_ids is populated which is going to be DEPRECATED, variables include_ouids/exclude_ouids/include_accounts/exclude_accounts can not be populated. Please use only one of the two methods."
+  }
+}
+
 # *****************************************************************************************************************************************************
 # INCLUDE/EXCLUDE CONFIGURATION SUPPORT
 #
@@ -37,29 +60,37 @@ locals {
 locals {
   # OU CONFIGURATION (determine user provided org configuration)
   org_configuration = (
-    # case1 - if no include/exclude ous provided, include entire org
-    var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) == 0 ? (
-      "entire_org"
+    # case1 - if old method is used where ONLY organizational_unit_ids is provided, use those
+    local.check_old_ouid_param ? (
+      "old_ouid_param"
     ) : (
-      # case2 - if only included ouids provided, include those ous only
-      var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) == 0 ? (
-        "included_ous_only"
+      # case2 - if no include/exclude ous provided, include entire org
+      var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) == 0 ? (
+        "entire_org"
       ) : (
-        # case3 - if only excluded ouids provided, exclude their accounts from rest of org
-        var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) > 0 ? (
-          "excluded_ous_only"
+        # case3 - if only included ouids provided, include those ous only
+        var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) == 0 ? (
+          "included_ous_only"
         ) : (
-          # case4 - if both include and exclude ouids are provided, includes override excludes
-          var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) > 0 ? (
-            "mixed_ous"
-          ) : ""
+          # case4 - if only excluded ouids provided, exclude their accounts from rest of org
+          var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) > 0 ? (
+            "excluded_ous_only"
+          ) : (
+            # case5 - if both include and exclude ouids are provided, includes override excludes
+            var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) > 0 ? (
+              "mixed_ous"
+            ) : ""
+          )
         )
       )
     )
   )
 
   # switch cases for various user provided org configuration to be onboarded
   deployment_options = {
+    old_ouid_param = {
+      org_units_to_deploy = var.organizational_unit_ids
+    }
     entire_org = {
        org_units_to_deploy = local.root_org_unit
     }
@@ -96,18 +127,23 @@ data "aws_organizations_organizational_unit_descendant_accounts" "ou_accounts_to
 locals {
   # ACCOUNTS CONFIGURATION (determine user provided accounts configuration)
   accounts_configuration = (
-    # case1 - if only included accounts provided, include those accts as well
-    var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) == 0 ? (
-      "UNION"
+    # case1 - if old method is used where ONLY organizational_unit_ids is provided, this configuration is a noop
+    local.check_old_ouid_param ? (
+      "NONE"
     ) : (
-      # case2 - if only excluded accounts or only excluded ouids provided, exclude those accounts
-      var.is_organizational && length(var.include_accounts) == 0 && ( length(var.exclude_accounts) > 0 || local.org_configuration == "excluded_ous_only" ) ? (
-        "DIFFERENCE"
+      # case2 - if only included accounts provided, include those accts as well
+      var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) == 0 ? (
+        "UNION"
       ) : (
-        # case3 - if both include and exclude accounts are provided, includes override excludes
-        var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) > 0 ? (
-          "MIXED"
-        ) : ""
+        # case3 - if only excluded accounts or only excluded ouids provided, exclude those accounts
+        var.is_organizational && length(var.include_accounts) == 0 && ( length(var.exclude_accounts) > 0 || local.org_configuration == "excluded_ous_only" ) ? (
+          "DIFFERENCE"
+        ) : (
+          # case4 - if both include and exclude accounts are provided, includes override excludes
+          var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) > 0 ? (
+            "MIXED"
+          ) : ""
+        )
       )
     )
   )
@@ -117,6 +153,10 @@ locals {
 
   # switch cases for various user provided accounts configuration to be onboarded
   deployment_account_options = {
+    NONE = {
+      accounts_to_deploy = []
+      account_filter_type = "NONE"
+    }
     UNION = {
       accounts_to_deploy = var.include_accounts
       account_filter_type = "UNION"

modules/agentless-scanning/variables.tf

@@ -32,7 +32,7 @@ variable "is_organizational" {
 
 variable "org_units" {
   description = <<-EOF
-    DEPRECATED: Defaults to `[]`, use `include_ouids` instead.
+    TO BE DEPRECATED: Defaults to `[]`, use `include_ouids` instead.
     When set, list of Organization Unit IDs to setup Agentless Scanning. By default, Agentless Scanning will be setup in all accounts within the Organization."
     EOF
   type        = set(string)

modules/config-posture/README.md

@@ -19,7 +19,7 @@ If instrumenting an AWS Gov account/organization, IAM policies and resources wil
 |---------------------------------------------------------------------------|-----------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0  |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws)                   | >= 5.60.0 |
-| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig)          | ~>1.48    |
+| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig)          | ~>1.51    |
 
 ## Providers
 

modules/config-posture/locals.tf

@@ -7,11 +7,34 @@ data "aws_organizations_organization" "org" {
 }
 
 locals {
+  # check if both old and new org parameters are used, fail early
+  check_org_configuration_params = var.is_organizational && length(var.organizational_unit_ids) > 0 && (
+  length(var.include_ouids) > 0 ||
+  length(var.exclude_ouids) > 0 ||
+  length(var.include_accounts) > 0 ||
+  length(var.exclude_accounts) > 0
+  )
+
+  # check if old org units parameter is used
+  check_old_ouid_param = var.is_organizational && length(var.organizational_unit_ids) > 0 && (
+  length(var.include_ouids) == 0 &&
+  length(var.exclude_ouids) == 0 &&
+  length(var.include_accounts) == 0 &&
+  length(var.exclude_accounts) == 0
+  )
+
   # fetch the AWS Root OU under org
   # As per https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html#organization-structure, there can be only one root
   root_org_unit = var.is_organizational ? [for root in data.aws_organizations_organization.org[0].roots : root.id] : []
 }
 
+check "validate_org_configuration_params" {
+  assert {
+    condition     = !local.check_org_configuration_params
+    error_message = "Error: If organizational_unit_ids is populated which is going to be DEPRECATED, variables include_ouids/exclude_ouids/include_accounts/exclude_accounts can not be populated. Please use only one of the two methods."
+  }
+}
+
 # *****************************************************************************************************************************************************
 # INCLUDE/EXCLUDE CONFIGURATION SUPPORT
 #
@@ -37,29 +60,37 @@ locals {
 locals {
   # OU CONFIGURATION (determine user provided org configuration)
   org_configuration = (
-    # case1 - if no include/exclude ous provided, include entire org
-    var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) == 0 ? (
-      "entire_org"
+    # case1 - if old method is used where ONLY organizational_unit_ids is provided, use those
+    local.check_old_ouid_param ? (
+      "old_ouid_param"
     ) : (
-      # case2 - if only included ouids provided, include those ous only
-      var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) == 0 ? (
-        "included_ous_only"
+      # case2 - if no include/exclude ous provided, include entire org
+      var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) == 0 ? (
+        "entire_org"
       ) : (
-        # case3 - if only excluded ouids provided, exclude their accounts from rest of org
-        var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) > 0 ? (
-          "excluded_ous_only"
+        # case3 - if only included ouids provided, include those ous only
+        var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) == 0 ? (
+          "included_ous_only"
         ) : (
-          # case4 - if both include and exclude ouids are provided, includes override excludes
-          var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) > 0 ? (
-            "mixed_ous"
-          ) : ""
+          # case4 - if only excluded ouids provided, exclude their accounts from rest of org
+          var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) > 0 ? (
+            "excluded_ous_only"
+          ) : (
+            # case5 - if both include and exclude ouids are provided, includes override excludes
+            var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) > 0 ? (
+              "mixed_ous"
+            ) : ""
+          )
         )
       )
     )
   )
 
   # switch cases for various user provided org configuration to be onboarded
   deployment_options = {
+    old_ouid_param = {
+      org_units_to_deploy = var.organizational_unit_ids
+    }
     entire_org = {
        org_units_to_deploy = local.root_org_unit
     }
@@ -96,18 +127,23 @@ data "aws_organizations_organizational_unit_descendant_accounts" "ou_accounts_to
 locals {
   # ACCOUNTS CONFIGURATION (determine user provided accounts configuration)
   accounts_configuration = (
-    # case1 - if only included accounts provided, include those accts as well
-    var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) == 0 ? (
-      "UNION"
+    # case1 - if old method is used where ONLY organizational_unit_ids is provided, this configuration is a noop
+    local.check_old_ouid_param ? (
+      "NONE"
     ) : (
-      # case2 - if only excluded accounts or only excluded ouids provided, exclude those accounts
-      var.is_organizational && length(var.include_accounts) == 0 && ( length(var.exclude_accounts) > 0 || local.org_configuration == "excluded_ous_only" ) ? (
-        "DIFFERENCE"
+      # case2 - if only included accounts provided, include those accts as well
+      var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) == 0 ? (
+        "UNION"
       ) : (
-        # case3 - if both include and exclude accounts are provided, includes override excludes
-        var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) > 0 ? (
-          "MIXED"
-        ) : ""
+        # case3 - if only excluded accounts or only excluded ouids provided, exclude those accounts
+        var.is_organizational && length(var.include_accounts) == 0 && ( length(var.exclude_accounts) > 0 || local.org_configuration == "excluded_ous_only" ) ? (
+          "DIFFERENCE"
+        ) : (
+          # case4 - if both include and exclude accounts are provided, includes override excludes
+          var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) > 0 ? (
+            "MIXED"
+          ) : ""
+        )
       )
     )
   )
@@ -117,6 +153,10 @@ locals {
 
   # switch cases for various user provided accounts configuration to be onboarded
   deployment_account_options = {
+    NONE = {
+      accounts_to_deploy = []
+      account_filter_type = "NONE"
+    }
     UNION = {
       accounts_to_deploy = var.include_accounts
       account_filter_type = "UNION"

modules/config-posture/variables.tf

@@ -10,7 +10,7 @@ variable "is_organizational" {
 
 variable "org_units" {
   description = <<-EOF
-    DEPRECATED: Defaults to `[]`, use `include_ouids` instead.
+    TO BE DEPRECATED: Defaults to `[]`, use `include_ouids` instead.
     When set, org units to install cspm."
     EOF
   type        = set(string)

modules/config-posture/versions.tf

@@ -7,7 +7,7 @@ terraform {
     }
     sysdig = {
       source  = "sysdiglabs/sysdig"
-      version = "~> 1.48"
+      version = "~> 1.51"
     }
   }
 }

modules/integrations/cloud-logs/README.md

@@ -18,7 +18,7 @@ If instrumenting an AWS Gov account/organization, resources will be created in `
 |---------------------------------------------------------------------------|-----------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0  |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws)                   | >= 5.60.0 |
-| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig)          | ~>1.48    |
+| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig)          | ~>1.51    |
 | <a name="requirement_random"></a> [random](#requirement\_random)          | >= 3.1    |
 
 ## Providers

modules/integrations/cloud-logs/versions.tf

@@ -8,7 +8,7 @@ terraform {
     }
     sysdig = {
       source = "sysdiglabs/sysdig"
-      version = "~> 1.48"
+      version = "~> 1.51"
     }
     random = {
       source  = "hashicorp/random"