Skip to content

Commit 41c098f

Browse files
raghavanandanraghavanandan
authored
feat(Onboarding): Create CFT for selective features SSPROD-64924 (#165)
* Add foundational and voume access CFT * Add foundational and workload scanning CFT * Add foundational with both scanning modules CFT * Update Makefile * Add CFT testing steps to Readme * Remove testing steps * Remove scanning ID param override
1 parent f126a93 commit 41c098f

8 files changed

Lines changed: 2724 additions & 0 deletions

‎modules/Makefile‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,9 @@ validate:
3232
aws --region us-east-1 cloudformation validate-template --template-body file://./log_ingestion.s3.cft.yaml
3333
aws --region us-east-1 cloudformation validate-template --template-body file://./volume_access.cft.yaml
3434
aws --region us-east-1 cloudformation validate-template --template-body file://./vm_workload_scanning.cft.yaml
35+
aws --region us-east-1 cloudformation validate-template --template-body file://./foundational_with_scanning.cft.yaml
36+
aws --region us-east-1 cloudformation validate-template --template-body file://./foundational_vm_workload_scanning.cft.yaml
37+
aws --region us-east-1 cloudformation validate-template --template-body file://./foundational_volume_access.cft.yaml
3538
@trap 'aws s3 rm $(RESPONSE_ACTIONS_TEMP_S3_URI) 2>/dev/null || true' EXIT; \
3639
aws s3 cp response_actions.cft.yaml $(RESPONSE_ACTIONS_TEMP_S3_URI) && \
3740
aws --region us-east-1 cloudformation validate-template --template-url `aws s3 presign $(RESPONSE_ACTIONS_TEMP_S3_URI) --region $(S3_REGION) --expires-in 60`
@@ -50,6 +53,15 @@ lint:
5053
yq '.Resources.ScanningOrgStackSet.Properties.TemplateBody' vm_workload_scanning.cft.yaml | cfn-lint -
5154
yq '.Resources.LambdaFunctionsStackSet.Properties.TemplateBody' response_actions.cft.yaml | cfn-lint -
5255
yq '.Resources.OrganizationDelegateRolesStackSet.Properties.TemplateBody' response_actions.cft.yaml | cfn-lint -
56+
yq '.Resources.FoundationalOrganizationStackSet.Properties.TemplateBody' foundational_with_scanning.cft.yaml | cfn-lint -
57+
yq '.Resources.VMWorkloadScanningOrganizationStackSet.Properties.TemplateBody' foundational_with_scanning.cft.yaml | cfn-lint -
58+
yq '.Resources.AccountStackSet.Properties.TemplateBody' foundational_with_scanning.cft.yaml | cfn-lint -
59+
yq '.Resources.VolumeAccessOrganizationStackSet.Properties.TemplateBody' foundational_with_scanning.cft.yaml | cfn-lint -
60+
yq '.Resources.FoundationalOrganizationStackSet.Properties.TemplateBody' foundational_vm_workload_scanning.cft.yaml | cfn-lint -
61+
yq '.Resources.VMWorkloadScanningOrganizationStackSet.Properties.TemplateBody' foundational_vm_workload_scanning.cft.yaml | cfn-lint -
62+
yq '.Resources.FoundationalOrganizationStackSet.Properties.TemplateBody' foundational_volume_access.cft.yaml | cfn-lint -
63+
yq '.Resources.AccountStackSet.Properties.TemplateBody' foundational_volume_access.cft.yaml | cfn-lint -
64+
yq '.Resources.VolumeAccessOrganizationStackSet.Properties.TemplateBody' foundational_volume_access.cft.yaml | cfn-lint -
5365

5466
publish:
5567
aws s3 cp foundational.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/foundational.cft.yaml
@@ -59,6 +71,9 @@ publish:
5971
aws s3 cp volume_access.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/volume_access.cft.yaml
6072
aws s3 cp vm_workload_scanning.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/vm_workload_scanning.cft.yaml
6173
aws s3 cp response_actions.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/response_actions.cft.yaml
74+
aws s3 cp foundational_with_scanning.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/foundational_with_scanning.cft.yaml
75+
aws s3 cp foundational_vm_workload_scanning.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/foundational_vm_workload_scanning.cft.yaml
76+
aws s3 cp foundational_volume_access.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/foundational_volume_access.cft.yaml
6277

6378
deploy:
6479
aws cloudformation deploy \
@@ -174,6 +189,52 @@ deploy:
174189
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
175190
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
176191
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"
192+
aws cloudformation deploy \
193+
--stack-name $(STACK_NAME)-FoundationalWithScanning-$(PARAM_NAME_SUFFIX) \
194+
--template-file foundational_with_scanning.cft.yaml \
195+
--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
196+
--parameter-overrides \
197+
"NameSuffix=$(PARAM_NAME_SUFFIX)" \
198+
"ExternalID=$(PARAM_EXTERNAL_ID)" \
199+
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
200+
"LambdaScanningEnabled=$(PARAM_LAMBDA_SCANNING_ENABLED)" \
201+
"Regions=$(PARAM_REGIONS)" \
202+
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
203+
"Partition=$(PARAM_PARTITION)" \
204+
"RootOUID=$(PARAM_ROOT_OU_ID)" \
205+
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
206+
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
207+
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"
208+
aws cloudformation deploy \
209+
--stack-name $(STACK_NAME)-FoundationalVMWorkloadScanning-$(PARAM_NAME_SUFFIX) \
210+
--template-file foundational_vm_workload_scanning.cft.yaml \
211+
--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
212+
--parameter-overrides \
213+
"NameSuffix=$(PARAM_NAME_SUFFIX)" \
214+
"ExternalID=$(PARAM_EXTERNAL_ID)" \
215+
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
216+
"LambdaScanningEnabled=$(PARAM_LAMBDA_SCANNING_ENABLED)" \
217+
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
218+
"Partition=$(PARAM_PARTITION)" \
219+
"RootOUID=$(PARAM_ROOT_OU_ID)" \
220+
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
221+
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
222+
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"
223+
aws cloudformation deploy \
224+
--stack-name $(STACK_NAME)-FoundationalVolumeAccess-$(PARAM_NAME_SUFFIX) \
225+
--template-file foundational_volume_access.cft.yaml \
226+
--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
227+
--parameter-overrides \
228+
"NameSuffix=$(PARAM_NAME_SUFFIX)" \
229+
"ExternalID=$(PARAM_EXTERNAL_ID)" \
230+
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
231+
"Regions=$(PARAM_REGIONS)" \
232+
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
233+
"Partition=$(PARAM_PARTITION)" \
234+
"RootOUID=$(PARAM_ROOT_OU_ID)" \
235+
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
236+
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
237+
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"
177238

178239
clean:
179240
aws cloudformation delete-stack --stack-name $(STACK_NAME)-Foundational-$(PARAM_NAME_SUFFIX)
@@ -183,3 +244,6 @@ clean:
183244
aws cloudformation delete-stack --stack-name $(STACK_NAME)-VolumeAccess-$(PARAM_NAME_SUFFIX)
184245
aws cloudformation delete-stack --stack-name $(STACK_NAME)-VMWorkloadScanning-$(PARAM_NAME_SUFFIX)
185246
aws cloudformation delete-stack --stack-name $(STACK_NAME)-ResponseActions-$(PARAM_NAME_SUFFIX)
247+
aws cloudformation delete-stack --stack-name $(STACK_NAME)-FoundationalWithScanning-$(PARAM_NAME_SUFFIX)
248+
aws cloudformation delete-stack --stack-name $(STACK_NAME)-FoundationalVMWorkloadScanning-$(PARAM_NAME_SUFFIX)
249+
aws cloudformation delete-stack --stack-name $(STACK_NAME)-FoundationalVolumeAccess-$(PARAM_NAME_SUFFIX)

‎modules/README.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,42 @@ Following are the new parameters to configure organizational deployments on the
2222
4. `ExcludeAccounts` - List of AWS Accounts to exclude deploying the Sysdig Secure for Cloud resources in.
2323

2424
**DEPRECATION NOTICE**: module template parameter `OrganizationalUnitIDs` has been DEPRECATED and is no longer supported. Please work with Sysdig to migrate your CFT based installs to use `IncludeOUIDs` instead to achieve the same deployment outcome.
25+
26+
## Available Templates
27+
28+
### foundational.cft.yaml
29+
Deploys foundational Sysdig Secure resources including posture management and onboarding capabilities.
30+
- **Components**: Secure posture, secure onboarding
31+
32+
### foundational_with_scanning.cft.yaml
33+
All-in-one template combining foundational resources with both VM workload scanning and agentless volume access/scanning capabilities.
34+
- **Components**: Secure posture, secure onboarding, VM workload scanning, secure scanning
35+
- **Additional Parameters**:
36+
- `LambdaScanningEnabled` - Enable Lambda function scanning (default: false)
37+
- `ScanningAccountID` - The AWS Account ID of the Sysdig Scanning Account (default: 878070807337)
38+
- `Regions` - Comma-separated list of regions enabled for Sysdig Scanning
39+
40+
### foundational_vm_workload_scanning.cft.yaml
41+
Combines foundational resources with VM workload scanning capabilities.
42+
- **Components**: Secure posture, secure onboarding, VM workload scanning
43+
- **Additional Parameters**:
44+
- `LambdaScanningEnabled` - Enable Lambda function scanning (default: false)
45+
46+
### foundational_volume_access.cft.yaml
47+
Combines foundational resources with agentless volume access and scanning capabilities.
48+
- **Components**: Secure posture, secure onboarding, secure scanning
49+
- **Additional Parameters**:
50+
- `ScanningAccountID` - The AWS Account ID of the Sysdig Scanning Account (default: 878070807337)
51+
- `Regions` - Comma-separated list of regions enabled for Sysdig Scanning
52+
53+
### volume_access.cft.yaml
54+
Standalone template for agentless volume access and scanning capabilities.
55+
56+
### vm_workload_scanning.cft.yaml
57+
Standalone template for VM workload scanning capabilities.
58+
59+
### log_ingestion.events.cft.yaml, log_ingestion.legacy_events.cft.yaml, log_ingestion.s3.cft.yaml
60+
Templates for configuring log ingestion through EventBridge and S3.
61+
62+
### response_actions.cft.yaml
63+
Template for deploying Sysdig response actions capabilities.

0 commit comments

Comments
 (0)