chore: remove sns member policy when not-required (#116)

sysdiglabs · Jul 11, 2022 · d5578ac · d5578ac
1 parent 72392e5
commit d5578ac
Show file tree

Hide file tree

Showing 24 changed files with 37 additions and 38 deletions.
diff --git a/examples/organizational/README.md b/examples/organizational/README.md
@@ -145,9 +145,9 @@ $ terraform apply
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
-| <a name="provider_aws.member"></a> [aws.member](#provider\_aws.member) | 4.21.0 |
-| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.37 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
+| <a name="provider_aws.member"></a> [aws.member](#provider\_aws.member) | 4.22.0 |
+| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.39 |
 
 ## Modules
 

diff --git a/examples/single-account-apprunner/README.md b/examples/single-account-apprunner/README.md
@@ -72,7 +72,7 @@ $ terraform apply
 
 | Name | Version |
 |------|---------|
-| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.37 |
+| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.39 |
 
 ## Modules
 

diff --git a/examples/single-account-ecs/README.md b/examples/single-account-ecs/README.md
@@ -72,7 +72,7 @@ $ terraform apply
 
 | Name | Version |
 |------|---------|
-| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.37 |
+| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.39 |
 
 ## Modules
 

diff --git a/examples/single-account-k8s/README.md b/examples/single-account-k8s/README.md
@@ -84,9 +84,9 @@ $ terraform apply
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
 | <a name="provider_helm"></a> [helm](#provider\_helm) | 2.6.0 |
-| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.37 |
+| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.39 |
 
 ## Modules
 

diff --git a/examples/trigger-events/README.md b/examples/trigger-events/README.md
@@ -49,7 +49,7 @@ $ terraform apply
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
 
 ## Modules
 

diff --git a/modules/infrastructure/cloudtrail/README.md b/modules/infrastructure/cloudtrail/README.md
@@ -12,7 +12,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
 
 ## Modules
 

diff --git a/modules/infrastructure/cloudtrail/data.tf b/modules/infrastructure/cloudtrail/data.tf
@@ -0,0 +1 @@
+data "aws_caller_identity" "me" {}
diff --git a/modules/infrastructure/cloudtrail/main.tf b/modules/infrastructure/cloudtrail/main.tf
@@ -23,5 +23,3 @@ resource "aws_cloudtrail" "cloudtrail" {
     aws_sns_topic_policy.allow_cloudtrail_publish
   ]
 }
-
-data "aws_caller_identity" "me" {}
diff --git a/modules/infrastructure/cloudtrail/sns_permissions.tf b/modules/infrastructure/cloudtrail/sns_permissions.tf
@@ -1,3 +1,8 @@
+locals {
+  cross_account = data.aws_caller_identity.me.account_id != var.organizational_config.sysdig_secure_for_cloud_member_account_id
+}
+
+
 resource "aws_sns_topic_policy" "allow_cloudtrail_publish" {
   arn    = aws_sns_topic.cloudtrail.arn
   policy = data.aws_iam_policy_document.cloudtrail_sns.json
@@ -20,18 +25,13 @@ data "aws_iam_policy_document" "cloudtrail_sns" {
   # Organizational Requirements
   # note; this statement is required to be on the SNS creation, don't move to other module as policies cannot be overriten/exteneded after creation
   dynamic "statement" {
-    for_each = var.is_organizational ? [1] : []
+    for_each = var.is_organizational && local.cross_account ? [1] : []
     content {
       sid    = "AllowSysdigSecureForCloudSubscribe"
       effect = "Allow"
       principals {
-        identifiers = [
-          "arn:aws:iam::${var.organizational_config.sysdig_secure_for_cloud_member_account_id}:role/${var.organizational_config.organizational_role_per_account}"
-        ]
-        type = "AWS"
-        #        more open policy but without requiring aws provider role
-        #        identifiers = ["sqs.amazonaws.com"]
-        #        type        = "Service"
+        identifiers = ["arn:aws:iam::${var.organizational_config.sysdig_secure_for_cloud_member_account_id}:role/${var.organizational_config.organizational_role_per_account}"]
+        type        = "AWS"
       }
       actions   = ["sns:Subscribe"]
       resources = [aws_sns_topic.cloudtrail.arn]

diff --git a/modules/infrastructure/cloudtrail_s3-sns-sqs/README.md b/modules/infrastructure/cloudtrail_s3-sns-sqs/README.md
@@ -46,7 +46,7 @@ EVENT FILTER/fine-tunning, regarding what we want to send to Sysdig Cloud-Connec
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
 
 ## Modules
 

diff --git a/modules/infrastructure/codebuild/README.md b/modules/infrastructure/codebuild/README.md
@@ -12,7 +12,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
 
 ## Modules
 

diff --git a/modules/infrastructure/ecs-vpc/README.md b/modules/infrastructure/ecs-vpc/README.md
@@ -13,7 +13,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
 
 ## Modules
 

diff --git a/modules/infrastructure/permissions/cloud-connector/README.md b/modules/infrastructure/permissions/cloud-connector/README.md
@@ -12,7 +12,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
 
 ## Modules
 

diff --git a/modules/infrastructure/permissions/cloud-scanning/README.md b/modules/infrastructure/permissions/cloud-scanning/README.md
@@ -12,7 +12,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
 
 ## Modules
 

diff --git a/modules/infrastructure/permissions/general/README.md b/modules/infrastructure/permissions/general/README.md
@@ -15,7 +15,7 @@ General permissions that apply to both cloud-connector and cloud-scanning module
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
 
 ## Modules
 

diff --git a/modules/infrastructure/permissions/iam-user/README.md b/modules/infrastructure/permissions/iam-user/README.md
@@ -45,7 +45,7 @@ Note: Contact us if this authentication system does not match your requirement.
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
 
 ## Modules
 

diff --git a/modules/infrastructure/permissions/org-role-ecs/README.md b/modules/infrastructure/permissions/org-role-ecs/README.md
@@ -31,8 +31,8 @@ The aim of this module is to manage the organizational **managed account** requi
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
-| <a name="provider_aws.member"></a> [aws.member](#provider\_aws.member) | 4.21.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
+| <a name="provider_aws.member"></a> [aws.member](#provider\_aws.member) | 4.22.0 |
 
 ## Modules
 

diff --git a/modules/infrastructure/permissions/org-role-eks/README.md b/modules/infrastructure/permissions/org-role-eks/README.md
@@ -29,7 +29,7 @@ The aim of this module is to manage the organizational **managed account** requi
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
 
 ## Modules
 

diff --git a/modules/infrastructure/resource-group/README.md b/modules/infrastructure/resource-group/README.md
@@ -13,7 +13,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
 
 ## Modules
 

diff --git a/modules/infrastructure/sqs-sns-subscription/README.md b/modules/infrastructure/sqs-sns-subscription/README.md
@@ -12,7 +12,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
 
 ## Modules
 

diff --git a/modules/infrastructure/ssm/README.md b/modules/infrastructure/ssm/README.md
@@ -16,7 +16,7 @@ and pass it, in a safe way, to all the modules that require it.
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
 
 ## Modules
 

diff --git a/modules/services/cloud-bench/README.md b/modules/services/cloud-bench/README.md
@@ -26,9 +26,9 @@ Deployed on **Sysdig Backend**
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
 | <a name="provider_random"></a> [random](#provider\_random) | 3.3.2 |
-| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.37 |
+| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.39 |
 
 ## Modules
 

diff --git a/modules/services/cloud-connector-ecs/README.md b/modules/services/cloud-connector-ecs/README.md
@@ -15,8 +15,8 @@ A task deployed on an **ECS deployment** will detect events in your infrastructu
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
-| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.37 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.22.0 |
+| <a name="provider_sysdig"></a> [sysdig](#provider\_sysdig) | 0.5.39 |
 
 ## Modules
 

diff --git a/use-cases/_questionnaire.md b/use-cases/_questionnaire.md
@@ -29,9 +29,9 @@ modules, and we also offer [AWS Cloudformation templates](https://github.com/sys
       - if so, does that S3 bucket already have any "Event Notification System"? Is it an SNS we could subscribe to?
       - if so, does that S3 bucket already have an "Amazon EventBridge" system activated?
     - whether it's organizational or not, could you give us a quick picture of the account setup in terms of purpose?
-- how many **regions** do you work with? 
+- how many **regions** do you work with?
     - is secure for cloud to be deployed on the same region as your existing resources?
-    - (aws-only) if in previous point you said you have a cloudtrail, cloudtrail-sns, or cloudtrail-s3, in which region is it?    
+    - (aws-only) if in previous point you said you have a cloudtrail, cloudtrail-sns, or cloudtrail-s3, in which region is it?
 - how do you handle **IAM permissions**? would you let our Terraform scripts set them up for you, or you want to set them yourself manually? any restriction we may be aware of?
 - how do you handle **outbound newtwork connection** securization? does your infrastructure have any customized VPC/firewally setup?
 - **Deployment** type
-Original file line number
+Diff line change
@@ Expand Up / @@ -23,5 +23,3 @@ resource "aws_cloudtrail" "cloudtrail" { @@
         aws_sns_topic_policy.allow_cloudtrail_publish
       ]
     }
-    data "aws_caller_identity" "me" {}