[build\_project\_arn](#input\_build\_project\_arn) | Code Build project arn | `string` | n/a | yes |
+| [build\_project\_name](#input\_build\_project\_name) | Code Build project name | `string` | n/a | yes |
| [ecs\_cluster](#input\_ecs\_cluster) | ECS Fargate Cluster where deploy the CloudConnector workload | `string` | n/a | yes |
| [secure\_api\_token\_secret\_name](#input\_secure\_api\_token\_secret\_name) | Sysdig Secure API token SSM parameter name | `string` | n/a | yes |
| [sns\_topic\_arn](#input\_sns\_topic\_arn) | CloudTrail module created SNS Topic ARN | `string` | n/a | yes |
@@ -65,7 +75,7 @@ A task deployed on an **ECS deployment** will detect events in your infrastructu
| [image](#input\_image) | Image of the cloud connector to deploy | `string` | `"quay.io/sysdig/cloud-connector:latest"` | no |
| [is\_organizational](#input\_is\_organizational) | whether secure-for-cloud should be deployed in an organizational setup | `bool` | `false` | no |
| [name](#input\_name) | Name to be assigned to all child resources. A suffix may be added internally when required. Use default value unless you need to install multiple instances | `string` | `"sfc-cloudconnector"` | no |
-| [organizational\_config](#input\_organizational\_config) | organizational\_config. following attributes must be given
- `sysdig_secure_for_cloud_role_arn` for cloud-connector assumeRole in order to read cloudtrail s3 events
- and the `connector_ecs_task_role_name` which has been granted trusted-relationship over the secure\_for\_cloud\_role
| object({
sysdig_secure_for_cloud_role_arn = string
connector_ecs_task_role_name = string
}) | {
"connector_ecs_task_role_name": null,
"sysdig_secure_for_cloud_role_arn": null
} | no |
+| [organizational\_config](#input\_organizational\_config) | organizational\_config. following attributes must be given
- `sysdig_secure_for_cloud_role_arn` for cloud-connector assumeRole in order to read cloudtrail s3 events
- `connector_ecs_task_role_name` which has been granted trusted-relationship over the secure\_for\_cloud\_role
- `organizational_role_per_account` is the name of the organizational role deployed by AWS in each account of the organization
| object({
sysdig_secure_for_cloud_role_arn = string
organizational_role_per_account = string
connector_ecs_task_role_name = string
}) | {
"connector_ecs_task_role_name": null,
"organizational_role_per_account": null,
"sysdig_secure_for_cloud_role_arn": null
} | no |
| [sysdig\_secure\_endpoint](#input\_sysdig\_secure\_endpoint) | Sysdig Secure API endpoint | `string` | `"https://secure.sysdig.com"` | no |
| [tags](#input\_tags) | sysdig secure-for-cloud tags | `map(string)` | {
"product": "sysdig-secure-for-cloud"
} | no |
| [verify\_ssl](#input\_verify\_ssl) | true/false to determine ssl verification for sysdig\_secure\_endpoint | `bool` | `true` | no |
diff --git a/modules/services/cloud-connector/ecs-service-security.tf b/modules/services/cloud-connector/ecs-service-security.tf
index 5be4fe6f..37c82381 100644
--- a/modules/services/cloud-connector/ecs-service-security.tf
+++ b/modules/services/cloud-connector/ecs-service-security.tf
@@ -17,6 +17,7 @@ data "aws_iam_role" "task_inherited" {
count = var.is_organizational ? 1 : 0
name = var.organizational_config.connector_ecs_task_role_name
}
+
resource "aws_iam_role" "task" {
count = var.is_organizational ? 0 : 1
name = "${var.name}-${local.ecs_task_role_name_suffix}"
@@ -24,6 +25,7 @@ resource "aws_iam_role" "task" {
path = "/"
tags = var.tags
}
+
data "aws_iam_policy_document" "task_assume_role" {
count = var.is_organizational ? 0 : 1
statement {
@@ -70,6 +72,81 @@ data "aws_iam_policy_document" "iam_role_task_policy" {
}
}
+resource "aws_iam_role_policy" "trigger_scan" {
+ name = "${var.name}-TriggerScan"
+ role = local.ecs_task_role_id
+ policy = data.aws_iam_policy_document.trigger_scan.json
+}
+data "aws_iam_policy_document" "trigger_scan" {
+ statement {
+ effect = "Allow"
+ actions = [
+ "codebuild:StartBuild"
+ ]
+ resources = [var.build_project_arn]
+ }
+}
+
+resource "aws_iam_role_policy" "task_definition_reader" {
+ name = "TaskDefinitionReader"
+ role = local.ecs_task_role_id
+ policy = data.aws_iam_policy_document.task_definition_reader.json
+}
+data "aws_iam_policy_document" "task_definition_reader" {
+ statement {
+ effect = "Allow"
+ actions = [
+ "ecs:DescribeTaskDefinition"
+ ]
+ resources = ["*"]
+ }
+}
+
+
+resource "aws_iam_role_policy" "secrets_reader" {
+ name = "SecretsReader"
+ role = local.ecs_task_role_id
+ policy = data.aws_iam_policy_document.secrets_reader.json
+}
+
+data "aws_iam_policy_document" "secrets_reader" {
+ statement {
+ effect = "Allow"
+ actions = [
+ "kms:Decrypt",
+ "secretsmanager:GetSecretValue"
+ ]
+ resources = ["*"]
+ }
+}
+
+resource "aws_iam_role_policy" "ecr_reader" {
+ name = "ECRReader"
+ role = local.ecs_task_role_id
+ policy = data.aws_iam_policy_document.ecr_reader.json
+}
+
+data "aws_iam_policy_document" "ecr_reader" {
+ statement {
+ effect = "Allow"
+ actions = [
+ "ecr:GetAuthorizationToken",
+ "ecr:BatchCheckLayerAvailability",
+ "ecr:GetDownloadUrlForLayer",
+ "ecr:GetRepositoryPolicy",
+ "ecr:DescribeRepositories",
+ "ecr:ListImages",
+ "ecr:DescribeImages",
+ "ecr:BatchGetImage",
+ "ecr:GetLifecyclePolicy",
+ "ecr:GetLifecyclePolicyPreview",
+ "ecr:ListTagsForResource",
+ "ecr:DescribeImageScanFindings"
+ ]
+ resources = ["*"]
+ }
+}
+
#---------------------------------
# execution role
# This role is required by tasks to pull container images and publish container logs to Amazon CloudWatch on your behalf.
diff --git a/modules/services/cloud-connector/s3-config.tf b/modules/services/cloud-connector/s3-config.tf
index 6fd2aba1..4223a8b0 100644
--- a/modules/services/cloud-connector/s3-config.tf
+++ b/modules/services/cloud-connector/s3-config.tf
@@ -1,4 +1,3 @@
-
locals {
s3_bucket_config_id = aws_s3_bucket.s3_config_bucket.id
}
@@ -11,16 +10,48 @@ resource "aws_s3_bucket_object" "config" {
}
locals {
- default_config = <`sysdig_secure_for_cloud_role_arn` for cloud-connector assumeRole in order to read cloudtrail s3 eventsand the `connector_ecs_task_role_name` which has been granted trusted-relationship over the secure_for_cloud_role
+
+ - `sysdig_secure_for_cloud_role_arn` for cloud-connector assumeRole in order to read cloudtrail s3 events
+ - `connector_ecs_task_role_name` which has been granted trusted-relationship over the secure_for_cloud_role
+ - `organizational_role_per_account` is the name of the organizational role deployed by AWS in each account of the organization
+
EOT
}