Skip to content

Commit 0f0972d

Browse files
hayk99hayk99
authored
feat: Event triggering module (#91)
* feat: trigger gcp event module * docs: add readme * chore: remove project_id * chore: fix docu * fix: change terraform-docs version
1 parent 901908b commit 0f0972d

File tree

16 files changed

+142
-25
lines changed

16 files changed

+142
-25
lines changed

‎.github/workflows/pre-commit.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ jobs:
9191
- name: Install pre-commit dependencies
9292
run: |
9393
pip install pre-commit
94-
curl -Lo ./terraform-docs.tar.gz https://github.com/terraform-docs/terraform-docs/releases/download/v0.13.0/terraform-docs-v0.13.0-$(uname)-amd64.tar.gz && tar -xzf terraform-docs.tar.gz && chmod +x terraform-docs && sudo mv terraform-docs /usr/bin/
94+
curl -Lo ./terraform-docs.tar.gz https://github.com/terraform-docs/terraform-docs/releases/download/v0.16.0/terraform-docs-v0.16.0-$(uname)-amd64.tar.gz && tar -xzf terraform-docs.tar.gz && chmod +x terraform-docs && sudo mv terraform-docs /usr/bin/
9595
curl -L "$(curl -s https://api.github.com/repos/terraform-linters/tflint/releases/latest | grep -o -E "https://.+?_linux_amd64.zip")" > tflint.zip && unzip tflint.zip && rm tflint.zip && sudo mv tflint /usr/bin/
9696
- name: Execute pre-commit
9797
# Run all pre-commit checks on max version supported

‎README.md

+3-1
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,9 @@ Notice that:
110110

111111
**Threat Detection**
112112

113-
Choose one of the rules contained in the `GCP Best Practices` policy and execute it in your GCP account.
113+
Terraform example module to trigger **GCP Update, Disable or Delete Sink** event can be found on [examples/trigger-events ](https://github.com/sysdiglabs/terraform-google-secure-for-cloud/blob/master/examples/trigger-events)
114+
115+
In another case, you can do it manually. Choose one of the rules contained in the `GCP Best Practices` policy and execute it in your GCP account.
114116
ex.: Create an alert (Monitoring > Alerting > Create policy). Delete it to prompt the event.
115117

116118
Remember that in case you add new rules to the policy you need to give it time to propagate the changes.

‎examples/organization/README.md

+6-6
Original file line numberDiff line numberDiff line change
@@ -69,17 +69,17 @@ module "secure-for-cloud_example_organization" {
6969

7070
| Name | Version |
7171
|------|---------|
72-
| <a name="provider_google"></a> [google](#provider\_google) | ~> 3.67.0 |
72+
| <a name="provider_google"></a> [google](#provider\_google) | 3.67.0 |
7373

7474
## Modules
7575

7676
| Name | Source | Version |
7777
|------|--------|---------|
78-
| <a name="module_cloud_bench"></a> [cloud\_bench](#module\_cloud\_bench) | ../../modules/services/cloud-bench | |
79-
| <a name="module_cloud_connector"></a> [cloud\_connector](#module\_cloud\_connector) | ../../modules/services/cloud-connector | |
80-
| <a name="module_connector_organization_sink"></a> [connector\_organization\_sink](#module\_connector\_organization\_sink) | ../../modules/infrastructure/organization_sink | |
81-
| <a name="module_pubsub_http_subscription"></a> [pubsub\_http\_subscription](#module\_pubsub\_http\_subscription) | ../../modules/infrastructure/pubsub_push_http_subscription | |
82-
| <a name="module_secure_secrets"></a> [secure\_secrets](#module\_secure\_secrets) | ../../modules/infrastructure/secrets | |
78+
| <a name="module_cloud_bench"></a> [cloud\_bench](#module\_cloud\_bench) | ../../modules/services/cloud-bench | n/a |
79+
| <a name="module_cloud_connector"></a> [cloud\_connector](#module\_cloud\_connector) | ../../modules/services/cloud-connector | n/a |
80+
| <a name="module_connector_organization_sink"></a> [connector\_organization\_sink](#module\_connector\_organization\_sink) | ../../modules/infrastructure/organization_sink | n/a |
81+
| <a name="module_pubsub_http_subscription"></a> [pubsub\_http\_subscription](#module\_pubsub\_http\_subscription) | ../../modules/infrastructure/pubsub_push_http_subscription | n/a |
82+
| <a name="module_secure_secrets"></a> [secure\_secrets](#module\_secure\_secrets) | ../../modules/infrastructure/secrets | n/a |
8383

8484
## Resources
8585

‎examples/single-project-k8s/README.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -63,15 +63,15 @@ Notice that:
6363

6464
| Name | Version |
6565
|------|---------|
66-
| <a name="provider_google"></a> [google](#provider\_google) | ~> 3.67.0 |
67-
| <a name="provider_helm"></a> [helm](#provider\_helm) | >=2.3.0 |
66+
| <a name="provider_google"></a> [google](#provider\_google) | 3.67.0 |
67+
| <a name="provider_helm"></a> [helm](#provider\_helm) | 2.4.1 |
6868

6969
## Modules
7070

7171
| Name | Source | Version |
7272
|------|--------|---------|
73-
| <a name="module_cloud_bench"></a> [cloud\_bench](#module\_cloud\_bench) | ../../modules/services/cloud-bench | |
74-
| <a name="module_connector_project_sink"></a> [connector\_project\_sink](#module\_connector\_project\_sink) | ../../modules/infrastructure/project_sink | |
73+
| <a name="module_cloud_bench"></a> [cloud\_bench](#module\_cloud\_bench) | ../../modules/services/cloud-bench | n/a |
74+
| <a name="module_connector_project_sink"></a> [connector\_project\_sink](#module\_connector\_project\_sink) | ../../modules/infrastructure/project_sink | n/a |
7575

7676
## Resources
7777

‎examples/single-project/README.md

+6-6
Original file line numberDiff line numberDiff line change
@@ -67,17 +67,17 @@ module "secure-for-cloud_example_single-project" {
6767

6868
| Name | Version |
6969
|------|---------|
70-
| <a name="provider_google"></a> [google](#provider\_google) | ~> 3.67.0 |
70+
| <a name="provider_google"></a> [google](#provider\_google) | 3.67.0 |
7171

7272
## Modules
7373

7474
| Name | Source | Version |
7575
|------|--------|---------|
76-
| <a name="module_cloud_bench"></a> [cloud\_bench](#module\_cloud\_bench) | ../../modules/services/cloud-bench | |
77-
| <a name="module_cloud_connector"></a> [cloud\_connector](#module\_cloud\_connector) | ../../modules/services/cloud-connector | |
78-
| <a name="module_connector_project_sink"></a> [connector\_project\_sink](#module\_connector\_project\_sink) | ../../modules/infrastructure/project_sink | |
79-
| <a name="module_pubsub_http_subscription"></a> [pubsub\_http\_subscription](#module\_pubsub\_http\_subscription) | ../../modules/infrastructure/pubsub_push_http_subscription | |
80-
| <a name="module_secure_secrets"></a> [secure\_secrets](#module\_secure\_secrets) | ../../modules/infrastructure/secrets | |
76+
| <a name="module_cloud_bench"></a> [cloud\_bench](#module\_cloud\_bench) | ../../modules/services/cloud-bench | n/a |
77+
| <a name="module_cloud_connector"></a> [cloud\_connector](#module\_cloud\_connector) | ../../modules/services/cloud-connector | n/a |
78+
| <a name="module_connector_project_sink"></a> [connector\_project\_sink](#module\_connector\_project\_sink) | ../../modules/infrastructure/project_sink | n/a |
79+
| <a name="module_pubsub_http_subscription"></a> [pubsub\_http\_subscription](#module\_pubsub\_http\_subscription) | ../../modules/infrastructure/pubsub_push_http_subscription | n/a |
80+
| <a name="module_secure_secrets"></a> [secure\_secrets](#module\_secure\_secrets) | ../../modules/infrastructure/secrets | n/a |
8181

8282
## Resources
8383

‎examples/trigger-events/README.md

+71
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
# Sysdig Secure for Cloud in GCP<br/>[ Example :: Trigger-Events]
2+
This example helps to trigger GCP Events. Cloud connector stack is required to be able to generate events.
3+
After applying, this will create a new sink and assign it to a new pub/sub topic. **GCP Update, Disable or Delete Sink** event will prompt once the module is destroyed.
4+
5+
## Prerequisites
6+
7+
Minimum requirements:
8+
1. Deploy Cloud Connector Stack on GCP.
9+
2. Configure Terraform GCP Provider.
10+
11+
## Usage
12+
13+
For quick testing, use this snippet on your terraform files
14+
15+
```terraform
16+
provider "google" {
17+
project = "<PROJECT_ID>"
18+
region = "<REGION_ID>; ex. us-central-1"
19+
}
20+
21+
module "secure-for-cloud_trigger_events" {
22+
source = "sysdiglabs/secure-for-cloud/google//examples/trigger-events"
23+
}
24+
```
25+
26+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
27+
## Requirements
28+
29+
| Name | Version |
30+
|------|---------|
31+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.14.0 |
32+
| <a name="requirement_google"></a> [google](#requirement\_google) | ~> 3.67.0 |
33+
| <a name="requirement_google-beta"></a> [google-beta](#requirement\_google-beta) | ~> 3.67.0 |
34+
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 3.1.0 |
35+
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | >= 0.5.21 |
36+
37+
## Providers
38+
39+
| Name | Version |
40+
|------|---------|
41+
| <a name="provider_google"></a> [google](#provider\_google) | 3.67.0 |
42+
43+
## Modules
44+
45+
No modules.
46+
47+
## Resources
48+
49+
| Name | Type |
50+
|------|------|
51+
| [google_logging_project_sink.project_sink](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/logging_project_sink) | resource |
52+
| [google_pubsub_topic.trigger_topic](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/pubsub_topic) | resource |
53+
| [google_pubsub_topic_iam_member.writer](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/pubsub_topic_iam_member) | resource |
54+
| [google_project.project](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/project) | data source |
55+
56+
## Inputs
57+
58+
No inputs.
59+
60+
## Outputs
61+
62+
No outputs.
63+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
64+
65+
## Authors
66+
67+
Module is maintained and supported by [Sysdig](https://github.com/sysdiglabs/terraform-google-cloudvision).
68+
69+
## License
70+
71+
Apache 2 Licensed. See LICENSE for full details.

‎examples/trigger-events/main.tf

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
data "google_project" "project" {
2+
}
3+
4+
resource "google_pubsub_topic" "trigger_topic" {
5+
name = "trigger-event-topic"
6+
project = data.google_project.project.project_id
7+
}
8+
9+
resource "google_logging_project_sink" "project_sink" {
10+
project = google_pubsub_topic.trigger_topic.project
11+
name = "trigger-event-project-sink"
12+
destination = "pubsub.googleapis.com/${google_pubsub_topic.trigger_topic.id}"
13+
unique_writer_identity = true
14+
filter = "resource.type = gce_instance AND severity >= WARNING"
15+
}
16+
17+
resource "google_pubsub_topic_iam_member" "writer" {
18+
project = google_pubsub_topic.trigger_topic.project
19+
topic = google_pubsub_topic.trigger_topic.name
20+
role = "roles/pubsub.publisher"
21+
member = google_logging_project_sink.project_sink.writer_identity
22+
}

‎examples/trigger-events/outputs.tf

Whitespace-only changes.

‎examples/trigger-events/variables.tf

Whitespace-only changes.

‎examples/trigger-events/versions.tf

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
terraform {
2+
required_version = ">= 0.14.0"
3+
4+
required_providers {
5+
random = {
6+
source = "hashicorp/random"
7+
version = ">= 3.1.0"
8+
}
9+
google = {
10+
source = "hashicorp/google"
11+
version = "~> 3.67.0"
12+
}
13+
google-beta = {
14+
source = "hashicorp/google-beta"
15+
version = "~> 3.67.0"
16+
}
17+
sysdig = {
18+
source = "sysdiglabs/sysdig"
19+
version = ">= 0.5.21"
20+
}
21+
}
22+
}

‎modules/infrastructure/organization_sink/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
| Name | Version |
1414
|------|---------|
15-
| <a name="provider_google"></a> [google](#provider\_google) | ~> 3.67.0 |
15+
| <a name="provider_google"></a> [google](#provider\_google) | 3.67.0 |
1616

1717
## Modules
1818

‎modules/infrastructure/project_sink/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
| Name | Version |
1414
|------|---------|
15-
| <a name="provider_google"></a> [google](#provider\_google) | ~> 3.67.0 |
15+
| <a name="provider_google"></a> [google](#provider\_google) | 3.67.0 |
1616

1717
## Modules
1818

‎modules/infrastructure/pubsub_push_http_subscription/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ already exists in the project. It will create the topic if it doesn't exist.
1515

1616
| Name | Version |
1717
|------|---------|
18-
| <a name="provider_google"></a> [google](#provider\_google) | ~> 3.67.0 |
18+
| <a name="provider_google"></a> [google](#provider\_google) | 3.67.0 |
1919

2020
## Modules
2121

‎modules/infrastructure/secrets/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
| Name | Version |
1414
|------|---------|
15-
| <a name="provider_google"></a> [google](#provider\_google) | ~> 3.67.0 |
15+
| <a name="provider_google"></a> [google](#provider\_google) | 3.67.0 |
1616

1717
## Modules
1818

‎modules/services/cloud-connector/README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,8 @@ module "cloud_connector_gcp" {
3232

3333
| Name | Version |
3434
|------|---------|
35-
| <a name="provider_google"></a> [google](#provider\_google) | ~> 3.67.0 |
36-
| <a name="provider_random"></a> [random](#provider\_random) | >= 3.1.0 |
35+
| <a name="provider_google"></a> [google](#provider\_google) | 3.67.0 |
36+
| <a name="provider_random"></a> [random](#provider\_random) | 3.1.0 |
3737

3838
## Modules
3939

‎test/fixtures/single-project/variables.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,6 @@ variable "sysdig_secure_endpoint" {
1818

1919
variable "location" {
2020
type = string
21-
default = "asia-northeast1"
21+
default = "us-central1"
2222
description = "Zone where the stack will be deployed"
2323
}

0 commit comments

Comments
 (0)