Skip to content

Commit aed8612

Browse files
semyonmorsemyonmor
authored
Merge pull request #606 from oferromaqua/2022.4
Adding examples for possible config scripts
2 parents ba4be33 + d6a2497 commit aed8612

File tree

7 files changed

+225
-1
lines changed

7 files changed

+225
-1
lines changed

‎enforcers/vm_enforcer/golden_image/README.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,6 @@ You can prepare a golden image for automated and easy deployment of VMs (hosts)
1010

1111
### Deployment steps
1212

13-
Refer to the [Product documentation](https://docs.aquasec.com/v2022.4/docs/vm-enforcer-golden-image) for the complete description and instructions.
13+
Refer to the [Product documentation](https://docs.aquasec.com/v2022.4/docs/vm-enforcer-golden-image) for the complete description and instructions.
14+
15+
Inside the config_scripts_examples folder you’ll find six ready-to-adapt templates that turn a dormant VM Enforcer baked into a golden image into an active, policy-enforcing agent. Each script retrieves the needed configuration parameters from cloud-native secret stores, writes them into conifg json in the Enforcer install directory — no restarts, no manual edits. All other details on how to use these examples — secret naming, managed-identity/IAM permissions, and deployment - are covered in the full documentation.

‎enforcers/vm_enforcer/golden_image/config_scripts_examples/ubuntu_on_aws.sh‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
ServerSecret="<AQUA_SERVER_SECRET_NAME>"
5+
TokenSecret="<AQUA_TOKEN_SECRET_NAME>"
6+
7+
IMDS_TOKEN=$(curl -sS -X PUT "http://169.254.169.254/latest/api/token" \
8+
-H "X-aws-ec2-metadata-token-ttl-seconds: 60")
9+
REGION="${AWS_REGION:-$(
10+
curl -sS -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" \
11+
http://169.254.169.254/latest/meta-data/placement/region
12+
)}"
13+
14+
CONFIG_DIR="/opt/aquasec"
15+
TMP_FILE="${CONFIG_DIR}/.config.tmp"
16+
FINAL_FILE="${CONFIG_DIR}/GI_AQUA_CONFIG-prod_env.json"
17+
18+
sudo apt-get update -y
19+
sudo apt-get install -y docker.io jq
20+
sudo systemctl start docker
21+
22+
fetch_secret () {
23+
local secret_id="$1"
24+
sudo docker run --rm public.ecr.aws/aws-cli/aws-cli \
25+
secretsmanager get-secret-value \
26+
--secret-id "$secret_id" \
27+
--region "$REGION" \
28+
--query SecretString --output text
29+
}
30+
31+
RAW_SERVER_JSON=$(fetch_secret "$ServerSecret")
32+
RAW_TOKEN_JSON=$(fetch_secret "$TokenSecret")
33+
34+
AQUA_SERVER=$(jq -r '.AQUA_SERVER' <<<"$RAW_SERVER_JSON")
35+
AQUA_TOKEN=$(jq -r '.AQUA_TOKEN' <<<"$RAW_TOKEN_JSON")
36+
37+
jq -n --arg s "$AQUA_SERVER" --arg t "$AQUA_TOKEN" \
38+
'{AQUA_SERVER:$s, AQUA_TOKEN:$t}' > "$TMP_FILE"
39+
sudo mv "$TMP_FILE" "$FINAL_FILE"

‎enforcers/vm_enforcer/golden_image/config_scripts_examples/ubuntu_on_azure_bootstrap.sh‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
# ── 0 ▪ validate required env-vars ──────────────────────────────────────────────
5+
: "${KV_NAME:?Missing KV_NAME}"
6+
: "${SERVER_SECRET:?Missing SERVER_SECRET}"
7+
: "${TOKEN_SECRET:?Missing TOKEN_SECRET}"
8+
9+
CONFIG_DIR=/opt/aquasec
10+
TMP_FILE="$CONFIG_DIR/.config.tmp"
11+
FINAL_FILE="$CONFIG_DIR/GI_AQUA_CONFIG-prod_env.json"
12+
13+
# ── 1 ▪ get an IMDS token for Key Vault ─────────────────────────────────────────
14+
IMDS_TOKEN=$(curl -sf -H Metadata:true \
15+
"http://169.254.169.254/metadata/identity/oauth2/token?api-version=2019-08-01&resource=https://vault.azure.net" \
16+
| jq -r .access_token)
17+
18+
# ── 2 ▪ fetch secrets whose names came from the launcher ────────────────────────
19+
AQUA_SERVER=$(curl -sf -H "Authorization: Bearer $IMDS_TOKEN" \
20+
"https://${KV_NAME}.vault.azure.net/secrets/${SERVER_SECRET}?api-version=7.3" \
21+
| jq -r .value)
22+
23+
AQUA_TOKEN=$(curl -sf -H "Authorization: Bearer $IMDS_TOKEN" \
24+
"https://${KV_NAME}.vault.azure.net/secrets/${TOKEN_SECRET}?api-version=7.3" \
25+
| jq -r .value)
26+
27+
# ── 3 ▪ write config atomically and lock it down ───────────────────────────────
28+
mkdir -p "$CONFIG_DIR"
29+
if ! command -v jq >/dev/null 2>&1; then
30+
if command -v apt-get >/dev/null 2>&1; then
31+
apt-get update -y
32+
apt-get install -y jq
33+
elif command -v yum >/dev/null 2>&1; then
34+
yum install -y jq
35+
else
36+
exit 1
37+
fi
38+
fi
39+
jq -n --arg s "$AQUA_SERVER" --arg t "$AQUA_TOKEN" \
40+
'{AQUA_SERVER:$s, AQUA_TOKEN:$t}' > "$TMP_FILE"
41+
42+
chmod 600 "$TMP_FILE"
43+
mv "$TMP_FILE" "$FINAL_FILE"

‎enforcers/vm_enforcer/golden_image/config_scripts_examples/ubuntu_on_azure_launch.sh‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
# ── 0 ▪ FILL IN YOUR VALUES ────────────────────────────────────────────────────
5+
SUB_ID="<SUBSCRIPTION_ID>"
6+
RG="<VM_RESOURCE_GROUP>"
7+
VM="<VM_NAME>"
8+
9+
KV_NAME="<KEYVAULT_NAME>"
10+
SERVER_SECRET="<AQUA_SERVER_SECRET_NAME>"
11+
TOKEN_SECRET="<AQUA_TOKEN_SECRET_NAME>"
12+
13+
# ── 1 ▪ select subscription ────────────────────────────────────────────────────
14+
az account set --subscription "$SUB_ID"
15+
16+
# ── 2 ▪ deploy / update the Custom Script Extension ────────────────────────────
17+
az vm extension set \
18+
--resource-group "$RG" \
19+
--vm-name "$VM" \
20+
--name CustomScript \
21+
--publisher Microsoft.Azure.Extensions \
22+
--version 2.1 \
23+
--protected-settings '{
24+
"fileUris": [
25+
"<bootstrap-aqua.sh script file url>"
26+
],
27+
"commandToExecute": "bash -c '\''export KV_NAME='"$KV_NAME"' \
28+
SERVER_SECRET='"$SERVER_SECRET"' TOKEN_SECRET='"$TOKEN_SECRET"' && bash <bootstrap-aqua.sh>'\''"
29+
}' \
30+
--output none
31+
32+
echo "Bootstrap extension applied to $VM."

‎enforcers/vm_enforcer/golden_image/config_scripts_examples/windows_on_aws.ps1‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
<powershell>
2+
3+
Set-StrictMode -Version Latest
4+
$ErrorActionPreference = 'Stop'
5+
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
6+
7+
$ServerSecret = '<AQUA_SERVER_SECRET_NAME>'
8+
$TokenSecret = '<AQUA_TOKEN_SECRET_NAME>'
9+
10+
$imdsToken = Invoke-RestMethod -Method Put `
11+
-Uri 'http://169.254.169.254/latest/api/token' `
12+
-Headers @{ 'X-aws-ec2-metadata-token-ttl-seconds' = '60' }
13+
14+
$region = Invoke-RestMethod `
15+
-Uri 'http://169.254.169.254/latest/meta-data/placement/region' `
16+
-Headers @{ 'X-aws-ec2-metadata-token' = $imdsToken }
17+
18+
if (-not (Get-Command Get-SECSecretValue -ErrorAction SilentlyContinue)) {
19+
Install-Module -Name AWS.Tools.SecretsManager -Force -Scope AllUsers
20+
}
21+
22+
function Get-PlainSecretValue {
23+
param (
24+
[Parameter(Mandatory)][string]$SecretId,
25+
[Parameter(Mandatory)][string]$Key
26+
)
27+
$json = (Get-SECSecretValue -SecretId $SecretId -Region $region).SecretString
28+
return ( $json | ConvertFrom-Json ).$Key
29+
}
30+
31+
$AQUA_SERVER = Get-PlainSecretValue $ServerSecret 'AQUA_SERVER'
32+
$AQUA_TOKEN = Get-PlainSecretValue $TokenSecret 'AQUA_TOKEN'
33+
34+
$jsonConfig = @{ AQUA_SERVER = $AQUA_SERVER; AQUA_TOKEN = $AQUA_TOKEN } |
35+
ConvertTo-Json -Depth 2
36+
37+
$configPath = 'C:\Program Files\AquaSec\GI_AQUA_CONFIG-prod_env.json'
38+
$tempPath = "$configPath.tmp"
39+
40+
$jsonConfig | Set-Content -Path $tempPath -Encoding ASCII -Force
41+
42+
icacls $tempPath /inheritance:d `
43+
/grant:r "SYSTEM:F" "BUILTIN\Administrators:F" | Out-Null
44+
45+
Move-Item -Path $tempPath -Destination $configPath -Force
46+
47+
</powershell>

‎enforcers/vm_enforcer/golden_image/config_scripts_examples/windows_on_azure_bootstrap.ps1‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
param(
2+
[Parameter(Mandatory=$true)][string]$KvName,
3+
[Parameter(Mandatory=$true)][string]$ServerSecret,
4+
[Parameter(Mandatory=$true)][string]$TokenSecret
5+
)
6+
7+
$ErrorActionPreference = 'Stop'
8+
9+
$configDir = 'C:\Program Files\AquaSec'
10+
$tmpFile = Join-Path $configDir '.config.tmp'
11+
$finalFile = Join-Path $configDir 'GI_AQUA_CONFIG-prod_env.json'
12+
13+
# 1 ▪ get IMDS token
14+
$imdsUrl = 'http://169.254.169.254/metadata/identity/oauth2/token' +
15+
'?api-version=2019-08-01&resource=https://vault.azure.net'
16+
$imdsToken = (Invoke-RestMethod -Headers @{Metadata='true'} -Uri $imdsUrl).access_token
17+
18+
# 2 ▪ fetch secrets
19+
$base = "https://$KvName.vault.azure.net/secrets"
20+
$api = '?api-version=7.3'
21+
22+
$aquaServer = (Invoke-RestMethod -Headers @{Authorization = "Bearer $imdsToken"} `
23+
-Uri ("$base/${ServerSecret}$api")).value
24+
$aquaToken = (Invoke-RestMethod -Headers @{Authorization = "Bearer $imdsToken"} `
25+
-Uri ("$base/${TokenSecret}$api")).value
26+
27+
# 3 ▪ write JSON atomically
28+
New-Item -ItemType Directory -Force -Path $configDir | Out-Null
29+
@{AQUA_SERVER = $aquaServer; AQUA_TOKEN = $aquaToken} `
30+
| ConvertTo-Json -Depth 2 `
31+
| Set-Content -Encoding ASCII -Path $tmpFile
32+
33+
icacls $tmpFile /inheritance:d /grant:r "SYSTEM:F" "BUILTIN\Administrators:F" | Out-Null
34+
Move-Item -Force $tmpFile $finalFile

‎enforcers/vm_enforcer/golden_image/config_scripts_examples/windows_on_azure_launch.sh‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
SUB_ID="<SUBSCRIPTION_ID>"
5+
RG="<VM_RESOURCE_GROUP>"
6+
VM="<VM_NAME>"
7+
8+
KV_NAME="<KEYVAULT_NAME>"
9+
SERVER_SECRET="<AQUA_SERVER_SECRET_NAME>"
10+
TOKEN_SECRET="<AQUA_TOKEN_SECRET_NAME>"
11+
12+
az account set --subscription "$SUB_ID"
13+
14+
az vm extension set \
15+
--resource-group "$RG" \
16+
--vm-name "$VM" \
17+
--name CustomScriptExtension \
18+
--publisher Microsoft.Compute \
19+
--protected-settings '{
20+
"fileUris": [
21+
"<bootsctrap script url> "
22+
],
23+
"commandToExecute": "powershell -ExecutionPolicy Bypass -File <bootstrap script name>.ps1 -KvName '"$KV_NAME"' -ServerSecret '"$SERVER_SECRET"' -TokenSecret '"$TOKEN_SECRET"'"
24+
}' \
25+
--output none
26+
27+
echo "Bootstrap extension applied to $VM."

0 commit comments

Comments
 (0)