You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+9-50Lines changed: 9 additions & 50 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,56 +1,18 @@
1
-
# Sysdig Secure for Cloud in Azure
1
+
# Sunset Notice
2
2
3
-
Terraform module that deploys the [**Sysdig Secure for Cloud** stack in **Azure**](https://docs.sysdig.com/en/docs/installation/sysdig-secure-for-cloud/deploy-sysdig-secure-for-cloud-on-azure).
4
-
<br/>
5
-
6
-
Provides unified threat-detection, compliance, forensics and analysis through these major components:
7
-
8
-
***[Threat Detection](https://docs.sysdig.com/en/docs/sysdig-secure/insights/)**: Tracks abnormal and suspicious
9
-
activities in your cloud environment based on Falco language. Managed through `cloud-connector` module. <br/>
10
-
11
-
***[Compliance](https://docs.sysdig.com/en/docs/sysdig-secure/posture/compliance/compliance-unified-/)**: Enables the
12
-
evaluation of standard compliance frameworks. Requires both modules `cloud-connector` and `cloud-bench`. <br/>
> Sysdig released a new onboarding experience for Azure in August 2024. We recommend connecting your cloud accounts by [following these instructions](https://docs.sysdig.com/en/docs/sysdig-secure/connect-cloud-accounts/).
5
+
>
6
+
> This repository should be used solely in cases where Agentless Threat Detection cannot be used.
25
7
26
8
## Usage
27
9
28
10
There are several ways to deploy Secure for Cloud in you Azure infrastructure,
29
-
-**[`/examples`](https://github.com/sysdiglabs/terraform-azurerm-secure-for-cloud/tree/master/examples)** for the most common scenarios
-[Single Subscription with a pre-existing Kubernetes Cluster](https://github.com/sysdiglabs/terraform-azurerm-secure-for-cloud/tree/master/examples/single-subscription-k8s/README.md)
-[Single Subscription with a pre-existing Kubernetes Cluster](https://github.com/sysdiglabs/terraform-azurerm-secure-for-cloud/tree/master/examples/single-subscription-k8s/README.md)
Find specific overall service arquitecture diagrams attached to each example/use-case.
37
-
38
-
<!--
39
-
In the long-term our purpose is to evaluate those use-cases and if they're common enough, convert them into examples to make their usage easier.
40
-
-->
41
-
42
-
If you're unsure about what/how to use this module, please fill the [questionnaire](https://github.com/sysdiglabs/terraform-aws-secure-for-cloud/blob/master/use-cases/_questionnaire.md) report as an issue and let us know your context, we will be happy to help.
43
-
44
-
45
-
46
-
### Notice
47
-
***Resource creation inventory** Find all the resources created by Sysdig examples in the resource-group `sysdig-secure-for-cloud`<br/>
48
-
* All Sysdig Secure for Cloud features but [Image Scanning](https://docs.sysdig.com/en/docs/sysdig-secure/scanning/) are enabled by default. You can enable it through `deploy_scanning` input variable parameters.<br/>
49
-
***Deployment cost** This example will create resources that cost money. Run `terraform destroy` when you don't need them anymore
50
-
* For **free subscription** users, beware that organizational examples may not deploy properly due to the [1 cloud-account limitation](https://docs.sysdig.com/en/docs/administration/administration-settings/subscription/#cloud-billing-free-tier). Open an Issue so we can help you here!
51
-
52
-
53
-
<br/>
15
+
If you're unsure about how to use this module, please contact your Sysdig representative. Our experts will guide you through the process and assist you in setting up your account securely and correctly.
54
16
55
17
## Required Permissions
56
18
@@ -64,12 +26,9 @@ This would be an overall schema of the **created resources**, for the default se
64
26
- Event Hub
65
27
- Sysdig Workload: Container Instance / For K8s cluter is pre-requied, not create
66
28
- For Scanning: Event-Grid, Event Hub, and Enterprise App in the ActiveDirectory
67
-
- Sysdig Lighthouse definition for [Compliance](https://github.com/sysdiglabs/terraform-azurerm-secure-for-cloud/tree/master/modules/services/cloud-bench)
68
29
69
30
### Provisioning Roles
70
31
71
-
- Compliance feature requires `Contributor` subcription-level role, in order to be able to check specific compliance rules.
72
-
- However, it can be lowered to `Reader` role, at the cost of failing the control Requirement 9.1 “Ensure App Service Authentication is set up for apps in Azure App Service” from CIS Microsoft Azure Foundations Benchmark) as this needs contributor access to query App Service Auth Settings.
73
32
- Threat Detection feature requires `Contributor` subscription-level role user assignment
74
33
- For AD diagnostic on [selected log types](https://github.com/sysdiglabs/terraform-azurerm-secure-for-cloud/blob/master/modules/infrastructure/eventhub/variables.tf#L80)`Security Administrator` role must be granted to at Organizational level.
75
34
- Otherwise, it can be disabled setting `deploy_active_directory=false` on all examples
| <aname="input_cloud_connector_image"></a> [cloud\_connector\_image](#input\_cloud\_connector\_image)| Cloud-connector image to deploy |`string`|`"quay.io/sysdig/cloud-connector"`| no |
110
109
| <aname="input_deploy_active_directory"></a> [deploy\_active\_directory](#input\_deploy\_active\_directory)| whether the Active Directory features are to be deployed |`bool`|`true`| no |
111
-
| <aname="input_deploy_benchmark"></a> [deploy\_benchmark](#input\_deploy\_benchmark)| whether benchmark module is to be deployed |`bool`|`true`| no |
112
110
| <aname="input_deploy_scanning"></a> [deploy\_scanning](#input\_deploy\_scanning)| whether scanning module is to be deployed |`bool`|`false`| no |
113
111
| <aname="input_existing_registries"></a> [existing\_registries](#input\_existing\_registries)| existing Azure Container Registry names to be included to scan by resource group { resource\_group\_1 = ["registry\_name\_11","registry\_name\_12"],resource\_group\_2 = ["registry\_name\_21","registry\_name\_22"]}. By default it will create a new ACR |`map(list(string))`|`{}`| no |
114
112
| <aname="input_location"></a> [location](#input\_location)| Zone where the stack will be deployed |`string`|`"westus"`| no |
| <aname="input_cpu"></a> [cpu](#input\_cpu)| Number of CPU cores of the containers |`string`|`"0.5"`| no |
105
104
| <aname="input_deploy_active_directory"></a> [deploy\_active\_directory](#input\_deploy\_active\_directory)| whether the Active Directory features are to be deployed |`bool`|`true`| no |
106
-
| <aname="input_deploy_benchmark"></a> [deploy\_benchmark](#input\_deploy\_benchmark)| whether benchmark module is to be deployed |`bool`|`true`| no |
107
105
| <aname="input_deploy_scanning"></a> [deploy\_scanning](#input\_deploy\_scanning)| true/false, whether scanning module is to be deployed |`bool`|`false`| no |
108
106
| <aname="input_existing_registries"></a> [existing\_registries](#input\_existing\_registries)| existing Azure Container Registry names to be included to scan by resource group { resource\_group\_1 = ["registry\_name\_11","registry\_name\_12"],resource\_group\_2 = ["registry\_name\_21","registry\_name\_22"]}. By default it will create a new ACR |`map(list(string))`|`{}`| no |
109
107
| <aname="input_location"></a> [location](#input\_location)| Zone where the stack will be deployed |`string`|`"westus"`| no |
@@ -112,7 +110,6 @@ $ terraform apply
112
110
| <aname="input_name"></a> [name](#input\_name)| Name to be assigned to all child resources. A suffix may be added internally when required. Use default value unless you need to install multiple instances |`string`|`"sfc"`| no |
113
111
| <aname="input_resource_group_name"></a> [resource\_group\_name](#input\_resource\_group\_name)| The resource group name to deploy secure for cloud stack |`string`|`""`| no |
114
112
| <aname="input_tags"></a> [tags](#input\_tags)| Tags to be added to the resources |`map(string)`| <pre>{<br> "product": "sysdig-secure-for-cloud"<br>}</pre> | no |
115
-
| <aname="input_use_reader_role"></a> [use\_reader\_role](#input\_use\_reader\_role)| Set this flag to `true` to use the `Reader` role instead of the `Contributor` role when creating the Trust Relationship. Some CSPM controls will not function correctly if this option is enabled |`bool`|`false`| no |
description="existing Azure Container Registry names to be included to scan by resource group { resource_group_1 = [\"registry_name_11\",\"registry_name_12\"],resource_group_2 = [\"registry_name_21\",\"registry_name_22\"]}. By default it will create a new ACR"
50
50
}
51
51
52
-
#
53
-
# benchmark
54
-
#
55
-
56
-
variable"deploy_benchmark" {
57
-
type=bool
58
-
description="whether benchmark module is to be deployed"
59
-
default=true
60
-
}
61
-
62
-
variable"use_reader_role" {
63
-
type=bool
64
-
description="Set this flag to `true` to use the `Reader` role instead of the `Contributor` role when creating the Trust Relationship. Some CSPM controls will not function correctly if this option is enabled"
0 commit comments