Skip to content

Commit 2a5425c

Browse files
SKosierSKosier
authored
feat(azure): add diagnostic settings for additional resources (SSPROD-44285) (#56)
1 parent cbbd896 commit 2a5425c

File tree

7 files changed

+118
-5
lines changed

7 files changed

+118
-5
lines changed

‎modules/integrations/additional-resources/README.md

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# Azure Additional Resources Module
2+
3+
This module creates diagnostic settings for all the resources specified by the client and directs the logs for those specified resources to the existing Event Hub, which will be queried by the Sysdig backend for log ingestion.
4+
The resources will forward only the logs specified by the user.
5+
6+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
7+
## Requirements
8+
9+
| Name | Version |
10+
|------|---------|
11+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
12+
| <a name="requirement_azurerm"></a> [azurerm](#requirement\_azurerm) | >= 3.76.0 |
13+
14+
## Providers
15+
16+
| Name | Version |
17+
|------|---------|
18+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | >= 3.76.0 |
19+
20+
## Modules
21+
22+
No modules.
23+
24+
## Resources
25+
26+
| Name | Type |
27+
|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------|
28+
| [azurerm_monitor_diagnostic_setting.sysdig_custom_diagnostic_settings](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_diagnostic_setting) | resource |
29+
30+
## Inputs
31+
32+
| Name | Description | Type | Default | Required |
33+
|-------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|----------|---------|:--------:|
34+
| <a name="input_event_hub_name"></a> [event\_hub\_name](#input\_event\_hub\_name) | Event Hub integration created for Sysdig Log Ingestion | `string` | n/a | yes |
35+
| <a name="input_sysdig_authorization_id"></a> [sysdig\_authorization\_id](#input\_sysdig\_authorization\_id) | Identifier of Authorization Rule for the Sysdig Namespace | `string` | n/a | yes |
36+
| <a name="input_deployment_identifier"></a> [deployment\_identifier](#input\_deployment\_identifier) | Identifier of Deployment that gets added to provisioned resources | `string` | n/a | yes |
37+
| <a name="input_diagnostic_settings"></a> [diagnostic\_settings](#input\_diagnostic\_settings) | Map of resource IDs to the list of logs to enable | `map(list(string))` | {} | yes |
38+
## Outputs
39+
40+
No outputs.
41+
42+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
43+
44+
## Authors
45+
46+
Module is maintained by [Sysdig](https://sysdig.com).
47+
48+
## License
49+
50+
Apache 2 Licensed. See LICENSE for full details.

‎modules/integrations/additional-resources/main.tf

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# M2
2+
resource "azurerm_monitor_diagnostic_setting" "sysdig_custom_diagnostic_settings" {
3+
for_each = var.diagnostic_settings
4+
name = "sysdig-diagnostic-settings-${substr(md5(each.key), 0, 8)}-${var.deployment_identifier}"
5+
target_resource_id = each.key
6+
eventhub_authorization_rule_id = var.sysdig_authorization_id
7+
eventhub_name = var.event_hub_name
8+
9+
dynamic "enabled_log" {
10+
for_each = each.value
11+
content {
12+
category = enabled_log.value
13+
}
14+
}
15+
}

‎modules/integrations/additional-resources/variables.tf

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
variable "sysdig_authorization_id" {
2+
type = string
3+
description = "Identifier of Authorization Rule for the Sysdig Namespace"
4+
}
5+
6+
variable "event_hub_name" {
7+
type = string
8+
description = "Event Hub integration created for Sysdig Log Ingestion"
9+
}
10+
11+
variable "diagnostic_settings" {
12+
type = map(list(string))
13+
description = "Map of resource IDs to the list of logs to enable"
14+
default = {}
15+
}
16+
17+
variable "deployment_identifier" {
18+
type = string
19+
description = "Identifier of Deployment that gets added to provisioned resources"
20+
}

‎modules/integrations/additional-resources/versions.tf

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">= 1.0.0"
3+
4+
required_providers {
5+
azurerm = {
6+
source = "hashicorp/azurerm"
7+
version = ">= 3.76.0"
8+
}
9+
}
10+
}

‎modules/integrations/event-hub/README.md

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -85,9 +85,12 @@ No modules.
8585
| <a name="input_enabled_entra_logs"></a> [enabled\_entra\_logs](#input\_enabled\_entra\_logs) | List of Entra logs to enable | `list(string)` | `["AuditLogs","SignInLogs","NonInteractiveUserSignInLogs","ServicePrincipalSignInLogs","ManagedIdentitySignInLogs","ProvisioningLogs","ADFSSignInLogs","RiskyUsers","UserRiskEvents","NetworkAccessTrafficLogs","RiskyServicePrincipals","ServicePrincipalRiskEvents","EnrichedOffice365AuditLogs","MicrosoftGraphActivityLogs","RemoteNetworkHealthLogs"]` | no |
8686
## Outputs
8787

88-
| Name | Description |
89-
|------|-------------|
90-
| <a name="output_event_hub_component_id"></a> [event\_hub\_component\_id](#output\_event\_hub\_component\_id) | Component identifier of Event Hub integration created in Sysdig Backend for Log Ingestion |
88+
| Name | Description |
89+
|-----------------------------------------------------------------------------------------------------------------------|-------------|
90+
| <a name="output_event_hub_component_id"></a> [event\_hub\_component\_id](#output\_event\_hub\_component\_id) | Component identifier of Event Hub integration created in Sysdig Backend for Log Ingestion |
91+
| <a name="output_event_hub_name"></a> [event\_hub\_name](#output\_event\_hub\_name) | Event Hub integration created for Sysdig Log Ingestion |
92+
| <a name="output_sysdig_authorization_id"></a> [sysdig\_authorization\_id](#output\_sysdig\_authorization\_id) | Identifier of Authorization Rule for the Sysdig Namespace |
93+
| <a name="output_unique_deployment_id"></a> [unique\_deployment\_id](#output\_unique\_deployment\_id) | Identifier of Deployment that gets added to provisioned resources |
9194
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
9295

9396
## Authors

‎modules/integrations/event-hub/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -184,4 +184,4 @@ resource "sysdig_secure_cloud_auth_account_component" "azure_event_hub" {
184184
}
185185
}
186186
})
187-
}
187+
}

‎modules/integrations/event-hub/outputs.tf

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,19 @@ output "event_hub_component_id" {
22
value = "${sysdig_secure_cloud_auth_account_component.azure_event_hub.type}/${sysdig_secure_cloud_auth_account_component.azure_event_hub.instance}"
33
description = "Component identifier of Event Hub integration created in Sysdig Backend for Log Ingestion"
44
depends_on = [ sysdig_secure_cloud_auth_account_component.azure_event_hub ]
5-
}
5+
}
6+
7+
output "event_hub_name" {
8+
value = azurerm_eventhub.sysdig_event_hub.name
9+
description = "Event Hub integration created for Sysdig Log Ingestion"
10+
}
11+
12+
output "sysdig_authorization_id" {
13+
value = azurerm_eventhub_namespace_authorization_rule.sysdig_rule.id
14+
description = "Identifier of Authorization Rule for the Sysdig Namespace"
15+
}
16+
17+
output "unique_deployment_id" {
18+
value = "${random_string.random.result}-${local.subscription_hash}"
19+
description = "Identifier of Deployment that gets added to provisioned resources"
20+
}

0 commit comments

Comments
 (0)