feat: introducing new ECR Module #1

afiune · 2021-03-16T00:47:59Z

As a Lacework user that uses Terraform,
I want to be able to create an IAM Role to integrate Elastic Container Registry (ECR) with Lacework using Terraform,
So I don't have to worry about creating an IAM Role manually.

Default Lacework ECR Integration

This example creates a new least privilege IAM Role to access the Amazon Container Registry of the account running the automation and integrates it with Lacework.

terraform {
  required_providers {
    lacework = {
      source = "lacework/lacework"
    }
  }
}

provider "lacework" {}
provider "aws" {
  region = "us-west-2"
}

module "lacework_ecr" {
  source  = "lacework/ecr/aws"
  version = "~> 0.1"
}

Signed-off-by: Salim Afiune Maya afiune@lacework.net

Signed-off-by: Salim Afiune Maya <afiune@lacework.net>

scottford-lw · 2021-03-16T19:11:54Z

examples/default/README.md

+provider "lacework" {}
+provider "aws" {


Suggested change

provider "lacework" {}

provider "aws" {

provider "lacework" {}

provider "aws" {

scottford-lw · 2021-03-16T19:14:26Z

examples/default/main.tf

+provider "lacework" {}
+provider "aws" {


Suggested change

provider "lacework" {}

provider "aws" {

provider "lacework" {}

provider "aws" {

scottford-lw

@afiune a couple of suggestions and a couple of items that need confirmation.

examples/default/main.tf

outputs.tf

Signed-off-by: Salim Afiune Maya <afiune@lacework.net>

examples/default/README.md

JPLachance · 2021-03-16T20:12:53Z

main.tf

+
+# wait for X seconds for things to settle down in the AWS side
+# before trying to create the Lacework external integration
+resource "time_sleep" "wait_time" {


I confirm I had this issue multiple times. Happy to see we have a fix for it!

JPLachance · 2021-03-16T20:17:10Z

main.tf

+  tags                    = var.tags
+}
+
+resource "aws_iam_role_policy_attachment" "ecr_read_only_policy_attachment" {


Let's suppose an AWS account with multiple regions. Let's suppose we don't want to create one IAM role per region and that we want to reuse the same role in each region.

To achieve this goal, I would set use_existing_iam_role to true. It will work in the first region.

How will it reach in the second region?

I think this attachment will fail because the policy AmazonEC2ContainerRegistryReadOnly will already be attached.

Very interesting use case! I will test it right away!

It works like a charm!

Code:

provider "lacework" { profile = "mini" } provider "aws" { alias = "west2" region = "us-west-2" } module "lacework_ecr_west" { source = "../.." providers = { aws = aws.west2 } } provider "aws" { alias = "east1" region = "us-east-1" } module "lacework_ecr_east" { source = "../.." providers = { aws = aws.west2 } use_existing_iam_role = true iam_role_name = module.lacework_ecr_west.iam_role_name iam_role_arn = module.lacework_ecr_west.iam_role_arn iam_role_external_id = module.lacework_ecr_west.external_id }

Running Terraform:

$ terraform apply module.lacework_ecr_west.module.lacework_ecr_iam_role.random_id.uniq: Refreshing state... [id=uTkifw] module.lacework_ecr_east.module.lacework_ecr_iam_role.random_id.uniq: Refreshing state... [id=mNsUIw] module.lacework_ecr_west.module.lacework_ecr_iam_role.random_string.external_id[0]: Refreshing state... [id=VmfEQMbZ8Ws95Enq] module.lacework_ecr_east.data.aws_caller_identity.current: Refreshing state... module.lacework_ecr_east.data.aws_region.current: Refreshing state... module.lacework_ecr_west.data.aws_region.current: Refreshing state... module.lacework_ecr_west.data.aws_caller_identity.current: Refreshing state... module.lacework_ecr_east.aws_iam_role_policy_attachment.ecr_read_only_policy_attachment: Refreshing state... [id=lw-iam-b939227f-20210316210253370700000001] module.lacework_ecr_west.module.lacework_ecr_iam_role.data.aws_iam_policy_document.lacework_assume_role_policy[0]: Refreshing state... module.lacework_ecr_west.module.lacework_ecr_iam_role.aws_iam_role.lacework_iam_role[0]: Refreshing state... [id=lw-iam-b939227f] module.lacework_ecr_east.time_sleep.wait_time: Refreshing state... [id=2021-03-16T21:03:08Z] module.lacework_ecr_west.aws_iam_role_policy_attachment.ecr_read_only_policy_attachment: Refreshing state... [id=lw-iam-b939227f-20210316210148989500000001] module.lacework_ecr_west.lacework_integration_ecr.iam_role: Refreshing state... [id=MINIALLY_9293C0545824CF31E4D29AA3D2BE425189ED2D56F45B0B0] module.lacework_ecr_east.lacework_integration_ecr.iam_role: Refreshing state... [id=MINIALLY_3884B70BF5F60803A1EB9A7B5238F78FFFD8DE746C2D6DC] module.lacework_ecr_west.time_sleep.wait_time: Refreshing state... [id=2021-03-16T21:02:04Z] Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

Two ECR integrations with the same IAM role in different Regions! ⭐

$ lacework int -p mini show MINIALLY_9293C0545824CF31E4D29AA3D2BE425189ED2D56F45B0B0 INTEGRATION GUID NAME TYPE STATUS STATE -----------------------------------------------------------+-----------------+---------------+---------+-------- MINIALLY_9293C0545824CF31E4D29AA3D2BE425189ED2D56F45B0B0 TF ECR IAM Role CONT_VULN_CFG Enabled Ok INTEGRATION DETAILS ---------------------------------------------------------------------------------- REGISTRY TYPE AWS_ECR REGISTRY DOMAIN 463783698038.dkr.ecr.us-west-2.amazonaws.com LIMIT BY TAG * LIMIT BY LABEL * LIMIT NUM IMAGES PER REPO 5 AWS AUTH TYPE AWS_IAM ROLE ARN arn:aws:iam::463783698038:role/lw-iam-b939227f $ $ lacework int -p mini show MINIALLY_3884B70BF5F60803A1EB9A7B5238F78FFFD8DE746C2D6DC INTEGRATION GUID NAME TYPE STATUS STATE -----------------------------------------------------------+-----------------+---------------+---------+-------- MINIALLY_3884B70BF5F60803A1EB9A7B5238F78FFFD8DE746C2D6DC TF ECR IAM Role CONT_VULN_CFG Enabled Ok INTEGRATION DETAILS ---------------------------------------------------------------------------------- REGISTRY TYPE AWS_ECR REGISTRY DOMAIN 463783698038.dkr.ecr.us-west-2.amazonaws.com LIMIT BY TAG * LIMIT BY LABEL * LIMIT NUM IMAGES PER REPO 5 AWS AUTH TYPE AWS_IAM ROLE ARN arn:aws:iam::463783698038:role/lw-iam-b939227f

@JPLachance Thoughts?

I will add this as an example!

Great stuff!

Signed-off-by: Salim Afiune Maya <afiune@lacework.net>

…form-aws-ecr into afiune/ALLY-371/ECR

scottford-lw

afiune requested review from scottford-lw, alannix-lw and dmurray-lacework March 16, 2021 00:48

afiune force-pushed the afiune/ALLY-371/ECR branch 2 times, most recently from 11672f0 to d0ec911 Compare March 16, 2021 15:22

feat: introducing new ECR Module

05f7600

Signed-off-by: Salim Afiune Maya <afiune@lacework.net>

afiune force-pushed the afiune/ALLY-371/ECR branch from d0ec911 to 05f7600 Compare March 16, 2021 15:41

scottford-lw reviewed Mar 16, 2021

View reviewed changes

scottford-lw suggested changes Mar 16, 2021

View reviewed changes

examples/default/main.tf Outdated Show resolved Hide resolved

outputs.tf Outdated Show resolved Hide resolved

chore: fix code review comments

a9c1ac8

Signed-off-by: Salim Afiune Maya <afiune@lacework.net>

afiune requested a review from scottford-lw March 16, 2021 19:27

afiune commented Mar 16, 2021

View reviewed changes

examples/default/README.md Outdated Show resolved Hide resolved

chore: update examples/default/README.md

83e5c59

JPLachance reviewed Mar 16, 2021

View reviewed changes

afiune added 2 commits March 16, 2021 15:17

docs: add multi-region example

db785c0

Signed-off-by: Salim Afiune Maya <afiune@lacework.net>

Merge branch 'afiune/ALLY-371/ECR' of ssh://github.com/lacework/terra…

96794fb

…form-aws-ecr into afiune/ALLY-371/ECR

JPLachance approved these changes Mar 16, 2021

View reviewed changes

scottford-lw approved these changes Mar 16, 2021

View reviewed changes

afiune merged commit 7219bc6 into main Mar 16, 2021

afiune deleted the afiune/ALLY-371/ECR branch March 16, 2021 21:37

alannix-lw mentioned this pull request Mar 17, 2021

Dependency conflicts with terraform-aws-cloudtrail lacework/terraform-aws-cloudtrail#26

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: introducing new ECR Module #1

feat: introducing new ECR Module #1

afiune commented Mar 16, 2021

scottford-lw Mar 16, 2021

scottford-lw Mar 16, 2021

scottford-lw left a comment

JPLachance Mar 16, 2021

JPLachance Mar 16, 2021

afiune Mar 16, 2021

afiune Mar 16, 2021

afiune Mar 16, 2021

JPLachance Mar 16, 2021

scottford-lw Mar 16, 2021

scottford-lw left a comment

feat: introducing new ECR Module #1

feat: introducing new ECR Module #1

Conversation

afiune commented Mar 16, 2021

Default Lacework ECR Integration

Choose a reason for hiding this comment

Choose a reason for hiding this comment

scottford-lw left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

scottford-lw left a comment

Choose a reason for hiding this comment