Skip to content

Commit

Permalink
docs(GCP README) Updates GCP docs for both Org and Project integration
Browse files Browse the repository at this point in the history
Signed-off-by: Scott Ford <scott.ford@lacework.net>
  • Loading branch information
scottford-lw committed Jun 5, 2020
1 parent 44aad17 commit 162d5a7
Showing 1 changed file with 53 additions and 10 deletions.
63 changes: 53 additions & 10 deletions gcp/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,20 +10,63 @@ configuration assessment, as well as GCP Audit Trail analysis.
- **PROJECT OWNER** (for project level integration)
- [Lacework API Key](https://support.lacework.com/hc/en-us/articles/360011403853-Generate-API-Access-Keys-and-Tokens)

## Step-By-Step
## Organziation Integration
The following section covers how to use Terraform to integrate GCP configuration assessment and Audit Trail for an entire GCP Org

### Setup GCP Service Account
In order to integrate Lacework with a GCP Organization you will need to first create a GCP service account with the the following permissions:
- Organziation Admin
- Logs Configuration Writer

Download the service account `json` file to your workstation and move on to the next section

More information on GCP sevice accounts can be found [here](https://cloud.google.com/iam/docs/service-accounts)

### Run Terraform
1. Clone this repository: https://github.com/lacework/terraform-provisioning
2. Download the compiled Lacework Terraform Provider for the platform you are running and place it at `~/.terraform.d/plugins/terraform-provider-lacework`
2. Change directories into `terraform-provisioning/gcp`
3. Create a new file called `terraform.tfvars` with the following content:

| Platform | 64-bit | 32-bit |
|---|---|---|
| MacOS (Darwing) | [`amd64`](https://techally-content.s3-us-west-1.amazonaws.com/terraform-provider-lacework/terraform-provider-lacework-darwin-amd64) | [`i386`](https://techally-content.s3-us-west-1.amazonaws.com/terraform-provider-lacework/terraform-provider-lacework-darwin-386)|
| Linux | [`amd64`](https://techally-content.s3-us-west-1.amazonaws.com/terraform-provider-lacework/terraform-provider-lacework-linux-amd64) | [`i386`](https://techally-content.s3-us-west-1.amazonaws.com/terraform-provider-lacework/terraform-provider-lacework-linux-386)|
| Windows | [`amd64`](https://techally-content.s3-us-west-1.amazonaws.com/terraform-provider-lacework/terraform-provider-lacework-windows-amd64.exe)| [`i386`](https://techally-content.s3-us-west-1.amazonaws.com/terraform-provider-lacework/terraform-provider-lacework-windows-386.exe)|
```
credentials_file = "<PATH TO GCP CREDENTIAL JSON FILE>"
org_integration = true
organization_id = "<GCP_ORG_ID>"
project_id = "<GCP_PROJECT_ID>"
prefix = "<name you want prefixed to resources provisioned>"
audit_log = true
lacework_account = "<YOUR LACEWORK ACCOUNT>"
lacework_api_key = "<THE API KEY FROM LACEWORK JSON FILE>"
lacework_api_secret = "<THE API SECRET FROM LACEWORK JSON FILE>"
lacework_integration_config_name = "<NAME FOR THIS INTEGRATION>"
lacework_integration_auditlog_name = "<NAME FOR THIS INTEGRATION>"
```
or use environment variables to avoid hardcoding API keys and secrets.

_NOTE: This is a temporary step until HashiCorp has released the Lacework Terraform Provider_
```
export TF_VAR_lacework_api_key=<THE API KEY FROM LACEWORK JSON FILE>
export TF_VAR_lacework_api_secret=<THE API SECRET FROM LACEWORK JSON FILE>
```

5. Run `terraform init`
6. Run `terraform apply`

3. Change directories into `terraform-provisioning/gcp`
4. Create a new file called `terraform.tfvars` with the following content:
More information on adding GCP credentials for Terraform can be found [here](https://www.terraform.io/docs/providers/google/guides/getting_started.html#adding-credentials)

## GCP Project Integration
The following section covers how to use Terraform to integrate GCP configuration assessment and Audit Trail on a per project basis.

### Setup GCP Service Account
In order to integrate Lacework with a GCP Organization you will need to first create a GCP service account with the the following permissions:
- Project Admin

Download the service account `json` file to your workstation and move on to the next section

More information on GCP sevice accounts can be found [here](https://cloud.google.com/iam/docs/service-accounts)

### Run Terraform
1. Clone this repository: https://github.com/lacework/terraform-provisioning
2. Change directories into `terraform-provisioning/gcp`
3. Create a new file called `terraform.tfvars` with the following content:

```
credentials_file = "<PATH TO GCP CREDENTIAL JSON FILE>"
Expand Down

0 comments on commit 162d5a7

Please sign in to comment.