Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs(gcp) Update README docs for Org and Project integration #30

Merged
merged 3 commits into from
Jun 6, 2020
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
67 changes: 54 additions & 13 deletions gcp/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,25 +5,66 @@ configuration assessment, as well as GCP Audit Trail analysis.

## Requirements
- Terraform `v.0.12.x`
- [GCP Service Account](https://cloud.google.com/iam/docs/service-accounts) with the following permissions
- **ORGANIZATION OWNER** (for organization level integration)
- **PROJECT OWNER** (for project level integration)
- [GCP Service Account](https://cloud.google.com/iam/docs/service-accounts)
- [Lacework API Key](https://support.lacework.com/hc/en-us/articles/360011403853-Generate-API-Access-Keys-and-Tokens)

## Step-By-Step
## Organziation Integration
The following section covers how to use Terraform to integrate GCP configuration assessment and Audit Trail for an entire GCP Organization

### Setup GCP Service Account
In order to integrate Lacework with a GCP Organization you will need a GCP service account with the following permissions:
- Organziation Admin
- Logs Configuration Writer

Download the service account `json` file to your workstation and move on to the next section.

More information on how to download a GCP service account key can be found [here](https://cloud.google.com/iam/docs/creating-managing-service-account-keys)

### Run Terraform
1. Clone this repository: https://github.com/lacework/terraform-provisioning
2. Download the compiled Lacework Terraform Provider for the platform you are running and place it at `~/.terraform.d/plugins/terraform-provider-lacework`
2. Change directories into `terraform-provisioning/gcp`
3. Create a new file called `terraform.tfvars` with the following content:

| Platform | 64-bit | 32-bit |
|---|---|---|
| MacOS (Darwing) | [`amd64`](https://techally-content.s3-us-west-1.amazonaws.com/terraform-provider-lacework/terraform-provider-lacework-darwin-amd64) | [`i386`](https://techally-content.s3-us-west-1.amazonaws.com/terraform-provider-lacework/terraform-provider-lacework-darwin-386)|
| Linux | [`amd64`](https://techally-content.s3-us-west-1.amazonaws.com/terraform-provider-lacework/terraform-provider-lacework-linux-amd64) | [`i386`](https://techally-content.s3-us-west-1.amazonaws.com/terraform-provider-lacework/terraform-provider-lacework-linux-386)|
| Windows | [`amd64`](https://techally-content.s3-us-west-1.amazonaws.com/terraform-provider-lacework/terraform-provider-lacework-windows-amd64.exe)| [`i386`](https://techally-content.s3-us-west-1.amazonaws.com/terraform-provider-lacework/terraform-provider-lacework-windows-386.exe)|
```
credentials_file = "<PATH TO GCP CREDENTIAL JSON FILE>"
org_integration = true
organization_id = "<GCP_ORG_ID>"
project_id = "<GCP_PROJECT_ID>"
prefix = "<name you want prefixed to resources provisioned>"
audit_log = true
lacework_account = "<YOUR LACEWORK ACCOUNT>"
lacework_api_key = "<THE API KEY FROM LACEWORK JSON FILE>"
lacework_api_secret = "<THE API SECRET FROM LACEWORK JSON FILE>"
lacework_integration_config_name = "<NAME FOR THIS INTEGRATION>"
lacework_integration_auditlog_name = "<NAME FOR THIS INTEGRATION>"
```
or use environment variables to avoid hardcoding API keys and secrets.

_NOTE: This is a temporary step until HashiCorp has released the Lacework Terraform Provider_
```
export TF_VAR_lacework_api_key=<THE API KEY FROM LACEWORK JSON FILE>
export TF_VAR_lacework_api_secret=<THE API SECRET FROM LACEWORK JSON FILE>
```

5. Run `terraform init`
6. Run `terraform apply`

3. Change directories into `terraform-provisioning/gcp`
4. Create a new file called `terraform.tfvars` with the following content:
More information on adding GCP credentials for Terraform can be found [here](https://www.terraform.io/docs/providers/google/guides/getting_started.html#adding-credentials)

## GCP Project Integration
The following section covers how to use Terraform to integrate GCP configuration assessment and Audit Trail on a per project basis.

### Setup GCP Service Account
In order to integrate Lacework with a GCP Project you will need a GCP service account in each project you intend to integrate with the following permissions:
- Project Admin

Download the service account `json` file to your workstation and move on to the next section.

More information on how to download a GCP service account key can be found [here](https://cloud.google.com/iam/docs/creating-managing-service-account-keys)

### Run Terraform
1. Clone this repository: https://github.com/lacework/terraform-provisioning
2. Change directories into `terraform-provisioning/gcp`
3. Create a new file called `terraform.tfvars` with the following content:

```
credentials_file = "<PATH TO GCP CREDENTIAL JSON FILE>"
Expand Down