diff --git a/CHANGELOG.md b/CHANGELOG.md index 1fdc286..9a895ef 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,7 @@ ### Features - Aurora PostgreSQL CloudWatch with slow query auditing example +- Google Cloud SQL for MySQL module ### Bug Fixes - Modified Server Host Name of AWS RDS MS SQL SERVER Dsfhub assets diff --git a/DSF_VERSION_COMPATABILITY.md b/DSF_VERSION_COMPATABILITY.md index 904eca2..05570b0 100644 --- a/DSF_VERSION_COMPATABILITY.md +++ b/DSF_VERSION_COMPATABILITY.md @@ -103,5 +103,9 @@ The following table lists the DSF versions that each module is tested and mainta onboard-gcp-bigquery 4.17+ + + onboard-gcp-mysql + 4.17+ + \ No newline at end of file diff --git a/examples/onboard-gcp-bigquery/README.md b/examples/onboard-gcp-bigquery/README.md index ecf4b93..af3d6f9 100644 --- a/examples/onboard-gcp-bigquery/README.md +++ b/examples/onboard-gcp-bigquery/README.md @@ -1,5 +1,5 @@ # Onboard Google Cloud BigQuery example -This example includes additional prerequisites that will need to be completed to fully utilize the module. More details can be found in the [onboarding documentation](hhttps://docs.imperva.com/bundle/onboarding-databases-to-sonar-reference-guide/page/BigQuery-Onboarding-Steps_48367536.html). +This example includes additional prerequisites that will need to be completed to fully utilize the module. More details can be found in the [onboarding documentation](https://docs.imperva.com/bundle/onboarding-databases-to-sonar-reference-guide/page/BigQuery-Onboarding-Steps_48367536.html). This example creates 'dsfhub' and 'google' resources. More information regarding authentication to each can be found in the relevant provider documentation: - [dsfhub](https://registry.terraform.io/providers/imperva/dsfhub/latest/docs) diff --git a/examples/onboard-gcp-mysql/README.md b/examples/onboard-gcp-mysql/README.md new file mode 100644 index 0000000..ed9e377 --- /dev/null +++ b/examples/onboard-gcp-mysql/README.md @@ -0,0 +1,48 @@ +# Onboard Google Cloud SQL for MySQL example +This example includes additional prerequisites that will need to be completed to fully utilize the module. More details can be found in the [onboarding documentation](https://docs.imperva.com/bundle/onboarding-databases-to-sonar-reference-guide/page/Cloud-SQL-for-MySQL-Onboarding-Steps_48367584.html). + +This example creates 'dsfhub' and 'google' resources. More information regarding authentication to each can be found in the relevant provider documentation: +- [dsfhub](https://registry.terraform.io/providers/imperva/dsfhub/latest/docs) +- [google](https://registry.terraform.io/providers/hashicorp/google/latest/docs) + +## Prerequisites +### Service Account +A Google Service Account will need to be created with permissions to read from PubSub subscriptions. This can be done via the ``google-service-account-dsf`` module. Depending on the authentication mechanism chosen, the service account will either need to be attached to a GCP Compute Engine instance or the service account's credentials file will need to be copied to your Agentless Gateway. + +### Google PubSub Subscription +A Google logging sink, PubSub topic, and PubSub subscription in addition to a GCP PUBSUB asset in DSF will need to be created in advance. This prerequisite is handled by the ``onboard-gcp-pubsub`` module. + + +## Requirements + +No requirements. + +## Providers + +No providers. + +## Modules + +| Name | Source | Version | +|------|--------|---------| +| [gcp-mysql-1](#module\_gcp-mysql-1) | ../../modules/onboard-gcp-mysql | n/a | +| [gcp-mysql-2](#module\_gcp-mysql-2) | ../../modules/onboard-gcp-mysql | n/a | +| [gcp-mysql-3](#module\_gcp-mysql-3) | ../../modules/onboard-gcp-mysql | n/a | +| [gcp-pubsub-1](#module\_gcp-pubsub-1) | ../../modules/onboard-gcp-pubsub | n/a | +| [gcp-pubsub-2-audit](#module\_gcp-pubsub-2-audit) | ../../modules/onboard-gcp-pubsub | n/a | +| [gcp-pubsub-2-slow-query](#module\_gcp-pubsub-2-slow-query) | ../../modules/onboard-gcp-pubsub | n/a | +| [gcp-pubsub-3](#module\_gcp-pubsub-3) | ../../modules/onboard-gcp-pubsub | n/a | +| [service-account](#module\_service-account) | ../../modules/google-service-account-dsf | n/a | + +## Resources + +No resources. + +## Inputs + +No inputs. + +## Outputs + +No outputs. + \ No newline at end of file diff --git a/examples/onboard-gcp-mysql/main.tf b/examples/onboard-gcp-mysql/main.tf new file mode 100644 index 0000000..2bccd3b --- /dev/null +++ b/examples/onboard-gcp-mysql/main.tf @@ -0,0 +1,274 @@ +locals { + admin_email = "test@example.com" + gateway_id = "a1b2c3d4-e5f6-g8h9-wxyz-123456790" + pubsub_auth_mechanism = "default" + + gcp_mysql_instance_authorized_networks = [ + { + name = "local" + value = "127.0.0.1" + } + ] + gcp_project_id = "my-gcp-project" + gcp_service_account_name = "dsf-service-account" + + excluded_traffic_filter = [ + { + name = "exclude-internal-traffic" + filter = "textPayload:\"[root]\" OR \"__google_connectivity_prober\"" + } + ] +} + +################################################################################ +# Providers +################################################################################ +terraform { + required_providers { + dsfhub = { + source = "imperva/dsfhub" + } + } +} + +provider "google" { + # Authenticated via "gcloud" CLI + project = local.gcp_project_id +} + +provider "dsfhub" {} + +################################################################################ +# Prerequisites +# 1. A service account with permissions to read from the PubSub subscription +# 2. A Google sink router, PubSub topic and subscription (handled below) +################################################################################ +module "service-account" { + source = "../../modules/google-service-account-dsf" + + account_id = local.gcp_service_account_name + auth_mechanism = local.pubsub_auth_mechanism + description = "MySQL audit pull service account" + project = local.gcp_project_id + project_roles = [ + "roles/pubsub.subscriber", + "roles/pubsub.viewer" + ] +} + +################################################################################ +# GCP MySQL 8.0 +################################################################################ +locals { + gcp_mysql_1_instance_name = "tf-mysql-8" +} + +module "gcp-pubsub-1" { + source = "../../modules/onboard-gcp-pubsub" + + gcp_pubsub_admin_email = local.admin_email + gcp_pubsub_audit_type = "MYSQL" + gcp_pubsub_auth_mechanism = local.pubsub_auth_mechanism + gcp_pubsub_gateway_id = local.gateway_id + + project = local.gcp_project_id + + pubsub_subscription_name = "${local.gcp_mysql_1_instance_name}-sub" + + pubsub_topic_name = "${local.gcp_mysql_1_instance_name}-topic" + + sink_router_description = "MySQL 8.0 sink" + sink_router_exclusions = local.excluded_traffic_filter + sink_router_filter = < +## Requirements + +No requirements. + +## Providers + +| Name | Version | +|------|---------| +| [dsfhub](#provider\_dsfhub) | n/a | + +## Modules + +No modules. + +## Resources + +| Name | Type | +|------|------| +| [dsfhub_data_source.this](https://registry.terraform.io/providers/imperva/dsfhub/latest/docs/resources/data_source) | resource | + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [admin\_email](#input\_admin\_email) | The email address to notify about the asset. | `string` | n/a | yes | +| [asset\_display\_name](#input\_asset\_display\_name) | User-friendly name of the asset, defined by user | `string` | n/a | yes | +| [asset\_id](#input\_asset\_id) | Unique identifier for the MySQL instance in the form '{project-id}:{instance-region}:{instance-name}'. | `string` | n/a | yes | +| [audit\_pull\_enabled](#input\_audit\_pull\_enabled) | If true, sonargateway will collect the audit logs for this system if it can. | `bool` | `false` | no | +| [gateway\_id](#input\_gateway\_id) | Unique identifier (UID) attached to the jSonar machine controlling the asset | `string` | n/a | yes | +| [logs\_destination\_asset\_id](#input\_logs\_destination\_asset\_id) | The asset\_id of the GCP PUSUB asset that this asset is sending its audit logs to. | `string` | `null` | no | +| [parent\_asset\_id](#input\_parent\_asset\_id) | The asset\_id of the GCP asset representing the GCP account where this data source is located. | `string` | `null` | no | +| [server\_host\_name](#input\_server\_host\_name) | Hostname (or IP if host is unknown) of the GCP MySQL instance | `string` | n/a | yes | +| [server\_ip](#input\_server\_ip) | IP address (or hostname if IP is unknown) of the GCP MySQL instance | `string` | n/a | yes | + +## Outputs + +| Name | Description | +|------|-------------| +| [this](#output\_this) | GCP MYSQL asset | + \ No newline at end of file diff --git a/modules/dsfhub-gcp-mysql/main.tf b/modules/dsfhub-gcp-mysql/main.tf new file mode 100644 index 0000000..1943ebf --- /dev/null +++ b/modules/dsfhub-gcp-mysql/main.tf @@ -0,0 +1,22 @@ +terraform { + required_providers { + dsfhub = { + source = "imperva/dsfhub" + } + } +} + +resource "dsfhub_data_source" "this" { + server_type = "GCP MYSQL" + + admin_email = var.admin_email + asset_display_name = var.asset_display_name + asset_id = var.asset_id + audit_pull_enabled = var.audit_pull_enabled + gateway_id = var.gateway_id + logs_destination_asset_id = var.logs_destination_asset_id + parent_asset_id = var.parent_asset_id + server_host_name = var.server_host_name + server_ip = var.server_ip + +} diff --git a/modules/dsfhub-gcp-mysql/outputs.tf b/modules/dsfhub-gcp-mysql/outputs.tf new file mode 100644 index 0000000..b6fad3b --- /dev/null +++ b/modules/dsfhub-gcp-mysql/outputs.tf @@ -0,0 +1,4 @@ +output "this" { + description = "GCP MYSQL asset" + value = dsfhub_data_source.this +} diff --git a/modules/dsfhub-gcp-mysql/variables.tf b/modules/dsfhub-gcp-mysql/variables.tf new file mode 100644 index 0000000..7babca4 --- /dev/null +++ b/modules/dsfhub-gcp-mysql/variables.tf @@ -0,0 +1,47 @@ +variable "admin_email" { + description = "The email address to notify about the asset." + type = string +} + +variable "asset_display_name" { + description = "User-friendly name of the asset, defined by user" + type = string +} + +variable "asset_id" { + description = "Unique identifier for the MySQL instance in the form '{project-id}:{instance-region}:{instance-name}'." + type = string +} + +variable "audit_pull_enabled" { + description = "If true, sonargateway will collect the audit logs for this system if it can." + type = bool + default = false +} + +variable "gateway_id" { + description = "Unique identifier (UID) attached to the jSonar machine controlling the asset" + type = string +} + +variable "logs_destination_asset_id" { + description = "The asset_id of the GCP PUSUB asset that this asset is sending its audit logs to." + type = string + default = null +} + +variable "parent_asset_id" { + description = "The asset_id of the GCP asset representing the GCP account where this data source is located." + type = string + default = null +} + +variable "server_host_name" { + description = "Hostname (or IP if host is unknown) of the GCP MySQL instance" + type = string +} + +variable "server_ip" { + description = "IP address (or hostname if IP is unknown) of the GCP MySQL instance" + type = string +} diff --git a/modules/dsfhub-gcp-pubsub/README.md b/modules/dsfhub-gcp-pubsub/README.md index 24d2f87..33160b5 100644 --- a/modules/dsfhub-gcp-pubsub/README.md +++ b/modules/dsfhub-gcp-pubsub/README.md @@ -1,13 +1,15 @@ ## Requirements -No requirements. +| Name | Version | +|------|---------| +| [dsfhub](#requirement\_dsfhub) | >= 1.3.5 | ## Providers | Name | Version | |------|---------| -| [dsfhub](#provider\_dsfhub) | n/a | +| [dsfhub](#provider\_dsfhub) | >= 1.3.5 | ## Modules @@ -27,8 +29,9 @@ No modules. | [asset\_display\_name](#input\_asset\_display\_name) | User-friendly name of the asset, defined by user | `string` | n/a | yes | | [asset\_id](#input\_asset\_id) | Unique identifier of the Google PubSub Subscription in the form 'projects/{{project}}/subscriptions/{{name}}'. | `string` | n/a | yes | | [audit\_pull\_enabled](#input\_audit\_pull\_enabled) | If true, sonargateway will collect the audit logs for this system if it can. | `bool` | `false` | no | -| [audit\_type](#input\_audit\_type) | Identifier for the type of audit data contained within the PubSub Subscription. Supported values: ALLOYDB\_POSTGRESQL, BIGQUERY, BIGTABLE, MYSQL, MYSQL\_SLOW, MSSQL, POSTGRESQL, SPANNER. | `string` | `null` | no | +| [audit\_type](#input\_audit\_type) | Identifier for the type of audit data contained within the PubSub Subscription. Supported values: ALLOYDB\_POSTGRESQL, BIGQUERY, BIGTABLE, GCP\_MYSQL\_SLOW, MYSQL, MSSQL, POSTGRESQL, SPANNER. | `string` | `null` | no | | [auth\_mechanism](#input\_auth\_mechanism) | Specifies the auth mechanism used by the connection. Supported values: default, service\_account. | `string` | `"default"` | no | +| [content\_type](#input\_content\_type) | Desired 'parent' asset 'Server Type' which is the one tha tuses this asset as a destination for logs. NOTE: The content\_type field will take precedence on the lookup for parent\_asset\_id field when checking which server is sending logs to this asset. | `string` | `null` | no | | [gateway\_id](#input\_gateway\_id) | Unique identifier (UID) attached to the jSonar machine controlling the asset | `string` | n/a | yes | | [key\_file](#input\_key\_file) | Path to JSON file with credentials info (service account's key) residing on your Agentless Gateway. File must be accessible by the sonarw OS user. Required when auth\_mechanism is set to 'service\_account'. | `string` | `null` | no | | [pubsub\_subscription](#input\_pubsub\_subscription) | ID of the Google PubSub Subscription in the form 'projects/{{project}}/subscriptions/{{name}}'. | `string` | n/a | yes | diff --git a/modules/dsfhub-gcp-pubsub/main.tf b/modules/dsfhub-gcp-pubsub/main.tf index 16d50d3..1621592 100644 --- a/modules/dsfhub-gcp-pubsub/main.tf +++ b/modules/dsfhub-gcp-pubsub/main.tf @@ -1,7 +1,8 @@ terraform { required_providers { dsfhub = { - source = "imperva/dsfhub" + source = "imperva/dsfhub" + version = ">= 1.3.5" } } } @@ -14,6 +15,7 @@ resource "dsfhub_log_aggregator" "this" { asset_id = var.asset_id audit_pull_enabled = var.audit_pull_enabled audit_type = var.audit_type + content_type = var.content_type gateway_id = var.gateway_id pubsub_subscription = var.pubsub_subscription server_host_name = "pubsub.googleapis.com" diff --git a/modules/dsfhub-gcp-pubsub/variables.tf b/modules/dsfhub-gcp-pubsub/variables.tf index 7160ae1..a672aa7 100644 --- a/modules/dsfhub-gcp-pubsub/variables.tf +++ b/modules/dsfhub-gcp-pubsub/variables.tf @@ -20,7 +20,7 @@ variable "audit_pull_enabled" { } variable "audit_type" { - description = "Identifier for the type of audit data contained within the PubSub Subscription. Supported values: ALLOYDB_POSTGRESQL, BIGQUERY, BIGTABLE, MYSQL, MYSQL_SLOW, MSSQL, POSTGRESQL, SPANNER." + description = "Identifier for the type of audit data contained within the PubSub Subscription. Supported values: ALLOYDB_POSTGRESQL, BIGQUERY, BIGTABLE, GCP_MYSQL_SLOW, MYSQL, MSSQL, POSTGRESQL, SPANNER." type = string default = null validation { @@ -29,8 +29,8 @@ variable "audit_type" { "ALLOYDB_POSTGRESQL", "BIGQUERY", "BIGTABLE", + "GCP_MYSQL_SLOW", "MYSQL", - "MYSQL_SLOW", "MSSQL", "POSTGRESQL", "SPANNER" @@ -51,6 +51,12 @@ variable "auth_mechanism" { } } +variable "content_type" { + description = "Desired 'parent' asset 'Server Type' which is the one tha tuses this asset as a destination for logs. NOTE: The content_type field will take precedence on the lookup for parent_asset_id field when checking which server is sending logs to this asset." + type = string + default = null +} + variable "gateway_id" { description = "Unique identifier (UID) attached to the jSonar machine controlling the asset" type = string diff --git a/modules/google-logging-project-sink/main.tf b/modules/google-logging-project-sink/main.tf index 7e20c1d..b70c0c4 100644 --- a/modules/google-logging-project-sink/main.tf +++ b/modules/google-logging-project-sink/main.tf @@ -7,7 +7,7 @@ resource "google_logging_project_sink" "this" { dynamic "exclusions" { # If exclusions is not defined, do not create - for_each = var.exclusions != null ? [0] : [] + for_each = var.exclusions != null ? var.exclusions : [] content { description = exclusions.value.description diff --git a/modules/google-sql-database-instance/README.md b/modules/google-sql-database-instance/README.md new file mode 100644 index 0000000..7a83f6a --- /dev/null +++ b/modules/google-sql-database-instance/README.md @@ -0,0 +1,42 @@ + +## Requirements + +No requirements. + +## Providers + +| Name | Version | +|------|---------| +| [google](#provider\_google) | n/a | + +## Modules + +No modules. + +## Resources + +| Name | Type | +|------|------| +| [google_sql_database_instance.this](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance) | resource | + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [authorized\_networks](#input\_authorized\_networks) | A list of authorized network blocks as defined below.

authorized\_network:
- expiration\_time: (Optional) The RFC 3339 formatted date time string indicating when this whitelist expires.
- name: (Optional) A name for this whitelist entry.
- value: A CIDR notation IPv4 or IPv6 address that is allowed to access this instance. |
list(
object(
{
expiration_time = optional(string)
name = optional(string)
value = string
}
)
)
| `null` | no | +| [database\_flags](#input\_database\_flags) | List of database flags to assign to the instance. |
list(
object(
{
name = string
value = string
}
)
)
| `null` | no | +| [database\_version](#input\_database\_version) | The MySQL, PostgreSQL or SQL Server version to use. The full list of supported versions can be found at https://cloud.google.com/sql/docs/db-versions. | `string` | n/a | yes | +| [deletion\_protection](#input\_deletion\_protection) | Whether Terraform will be prevented from destroying the instance. When the field is set to true or unset in Terraform state, a terraform apply or terraform destroy that would delete the instance will fail. When the field is set to false, deleting the instance is allowed. | `bool` | `false` | no | +| [name](#input\_name) | The name of the instance. | `string` | n/a | yes | +| [project](#input\_project) | The ID of the project that the service account will be created in. | `string` | `null` | no | +| [region](#input\_region) | The region the instance will sit in. If a region is not provided in the resource definition, the provider region will be used instead. | `string` | `null` | no | +| [root\_password](#input\_root\_password) | Initial root password. Can be updated. Required for MS SQL Server. | `string` | `null` | no | +| [sql\_server\_audit\_config](#input\_sql\_server\_audit\_config) | A block describing a SQL Server audit configuration as described below.

- bucket: (Optional) The name of the destination bucket (e.g., gs://mybucket).
- upload\_interval: (Optional) How often to upload generated audit files. A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s".
- retention\_interval: (Optional) How long to keep generated audit files. A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s". |
object({
bucket = optional(string)
upload_interval = optional(string)
retention_interval = optional(string)
})
| `null` | no | +| [tier](#input\_tier) | The machine type to use. See [tiers](https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1beta4/tiers) for more details and supported versions | `string` | `"db-f1-micro"` | no | + +## Outputs + +| Name | Description | +|------|-------------| +| [this](#output\_this) | Google SQL database instance | + \ No newline at end of file diff --git a/modules/google-sql-database-instance/main.tf b/modules/google-sql-database-instance/main.tf new file mode 100644 index 0000000..cf699e2 --- /dev/null +++ b/modules/google-sql-database-instance/main.tf @@ -0,0 +1,43 @@ +resource "google_sql_database_instance" "this" { + database_version = var.database_version + deletion_protection = var.deletion_protection + name = var.name + project = var.project + region = var.region + root_password = var.root_password + + settings { + tier = var.tier + + dynamic "database_flags" { + for_each = var.database_flags != null ? var.database_flags : [] + + content { + name = database_flags.value.name + value = database_flags.value.value + } + } + + ip_configuration { + dynamic "authorized_networks" { + for_each = var.authorized_networks != null ? var.authorized_networks : [] + + content { + expiration_time = authorized_networks.value.expiration_time + name = authorized_networks.value.name + value = authorized_networks.value.value + } + } + } + + dynamic "sql_server_audit_config" { + for_each = var.sql_server_audit_config != null ? [0] : [] + + content { + bucket = var.sql_server_audit_config.bucket + upload_interval = var.sql_server_audit_config.upload_interval + retention_interval = var.sql_server_audit_config.retention_interval + } + } + } +} diff --git a/modules/google-sql-database-instance/outputs.tf b/modules/google-sql-database-instance/outputs.tf new file mode 100644 index 0000000..c58fe10 --- /dev/null +++ b/modules/google-sql-database-instance/outputs.tf @@ -0,0 +1,4 @@ +output "this" { + description = "Google SQL database instance" + value = google_sql_database_instance.this +} diff --git a/modules/google-sql-database-instance/variables.tf b/modules/google-sql-database-instance/variables.tf new file mode 100644 index 0000000..cd1ede5 --- /dev/null +++ b/modules/google-sql-database-instance/variables.tf @@ -0,0 +1,97 @@ +variable "authorized_networks" { + description = < +## Requirements + +No requirements. + +## Providers + +No providers. + +## Modules + +| Name | Source | Version | +|------|--------|---------| +| [gcp-mysql-asset](#module\_gcp-mysql-asset) | ../dsfhub-gcp-mysql | n/a | +| [gcp-mysql-instance](#module\_gcp-mysql-instance) | ../google-sql-database-instance | n/a | + +## Resources + +No resources. + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [gcp\_mysql\_admin\_email](#input\_gcp\_mysql\_admin\_email) | The email address to notify about the asset. | `string` | n/a | yes | +| [gcp\_mysql\_audit\_pull\_enabled](#input\_gcp\_mysql\_audit\_pull\_enabled) | If true, sonargateway will collect the audit logs for this system if it can. | `bool` | `false` | no | +| [gcp\_mysql\_gateway\_id](#input\_gcp\_mysql\_gateway\_id) | Unique identifier (UID) attached to the jSonar machine controlling the asset | `string` | n/a | yes | +| [gcp\_mysql\_logs\_destination\_asset\_id](#input\_gcp\_mysql\_logs\_destination\_asset\_id) | The asset\_id of the GCP PUSUB asset that this asset is sending its audit logs to. | `string` | n/a | yes | +| [gcp\_mysql\_parent\_asset\_id](#input\_gcp\_mysql\_parent\_asset\_id) | The asset\_id of the GCP asset representing the GCP account where this data source is located. | `string` | `null` | no | +| [instance\_authorized\_networks](#input\_instance\_authorized\_networks) | A list of authorized network blocks as defined below.

authorized\_network:
- expiration\_time: (Optional) The RFC 3339 formatted date time string indicating when this whitelist expires.
- name: (Optional) A name for this whitelist entry.
- value: A CIDR notation IPv4 or IPv6 address that is allowed to access this instance. |
list(
object(
{
expiration_time = optional(string)
name = optional(string)
value = string
}
)
)
| n/a | yes | +| [instance\_database\_flags](#input\_instance\_database\_flags) | List of database flags to assign to the instance. |
list(
object(
{
name = string
value = string
}
)
)
|
[
{
"name": "log_output",
"value": "FILE"
},
{
"name": "general_log",
"value": "on"
}
]
| no | +| [instance\_database\_version](#input\_instance\_database\_version) | The MySQL version to use. The full list of supported versions can be found at https://cloud.google.com/sql/docs/db-versions. | `string` | `"MYSQL_8_0"` | no | +| [instance\_deletion\_protection](#input\_instance\_deletion\_protection) | Whether Terraform will be prevented from destroying the instance. When the field is set to true or unset in Terraform state, a terraform apply or terraform destroy that would delete the instance will fail. When the field is set to false, deleting the instance is allowed. | `bool` | `false` | no | +| [instance\_name](#input\_instance\_name) | The name of the instance. | `string` | n/a | yes | +| [instance\_project](#input\_instance\_project) | The ID of the project that the service account will be created in. | `string` | `null` | no | +| [instance\_region](#input\_instance\_region) | The region the instance will sit in. If a region is not provided in the resource definition, the provider region will be used instead. | `string` | `null` | no | +| [instance\_tier](#input\_instance\_tier) | The machine type to use. See [tiers](https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1beta4/tiers) for more details and supported versions | `string` | `"db-f1-micro"` | no | + +## Outputs + +| Name | Description | +|------|-------------| +| [gcp-mysql-asset](#output\_gcp-mysql-asset) | GCP MYSQL asset | +| [gcp-mysql-instance](#output\_gcp-mysql-instance) | Google MySQL database instance | + \ No newline at end of file diff --git a/modules/onboard-gcp-mysql/main.tf b/modules/onboard-gcp-mysql/main.tf new file mode 100644 index 0000000..4f18686 --- /dev/null +++ b/modules/onboard-gcp-mysql/main.tf @@ -0,0 +1,28 @@ +module "gcp-mysql-instance" { + source = "../google-sql-database-instance" + + authorized_networks = var.instance_authorized_networks + database_flags = var.instance_database_flags + database_version = var.instance_database_version + deletion_protection = var.instance_deletion_protection + name = var.instance_name + project = var.instance_project + region = var.instance_region + root_password = null + sql_server_audit_config = null + tier = var.instance_tier +} + +module "gcp-mysql-asset" { + source = "../dsfhub-gcp-mysql" + + admin_email = var.gcp_mysql_admin_email + asset_display_name = module.gcp-mysql-instance.this.name + asset_id = "${module.gcp-mysql-instance.this.project}:${module.gcp-mysql-instance.this.region}:${module.gcp-mysql-instance.this.name}" + audit_pull_enabled = var.gcp_mysql_audit_pull_enabled + gateway_id = var.gcp_mysql_gateway_id + logs_destination_asset_id = var.gcp_mysql_logs_destination_asset_id + parent_asset_id = var.gcp_mysql_parent_asset_id + server_host_name = module.gcp-mysql-instance.this.ip_address.0.ip_address + server_ip = module.gcp-mysql-instance.this.ip_address.0.ip_address +} diff --git a/modules/onboard-gcp-mysql/outputs.tf b/modules/onboard-gcp-mysql/outputs.tf new file mode 100644 index 0000000..2296af5 --- /dev/null +++ b/modules/onboard-gcp-mysql/outputs.tf @@ -0,0 +1,9 @@ +output "gcp-mysql-instance" { + description = "Google MySQL database instance" + value = module.gcp-mysql-instance.this +} + +output "gcp-mysql-asset" { + description = "GCP MYSQL asset" + value = module.gcp-mysql-asset.this +} diff --git a/modules/onboard-gcp-mysql/variables.tf b/modules/onboard-gcp-mysql/variables.tf new file mode 100644 index 0000000..9a45200 --- /dev/null +++ b/modules/onboard-gcp-mysql/variables.tf @@ -0,0 +1,109 @@ +variable "gcp_mysql_admin_email" { + description = "The email address to notify about the asset." + type = string +} + +variable "gcp_mysql_audit_pull_enabled" { + description = "If true, sonargateway will collect the audit logs for this system if it can." + type = bool + default = false +} + +variable "gcp_mysql_gateway_id" { + description = "Unique identifier (UID) attached to the jSonar machine controlling the asset" + type = string +} + +variable "gcp_mysql_logs_destination_asset_id" { + description = "The asset_id of the GCP PUSUB asset that this asset is sending its audit logs to." + type = string +} + +variable "gcp_mysql_parent_asset_id" { + description = "The asset_id of the GCP asset representing the GCP account where this data source is located." + type = string + default = null +} + +variable "instance_authorized_networks" { + description = < [gcp\_pubsub\_admin\_email](#input\_gcp\_pubsub\_admin\_email) | The email address to notify about the asset. | `string` | n/a | yes | | [gcp\_pubsub\_audit\_pull\_enabled](#input\_gcp\_pubsub\_audit\_pull\_enabled) | If true, sonargateway will collect the audit logs for this system if it can. | `bool` | `null` | no | -| [gcp\_pubsub\_audit\_type](#input\_gcp\_pubsub\_audit\_type) | Identifier for the type of audit data contained within the PubSub Subscription. Supported values: ALLOYDB\_POSTGRESQL, BIGQUERY, BIGTABLE, MYSQL, MYSQL\_SLOW, MSSQL, POSTGRESQL, SPANNER. | `string` | `null` | no | +| [gcp\_pubsub\_audit\_type](#input\_gcp\_pubsub\_audit\_type) | Identifier for the type of audit data contained within the PubSub Subscription. Supported values: ALLOYDB\_POSTGRESQL, BIGQUERY, BIGTABLE, GCP\_MYSQL\_SLOW, MYSQL, MSSQL, POSTGRESQL, SPANNER. | `string` | `null` | no | | [gcp\_pubsub\_auth\_mechanism](#input\_gcp\_pubsub\_auth\_mechanism) | Specifies the auth mechanism used by the connection. Supported values: default, service\_account. | `string` | `"default"` | no | +| [gcp\_pubsub\_content\_type](#input\_gcp\_pubsub\_content\_type) | Desired 'parent' asset 'Server Type' which is the one tha tuses this asset as a destination for logs. NOTE: The content\_type field will take precedence on the lookup for parent\_asset\_id field when checking which server is sending logs to this asset. | `string` | `null` | no | | [gcp\_pubsub\_gateway\_id](#input\_gcp\_pubsub\_gateway\_id) | Unique identifier (UID) attached to the jSonar machine controlling the asset | `string` | n/a | yes | | [gcp\_pubsub\_key\_file](#input\_gcp\_pubsub\_key\_file) | Path to JSON file with credentials info (service account's key) residing on your Agentless Gateway. File must be accessible by the sonarw OS user. Required when auth\_mechanism is set to 'service\_account'. | `string` | `null` | no | | [gcp\_pubsub\_reason](#input\_gcp\_pubsub\_reason) | Used to differentiate connections that belong to the same asset | `string` | `"default"` | no | diff --git a/modules/onboard-gcp-pubsub/main.tf b/modules/onboard-gcp-pubsub/main.tf index f397b10..a91ce6a 100644 --- a/modules/onboard-gcp-pubsub/main.tf +++ b/modules/onboard-gcp-pubsub/main.tf @@ -55,6 +55,7 @@ module "gcp-pubsub-asset" { audit_pull_enabled = var.gcp_pubsub_audit_pull_enabled audit_type = var.gcp_pubsub_audit_type auth_mechanism = var.gcp_pubsub_auth_mechanism + content_type = var.gcp_pubsub_content_type gateway_id = var.gcp_pubsub_gateway_id key_file = var.gcp_pubsub_key_file pubsub_subscription = module.pubsub-subscription.this.id diff --git a/modules/onboard-gcp-pubsub/variables.tf b/modules/onboard-gcp-pubsub/variables.tf index 2a4ac1e..72f3c9a 100644 --- a/modules/onboard-gcp-pubsub/variables.tf +++ b/modules/onboard-gcp-pubsub/variables.tf @@ -10,7 +10,7 @@ variable "gcp_pubsub_audit_pull_enabled" { } variable "gcp_pubsub_audit_type" { - description = "Identifier for the type of audit data contained within the PubSub Subscription. Supported values: ALLOYDB_POSTGRESQL, BIGQUERY, BIGTABLE, MYSQL, MYSQL_SLOW, MSSQL, POSTGRESQL, SPANNER." + description = "Identifier for the type of audit data contained within the PubSub Subscription. Supported values: ALLOYDB_POSTGRESQL, BIGQUERY, BIGTABLE, GCP_MYSQL_SLOW, MYSQL, MSSQL, POSTGRESQL, SPANNER." type = string default = null validation { @@ -19,8 +19,8 @@ variable "gcp_pubsub_audit_type" { "ALLOYDB_POSTGRESQL", "BIGQUERY", "BIGTABLE", + "GCP_MYSQL_SLOW", "MYSQL", - "MYSQL_SLOW", "MSSQL", "POSTGRESQL", "SPANNER" @@ -41,6 +41,12 @@ variable "gcp_pubsub_auth_mechanism" { } } +variable "gcp_pubsub_content_type" { + description = "Desired 'parent' asset 'Server Type' which is the one tha tuses this asset as a destination for logs. NOTE: The content_type field will take precedence on the lookup for parent_asset_id field when checking which server is sending logs to this asset." + type = string + default = null +} + variable "gcp_pubsub_gateway_id" { description = "Unique identifier (UID) attached to the jSonar machine controlling the asset" type = string