Skip to content

docs: compliance manual guideliness for azure #152

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
May 19, 2023
Merged

docs: compliance manual guideliness for azure #152

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6dc2289
docs: compliance manual guideliness for azure
Jan 4, 2023
a5cb02a
Merge branch 'master' into compliance-manual-azure
May 19, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions use-cases/manual-compliance.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,15 @@
# Compliance


## AWS
On each account where compliance wants to be checked (`AWS_ACCOUNT_ID`), we need to provide a role for Sysdig to be able to impersonate and perform `SecurityAudit` tasks.

In addition, we must make Sysdig aware of these accounts and role.
We will guide you to provide, on the Sysdig Secure SaaS backend, the following resources:
- a cloud-account for each account of your organization where compliance is wanted to be checked
- a task that will run `aws_foundations_bench-1.3.0` schema on previously defined accounts

## Sysdig Side
### Sysdig Side

1. **Register cloud accounts** on Sysdig

Expand Down Expand Up @@ -81,7 +83,7 @@ From the resulting payload get the `externalId` attribute value, it should be a

<br/>

## Customer's Side
### Customer's Side

Now create `SysdigCompliance` role on each account using the values gathered in previous step.
- Add `arn:aws:iam::aws:policy/SecurityAudit` AWS managed policy
Expand All @@ -99,7 +101,7 @@ Now create `SysdigCompliance` role on each account using the values gathered in
}
```

## End-To-End Validation
### End-To-End Validation

Validate if Sysdig <-> Customer infra connection is properly made using [`/cloud/accounts/{accountId}/validateRole`](https://secure.sysdig.com/swagger.html#tag/Cloud/paths/~1api~1cloud~1v2~1accounts~1{accountId}~1validateRole/get)

Expand All @@ -111,7 +113,7 @@ $ https://<SYSDIG_SECURE_ENDPOINT>/api/cloud/v2/accounts/<AWS_ACCOUNT_ID>/valida
You should get success or the reason of failure.


## Testing
### Testing

Check within Sysdig Secure
- Posture > Compliance for the compliance task schedule
Expand Down