Cloud Onboarding

This topic describes how to connect your AWS, Azure, GCP and OCI environments to Sysdig Secure. Click a tab below to select the platform you want to set up. You can connect Single Accounts or entire Organization Accounts using Terraform or CloudFormation.

AWS

AWS

1. Prerequisites

• A Sysdig Secure administrator account.
• An AWS user or role with permission to install IAM policies, as shown in the table below.
• A local workstation with Terraform v1.5+ installed or access to CloudFormation.
• Docs Help
• Onboard AWS Help

Click to Learn More About Using Terraform and AWS CLI

import TerraformSnippet from ‘/snippets/terraform-snippet.mdx’;

Click to Learn More About IAM Permissions

Access	Description
IAMFullAccess	Required to create IAM Roles and associated permissions.
AWSOrganizationsReadOnlyAccess	Required to list Accounts and OUIDs in your Organization.
AWSCloudFormationFullAccess	Required to create a CloudFormation StackSet that creates IAM roles in each Account in your Organization.

Only IAMFullAccess is required for individual accounts.

2. Collect Your Account Details

• Sign in to the AWS Console. For an Organization, ensure you sign in to your organization’s management account.

• Expand the dropdown in the top right corner of the AWS Console and copy your Account ID.

  You can also get your AWS AccountID by using this command via AWS CLI or the AWS Console terminal:

  aws sts get-caller-identity \
      --query Account \
      --output text
  

• Optional Organization Unit IDs. By default, your entire AWS Organization will be onboarded. If you want to restrict onboarding to a subset of your Organization, you can gather specific OUIDs now and enter them in the following steps.

3. Connect with Terraform

1. Log in

   Log in to Sysdig Secure.

2. Click Integrations

   Click Integrations at the bottom of the main left-hand navigation menu, and choose AWS Cloud Accounts.

3. Choose account type

   Choose whether to connect an AWS Organization or a Single Account.

4. Enter IDs and region

   For Organization accounts, in Step 2, enter your AWS management Account ID and select your Primary Region. For Single Accounts, enter only your AWS Account ID.

5. Enter OUIDs

   In Step 3, you can onboard a subset of your Organization Accounts by entering the OUIDs in a comma-separated list. Leave the field blank to onboard your entire Organization.

6. Generate Terraform file

   In Step 4, click the Next button to generate a main.tf file to use with Terraform. Copy its contents and paste them into a new file, or download the file to an empty folder on your workstation, such as /home/user/sysdig_onboarding.

7. Execute Terraform

   • On your workstation, navigate using the CLI to the folder containing your main.tf file and execute the following commands:

   $ cd /home/user/sysdig_onboarding   # Your main.tf file location
   $ terraform init && terraform apply
   
8. Complete Onboarding

   • When Terraform completes, click the Complete Onboarding button in the Sysdig Secure dashboard. Your newly added account will appear in the Cloud Accounts page.

4. Connect with CloudFormation

• Log in to Sysdig Secure.
• In a separate browser window, log in to your AWS Account. For Organization installs, be sure to log in to your Organization’s Management Account.
• For Organization accounts, in Step 2, enter your AWS management account ID and your OUID(s). For a Single Account, enter only your AWS Account ID.
• In Step 3, click the Launch Stack button. This will shift you to an AWS console browser window. Follow any prompts in AWS to deploy the required resources, and be sure to check the Acknowledgements in the AWS Capabilities section.
• When CloudFormation completes, click the Complete Onboarding button in the Sysdig dashboard. Your newly added account will appear in the Cloud Accounts page.

5. Check the Connection

• To validate your AWS connection, navigate to Sysdig Secure’s Integrations > Environments > AWS.
• Click the Added On column heading to show the most recently added account on top.
• The Status column shows the overall connection status:
  • Connected
  • Error
  • Needs Attention
  • Unknown

Select the desired AWS account to review the individual services in the detail drawer. There you can view the status of each feature you’ve enabled.

See an Example of the Health Status for CSPM

CSPM Status	Description
✅ Healthy	The account has been successfully connected, and all the resources have been scanned.
! Needs Attention	Some features are not working properly.
❌ Error	Authentication errors. For example: Invalid account ID Invalid client secret Invalid access credentials Access token errors Deny policy created by the user is preventing Sysdig from collecting resources The scan takes too long and eventually times out. Unknown error

Further Reading

Learn More About Permissions

Permissions Granted to Sysdig

The above installation creates two IAM Roles that Sysdig can access. These Roles have the following permissions:

• A role named sysdig-secure-onboarding-XXXX, used to manage the base integration with Sysdig
  • AWSAccountManagementReadOnlyAccess
  • AWSOrganizationsReadOnlyAccess (Organizational install)
• A role named sysdig-secure-posture-XXXX, used to collect an inventory of cloud resources and perform CSPM
  • SecurityAudit
  • A Custom IAM Policy containing the following permissions:
    • account:GetContactInformation
    • elasticfilesystem:DescribeAccessPoints
    • lambda:GetFunction
    • lambda:GetRuntimeManagementConfig
    • macie2:ListClassificationJobs
    • waf-regional:ListRuleGroups
    • waf-regional:ListRules
    • bedrock:ListAgents
    • bedrock:GetAgent
    • bedrock:ListKnowledgeBases
    • bedrock:GetKnowledgeBase
    • bedrock:ListGuardrails
    • bedrock:GetGuardrail
    • bedrock:GetModelInvocationLoggingConfiguration

Learn More About Identities Shared with Sysdig

Identities

Two AWS identities are required in the onboarding process:

• Installer: Either an AWS user or a role used to perform the onboarding. Sysdig does not have access to this identity.
• Sysdig: A set of IAM Roles created during onboarding with specific, less permissive permissions attached. Sysdig is given access to these roles.

(Original: https://docs.sysdig.com/en/sysdig-secure/connect-aws/)

Azure

Azure

Cloud Security Posture Management (CSPM)

Cloud Security Posture Management (CSPM):

• Monitors and detects misconfigurations in your cloud resources.
• Ensures your cloud environment complies with industry standards and regulations.
• Provides a comprehensive inventory of all cloud assets, helping you maintain visibility and control over your environment.

To enable CSPM, connect your Azure environment.

Review Azure Roles and Permissions

Security Principals

The onboarding process involves two security principals:

• Installer: The primary security principal, either a User or a Service Principal. This security principal will be used to perform the onboarding. Sysdig does not have access to this security principal.
• Sysdig: A Service Principal (robot user) created during onboarding with specific, less permissive roles. Sysdig will be given access to this security principal.

Azure Role Types

Azure Identity and Access Management (IAM) is separated into two control planes:

• Entra ID Roles: Applied to the entire Tenant.
• Azure RBAC Roles: Applied to the Subscription or Management Group being onboarded.

Prerequisites

• Sysdig Secure SaaS with Admin permissions
• Terraform v1.5.0+ installed
• Azure CLI installed. See How to install the Azure CLI.
• A security principal with the permissions required to install, as mentioned in Security Principals. For the required permissions, see Permissions Required to Install. To grant permissions, you need:
  • SP_ID: Your Installer security principal ID. To retrieve this, open the Azure CLI and use the command az ad sp list --display-name "terraform-runner" --query "[0].appId" --output tsv.
  • ROOT_MANAGEMENT_GROUP_ID: Your Root Management Group ID. To retrieve this, open the Azure CLI and use the command az account management-group list --query "[].{name:name, id:id}" --output tsv.

Prepare Your Environment

1. Configure Installation Permissions

Ensure the principal you log in to Azure with has the necessary roles and permissions to install. You can:

• Use an existing principal who meets the permissions requirements.
• Create a new principal and set up permissions.
• Add permissions to an existing principal.

1. Log in to Azure.
2. Check Entra ID Roles:
   • Navigate to the Entra ID console and select Roles and Administrators.
   • Verify and add necessary roles.
3. Check Azure RBAC Roles:
   • For Single Subscriptions: Navigate to Subscriptions, select the target subscription, and verify roles.
   • For Management Groups: Navigate to Management Groups, select the target group, and verify roles.

2. Authenticate and Configure Terraform

A common way to do this is:

1. Ensure you are logged in to the correct Tenant.
   Log in using the Azure CLI:

az login --tenant "TENANT_ID_OR_DOMAIN"

2. You will be presented with a web page to select your user account. Be sure to log in as the user you configured in Step 1.
3. Confirm you are logged in as the correct user by running:

az ad signed-in-user show

4. For alternative ways to authenticate Terraform, see the Terraform documentation: Authenticating to Azure Active Directory and Authenticating to Azure.

3. Collect your Azure Tenant ID and Subscription ID

Tenant ID

1. Sign in to the Azure portal.
2. Navigate to Microsoft Entra ID > Properties.
3. Scroll down to the Tenant ID section.
4. Find your tenant ID in the box.
5. Select the Copy to clipboard icon shown next to the Tenant ID.
6. Store this value. You can paste this value into a text document or other location.

Subscription ID

1. Sign in to the Azure portal.
2. Under the Azure services heading, select Subscriptions. If you don’t see Subscriptions here, use the search box to find it.
3. Find the subscription in the list, and note the Subscription ID shown in the second column. If no subscriptions appear, or you don’t see the right one, you may need to switch directories to show the subscriptions from a different Microsoft Entra tenant.
4. To easily copy the Subscription ID, select the subscription name to display more details. Select the Copy to clipboard icon shown next to the Subscription ID in the Essentials section. You can paste this value into a text document or other location.

Install Azure Using the Wizard

1. Log in to Sysdig Secure.
2. Select Integrations > Cloud Accounts > Azure and click Add Azure Account on the top right corner.
3. Connect your Azure Tenant or Single Subscription.
   • This enables CSPM and lets you onboard Vulnerability Management and CDR after completing the setup.

Tenant Multi-Subscription

1. Enter your:
   1. Tenant ID: The ID of the tenant you want to onboard.
   2. Subscription ID: The ID of the subscription where the Sysdig resources will be created.
2. Specify Management Groups:
   1. For onboarding the entire Tenant: Enter Root Management Group ID.
   2. For a subset: Enter Management Group IDs in a comma-separated list.
3. Generate and apply the Terraform code:
   1. Create a main.tf file.
   2. Copy the snippet provided into the file.
   3. Run the command: terraform init && terraform apply.

Within an hour after deployment, your accounts will appear on the Cloud Accounts page.

Single Subscription

1. Enter your:
   1. Tenant ID: The ID of the tenant which contains the subscription you want to onboard.
   2. Subscription ID: The ID of the subscription you want to onboard.
2. Generate and apply the Terraform code:
   1. Create a main.tf file.
   2. Copy the snippet provided into the file.
   3. Run the command: terraform init && terraform apply.

Within an hour after deployment, your accounts will appear on the Cloud Accounts page.

Check the Connection Status

Within 5 minutes, after you apply Terraform, your accounts will appear on the Sysdig Cloud Accounts page. You can add more features after this initial connection by following instructions to Add New Features.

You can verify your CSPM configuration by checking the connection status.

1. In Sysdig Secure, select Integrations > Cloud Accounts > Azure.
   The Status column shows the overall connection status:
   • Connected
   • Error
   • Unknown
2. Select the desired account to review the individual services in the detail drawer.
   The health status for CSPM configuration is given below:

CSPM Status	Description
Healthy ✅	The account has been successfully connected, and all the resources have been scanned.
Error ❌	Authentication errors. For example: Invalid account ID Invalid client secret Invalid access credentials Access token errors Deny policy created by the user is preventing Sysdig from collecting resources The scan takes too long and eventually times out. Unknown error

GCP

GCP

OCI

OCI