Skip to content

Commit d1a5eab

Browse files
jujufughgustavo_saurez
jujufugh
and
gustavo_saurez
authored
SFD 2.0 Terraform Stack - Deploy option (#49)
* Trend of Identity API Calls widget * SFD updates and repo maint * Region Filter for SFD dashboards * SFD Security Operations screenshot update * SFD Region Filter * added to github --------- Co-authored-by: gustavo_saurez <gustavo.saurez@oracle.com>
1 parent 3f7f26b commit d1a5eab

File tree

7 files changed

+364
-0
lines changed

7 files changed

+364
-0
lines changed

‎knowlege-content/MAP/security-fundamentals-dashboards/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
# Security Fundamentals Dashboards for MAP
22

3+
[![Deploy to Oracle Cloud](https://oci-resourcemanager-plugin.plugins.oci.oraclecloud.com/latest/deploy-to-oracle-cloud.svg)](https://cloud.oracle.com/resourcemanager/stacks/create?zipUrl=https://github.com/jujufugh/oci-o11y-solutions/releases/download/security-fundamentals-dashboard/sfd-la-2.0.zip)
4+
35
### Dashboards screenshots
46
* Identity Dashboard
57
![Out-of-Box Dashboard for Identity Security](images/identity_security_dashboard_identity_domain.png)

‎knowlege-content/MAP/security-fundamentals-dashboards/modules/sfd/README.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# oci-iam-dashboard
2+
[![Deploy to Oracle Cloud](https://oci-resourcemanager-plugin.plugins.oci.oraclecloud.com/latest/deploy-to-oracle-cloud.svg)](https://cloud.oracle.com/resourcemanager/stacks/create?zipUrl=https://github.com/gsrz23/oci-iam-dashboard/archive/refs/heads/main.zip)
3+
4+
This repository provides an OCI Logging Analytics Dashboard with some sample widgets to monitor and visualize audit Events for OCI IAM Identity Domains. The Dashboard will only work in OCI Tenancies that [support IAM Identity Domains](https://docs.oracle.com/en-us/iaas/Content/Identity/getstarted/identity-domains.htm#identity_documentation__updated-identity-domains).
5+
6+
7+
## Overview
8+
9+
The Audit Logs for OCI IAM Identity Domains can be obtained directly from the OCI Audit Service along with the events from other OCI Services. The IDCS Rest APIs can still be used, but the Audit Service is more convenient since Audit logs can be easily pushed to Streaming, Object Storage, etc. The solution in this repository deploys Service Connector Hub to send OCI Audit Logs to Logging Analytics. It also deploys a sample Dashboard to visualize the audit logs for OCI IAM Identity Domains.
10+
11+
![Dashboard1](images/Dashboard1.png)
12+
![Dashboard3](images/Dashboard3.png)
13+
![Dashboard2](images/Dashboard2.png)
14+
15+
16+
## Resources
17+
18+
The following resources are provisioned with terraform or Resource Manager
19+
20+
- **Logging Analytics**: This is a regional service. It will be onboarded in the selected region if not available yet. This can incur some storage costs.
21+
- **Custom Logging Analytics Fields**: Some custom fields are provisioned in Logging Analytics to support parsing and querying of the OCI Audit Logs. The fields include: IAM Domain Name, IAM Event ID, IAM Actor Name, IAM Actor Type, IAM Target Name, IAM CLIENT IP, IAM Identity Provider, etc.
22+
- **Custom Logging Analytics Parser**: The parser *IAM Audit Log Format* is used to parse the additionalDetails field from the OCI Audit Logs for Identity Audit Logs.
23+
- **OCI Audit Logs Source**: The OOB source *OCI Audit Logs* is modified to include the above parser.
24+
- **Loggin Analytics Log Group**: A Log Group named *iam_identity_domain_audit_${var.iam_dashboard_domainname}* is provisioned as the target for Service Connector Hub.
25+
- **Service Connector Hub**: A SCH named *IAM Identity Domain Audit to Logging Analytics* is provisioned to push OCI Audit Logs from a specific compartment to Logging Analytics.
26+
- **IAM Policy**: A Policy named *IAM_Dashboard_ConnectorPolicy_LoggingAnalytics_${var.iam_dashboard_domainname}* that allows SCH to publish logs to the Logging Analytics Log Group.
27+
- **IAM Dashboard**: A sample Loggin Analytics dashboard and with queries based on the custom fields.
28+
29+
## Deployment Notes
30+
31+
The following variables are used for deployment:
32+
33+
- **iam_dashboard_domain_ocid** is the OCID of the existing OCI IAM Identity Domain to be used in the Dashboard queries.
34+
- **region** is Base Region of the IAM Identity Domain. Logging Analytics will be onboarded in this region if needed.
35+
- **iam_dashboard_compartmentid** is the compartment ID where the OCI IAM Identity Domain resides and where the dashboard and saved queries are deployed.
36+
- **create_service_connector_audit** set to true if a SCH is needed to push OCI Audit Logs to Logging Analytics. It's provisioned in the compartment *iam_dashboard_compartmentid*. The default is *false*
37+
- **service_connector_audit_state** is the initial stated of the SCH if provisioned. Allowed values are *INACTIVE* (default) and *ACTIVE*
38+
- **logging_analytics_log_group_name** is the name of the Logging Analytics Log Group that will have the Audit Logs.
39+
- **am_dashboard_details** a template to import dashboards, it's based on the variables *iam_dashboard_domainname* and *iam_dashboard_compartmentid*
40+
41+
To deploy multiple Dashboards use a different stack for each one specifying the respective variables.
42+
43+
If multiple dashboards are created in the same compartment, there's no need to create a SCH for each. They can all share one SCH. The same goes for the Logging Analytics Log Group.
44+
45+
A provisioned Dashboard can't be modified with terraform, any modification to the variable *am_dashboard_details* will create a new dashboard and new saved queries.
46+
47+
Some considerations when using the terraform *destroy* command:
48+
- The Logging Analytics dashboard and customizations are removed from the terraform state but not from Logging Analytics.
49+
- A Dashboard and its Saved Queries have to be removed manually from the console or with API calls.
50+
- The Logging Analytics Log Group won't be destroyed if it contains data.
51+
- Logging Analytics service is not offboarded with the destroy command.
52+
- To remove the Logging Analytics customizations do the following from the Logging Analytics Administration Menu:
53+
- Edit the OOB Source *OCI Audit Logs* and in the Parser section click Default and then save the source
54+
- Delete the custom Parser *IAM Audit Log Format*
55+
- Delete all the custom fields with name that starts with IAM: IAM Domain Name, IAM EventID, IAM Actor Name, etc.

‎knowlege-content/MAP/security-fundamentals-dashboards/modules/sfd/provider.tf‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Copyright (c) 2021 Oracle and/or its affiliates.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
3+
4+
5+
6+
provider "oci" {
7+
region = var.region
8+
tenancy_ocid = var.tenancy_ocid
9+
user_ocid = var.user_ocid
10+
fingerprint = var.fingerprint
11+
private_key_path = var.private_key_path
12+
private_key_password = var.private_key_password
13+
}
14+
15+
provider "oci" {
16+
alias = "token"
17+
auth = "SecurityToken"
18+
config_file_profile = "IDDomain"
19+
region = var.region
20+
}
21+
22+
provider "oci" {
23+
alias = "home"
24+
region = lookup(local.regions_map, data.oci_identity_tenancy.tenancy.home_region_key)
25+
tenancy_ocid = var.tenancy_ocid
26+
user_ocid = var.user_ocid
27+
fingerprint = var.fingerprint
28+
private_key_path = var.private_key_path
29+
private_key_password = var.private_key_password
30+
}

‎knowlege-content/MAP/security-fundamentals-dashboards/modules/sfd/schema.yml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
# Copyright (c) 2021 Oracle and/or its affiliates.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
3+
4+
title: "OCI Security Fundamentals Dashboards Deployment"
5+
stackDescription: "A stack to deploy Logging Analytics Dashboards for OCI."
6+
schemaVersion: 1.1.0
7+
version: "0.0.1"
8+
locale: "en"
9+
10+
variableGroups:
11+
- title: "Dashboards Region and Compartment Information"
12+
variables:
13+
- "region"
14+
- "sfd_compartment_ocid"
15+
16+
- title: "Service Connector for Logging Analytics"
17+
variables:
18+
- "create_service_connector_audit"
19+
- "logging_analytics_log_group_name"
20+
- "service_connector_audit_state"
21+
22+
- title: "Hidden Variables"
23+
visible: false
24+
variables:
25+
- "tenancy_ocid"
26+
- "user_ocid"
27+
- "fingerprint"
28+
- "private_key_path"
29+
- "private_key_password"
30+
- "iam_dashboard_import_custom_content_file"
31+
32+
variables:
33+
region:
34+
type: oci:identity:region:name
35+
title: "Dashboards Region"
36+
description: "Base Region of Dashboards. Note: Logging Analytics will be onboarded on this region"
37+
required: true
38+
39+
sfd_compartment_ocid:
40+
type: oci:identity:compartment:id
41+
title: "Dashboard Compartment Name"
42+
description: "Compartment where the dashboards and saved queries will be deployed"
43+
required: true
44+
45+
create_service_connector_audit:
46+
type: boolean
47+
title: "Create Service Connector for IAM Identity Domain Audit?"
48+
description: "Creates a Service Connector for IAM Identity Domain Audit logs with Logging Analytics as the Target. It's created in the same compartment as the Dashboard"
49+
required: true
50+
default: false
51+
52+
service_connector_audit_state:
53+
type: enum
54+
required: false
55+
title: "Service Connector Hub State"
56+
description: "Initial state in which to create the Service Connector Hub for Audit logs."
57+
default: INACTIVE
58+
visible: create_service_connector_audit
59+
enum:
60+
- INACTIVE
61+
- ACTIVE
62+
63+
logging_analytics_log_group_name:
64+
type: string
65+
required: true
66+
default: "sfd_identity_domain_audit"
67+
description: "Name of the Logging Analytics Log Group that will have the Audit Logs"
68+
title: "Logging Analytic Log Group Name"
69+
visible: create_service_connector_audit
70+
71+
# Variables not required to display to user
72+
user_ocid:
73+
type: string
74+
75+
fingerprint:
76+
type: string
77+
78+
private_key_path:
79+
type: string
80+
81+
private_key_password:
82+
type: password
83+
84+

‎knowlege-content/MAP/security-fundamentals-dashboards/modules/sfd/sfd_dashboard.tf‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
# Copyright (c) 2021 Oracle and/or its affiliates.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
3+
4+
5+
locals {
6+
# iam_dashboard_domainname = data.oci_identity_domain.oci_dashboard_identity_domain.display_name
7+
regions_map = { for r in data.oci_identity_regions.these.regions : r.key => r.name } # All regions indexed by region key.
8+
sfd_repo = "https://raw.githubusercontent.com/oracle-quickstart/oci-o11y-solutions/main/knowlege-content/MAP/security-fundamentals-dashboards/"
9+
dashboard_names = toset(["Identity%20Security.json","Network%20Security.json","Security%20Operations.json"])
10+
11+
}
12+
13+
data "oci_identity_regions" "these" {}
14+
data oci_identity_tenancy tenancy {
15+
tenancy_id = var.tenancy_ocid
16+
}
17+
18+
data "http" "security_dashboards" {
19+
for_each = local.dashboard_names
20+
url = "${local.sfd_repo}${each.value}"
21+
request_headers = {
22+
Accept = "application/json"
23+
}
24+
}
25+
26+
data "oci_logging_log_groups" "oci_log_groups" {
27+
#Required
28+
compartment_id = var.sfd_compartment_ocid
29+
30+
#Optional
31+
display_name = "_Audit_Include_Subcompartment"
32+
#is_compartment_id_in_subtree = var.log_group_is_compartment_id_in_subtree
33+
}
34+
35+
36+
# output "audit_id" {
37+
# value = data.oci_logging_log_groups.oci_log_groups.id
38+
# }
39+
40+
data "oci_objectstorage_namespace" "ns" {
41+
compartment_id = var.sfd_compartment_ocid
42+
}
43+
44+
data "oci_log_analytics_namespaces" "sfd_dashboard_namespaces" {
45+
compartment_id = var.tenancy_ocid
46+
}
47+
48+
resource "oci_log_analytics_namespace" "sfd_dashboard_namespace" {
49+
count = data.oci_log_analytics_namespaces.sfd_dashboard_namespaces.namespace_collection.0.items.0.is_onboarded ? 0 : 1
50+
namespace = data.oci_objectstorage_namespace.ns.namespace
51+
is_onboarded = true
52+
compartment_id = var.tenancy_ocid
53+
}
54+
55+
56+
resource "time_sleep" "wait_40_seconds" {
57+
count = data.oci_log_analytics_namespaces.sfd_dashboard_namespaces.namespace_collection.0.items.0.is_onboarded ? 0 : 1
58+
depends_on = [oci_log_analytics_namespace.sfd_dashboard_namespace]
59+
create_duration = "40s"
60+
}
61+
62+
resource "oci_management_dashboard_management_dashboards_import" "iam_dashboard_import" {
63+
for_each = local.dashboard_names
64+
#import_details = replace(replace(data.http.security_dashboards[each.key].response_body,"${"$"}{compartment_ocid}","${var.sfd_compartment_ocid}"),"2507e19d927d458a0cafe461cd07c5ae","${var.sfd_compartment_ocid}")
65+
#import_details = replace(data.http.security_dashboards[each.key].response_body,"/(\"compartmentId\":\\s*\")\\S+\"/","\"compartmentId\": \"${var.sfd_compartment_ocid}\"")
66+
import_details = replace(data.http.security_dashboards[each.key].response_body,"/(\"compartmentId\":\\s*\")\\S+\"/","$${1}${var.sfd_compartment_ocid}\"")
67+
#import_details = templatefile(format("%s/%s/%s", path.root,"resources", each.value), {"compartment_ocid" : "${var.sfd_compartment_ocid}"})
68+
}
69+
70+
71+
# Create a log group with required parameters
72+
resource "oci_log_analytics_log_analytics_log_group" "iam_dashboard_log_group" {
73+
74+
count = (var.create_service_connector_audit == true ) ? 1 : 0
75+
compartment_id = var.sfd_compartment_ocid
76+
#namespace = oci_log_analytics_namespace.iam_dashboard_namespace.namespace
77+
namespace = data.oci_log_analytics_namespaces.sfd_dashboard_namespaces.namespace_collection.0.items.0.is_onboarded ? data.oci_log_analytics_namespaces.sfd_dashboard_namespaces.namespace_collection.0.items.0.namespace : oci_log_analytics_namespace.sfd_dashboard_namespace[count.index].namespace
78+
display_name = var.logging_analytics_log_group_name
79+
}
80+
81+
# Get details of above created log group with required parameters
82+
data "oci_log_analytics_log_analytics_log_group" "iam_dashboard_log_group_details" {
83+
count = (var.create_service_connector_audit == true ) ? 1 : 0
84+
#namespace = data.oci_log_analytics_namespaces.iam_dashboard_namespaces.namespace_collection.0.items.0.namespace
85+
namespace = data.oci_log_analytics_namespaces.sfd_dashboard_namespaces.namespace_collection.0.items.0.is_onboarded ? data.oci_log_analytics_namespaces.sfd_dashboard_namespaces.namespace_collection.0.items.0.namespace : oci_log_analytics_namespace.sfd_dashboard_namespace[count.index].namespace
86+
log_analytics_log_group_id = oci_log_analytics_log_analytics_log_group.iam_dashboard_log_group[count.index].id
87+
}
88+
89+
resource "oci_sch_service_connector" "iam_dashboard_service_connector" {
90+
count = (var.create_service_connector_audit == true ) ? 1 : 0
91+
compartment_id = var.sfd_compartment_ocid
92+
#defined_tags = {"${oci_identity_tag_namespace.tag-namespace1.name}.${oci_identity_tag.tag1.name}" = "updatedValue"}
93+
description = "Used to populate Logging Analytics with OCI Audit Logs"
94+
display_name = "IAM Identity Domain Audit to Logging Analytics"
95+
96+
97+
source {
98+
kind = "logging"
99+
#Audit
100+
log_sources {
101+
compartment_id = var.sfd_compartment_ocid
102+
log_group_id = "_Audit"
103+
log_id = ""
104+
}
105+
}
106+
target {
107+
kind = "loggingAnalytics"
108+
log_group_id = data.oci_log_analytics_log_analytics_log_group.iam_dashboard_log_group_details[count.index].id
109+
}
110+
111+
state = var.service_connector_audit_state
112+
}
113+
114+
resource "oci_identity_policy" "connectorpolicy_logginganalytics" {
115+
count = (var.create_service_connector_audit == true ) ? 1 : 0
116+
name = "SFD_Dashboard_ConnectorPolicy_LoggingAnalytics"
117+
description = "Policy to allow Service Connector to upload logs to a Logging Analytics Log Group"
118+
compartment_id = var.sfd_compartment_ocid
119+
provider = oci.home
120+
121+
statements = [
122+
"allow any-user to {LOG_ANALYTICS_LOG_GROUP_UPLOAD_LOGS} in compartment id ${var.sfd_compartment_ocid} where all {request.principal.type='serviceconnector', target.loganalytics-log-group.id='${data.oci_log_analytics_log_analytics_log_group.iam_dashboard_log_group_details[count.index].id}', request.principal.compartment.id='${var.sfd_compartment_ocid}'}"
123+
]
124+
}

‎knowlege-content/MAP/security-fundamentals-dashboards/modules/sfd/terraform.tfvars.template‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#---------------------------------------
2+
# Tenancy Connectivity Variables
3+
#---------------------------------------
4+
5+
tenancy_ocid = "ocid1.tenancy.oc1..aaaaaaaaa3qmjxr43tjexx75r6gwk6vjw22ermohbw2vbxyhczksgjir7xdq" # Get this from OCI Console (after logging in, go to top-right-most menu item and click option "Tenancy: <your tenancy name>").
6+
user_ocid = "ocid1.user.oc1..aaaaaaaaag3xbwgruyx5q6xlbpvdkgfhpe5l76lzy4wgaoji5wwrx6e7ha6a" # Get this from OCI Console (after logging in, go to top-right-most menu item and click option "My profile").
7+
fingerprint = "93:13:4d:f4:74:86:91:5e:50:c5:6d:34:2c:af:7b:b0" # The fingerprint can be gathered from your user account. In the "My profile page, click "API keys" on the menu in left hand side).
8+
private_key_path = "/Users/gsaurez/.oci/gs_oci_api_key.pem" # This is the full path on your local system to the API signing private key.
9+
private_key_password = "" # This is the password that protects the private key, if any.
10+
region = "mx-queretaro-1" #"us-ashburn-1"
11+
12+
#---------------------------------------
13+
# input Variables
14+
#---------------------------------------
15+
16+
sfd_compartment_ocid = "ocid1.compartment.oc1..aaaaaaaaib4damcmimkx7c4u75wz4n6kknbc6rjaxex5rb2zxdxn47rdsh2q"

‎knowlege-content/MAP/security-fundamentals-dashboards/modules/sfd/variables.tf‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# Copyright (c) 2021 Oracle and/or its affiliates.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
3+
4+
5+
6+
variable "sfd_compartment_ocid" {
7+
type = string
8+
}
9+
10+
variable "tenancy_ocid" {}
11+
12+
variable "user_ocid" {
13+
default = ""
14+
}
15+
variable "fingerprint" {
16+
default = ""
17+
}
18+
variable "private_key_path" {
19+
default = ""
20+
}
21+
variable "private_key_password" {
22+
default = ""
23+
}
24+
variable "region" {}
25+
26+
27+
# variable iam_dashboard_import_custom_content_file {
28+
# default = "./resources/ociAuditLogSource.zip"
29+
# }
30+
31+
# #variable iam_dashboard_import_custom_content_namespace {}
32+
33+
# variable iam_dashboard_custom_content_is_overwrite {
34+
# type = bool
35+
# default = true
36+
# }
37+
38+
variable create_service_connector_audit {
39+
type = bool
40+
default = false
41+
}
42+
43+
variable logging_analytics_log_group_name {
44+
type = string
45+
default = "sfd_identity_domain_audit"
46+
}
47+
48+
variable service_connector_audit_state {
49+
type = string
50+
default = "INACTIVE"
51+
}
52+
53+

0 commit comments

Comments
 (0)