Skip to content

Commit 2a8b4db

Browse files
ravinadhruve10ravinadhruve10
authored
Deprecate legacy TF module variables for OUs (#94)
* Deprecate legacy TF module variables for OUs DEPRECATION NOTICE ------------------- Deprecating the following variables from all modules :- - organizational_unit_ids - org_units With this breaking change, above legacy vars will no longer be supported for Secure installs. Recommended Solutions ----------------------- - For new Foundational installs: Users will need to use the new vars for including and excluding organizational_units and/or accounts. - For existing installs: - It is highly recommended to migrate to using new variables. Please work with Sysdig to migrate your Terraform installs to use new vars instead to achieve the same deployment outcome. - Pin and use older module version if you do not wish to migrate. * Update test files
1 parent f1299c2 commit 2a8b4db

34 files changed

+176
-529
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ There are four new parameters to configure organizational deployments on the clo
7373
3. `include_accounts` - List of AWS Accounts to deploy the Sysdig Secure for Cloud resources in.
7474
4. `exclude_accounts` - List of AWS Accounts to exclude deploying the Sysdig Secure for Cloud resources in.
7575

76-
**WARNING**: module variable `organizational_unit_ids` / `org_units` will be DEPRECATED on 30th November, 2025. Please work with Sysdig to migrate your Terraform installs to use `include_ouids` instead to achieve the same deployment outcome.
76+
**DEPRECATION NOTICE**: module variables `organizational_unit_ids` / `org_units` have been DEPRECATED and are no longer supported. Please work with Sysdig to migrate your Terraform installs to use `include_ouids` instead to achieve the same deployment outcome.
7777

7878
### Stackset Instances Installation
7979

‎modules/agentless-scanning/README.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,6 @@ No modules.
6262
| <a name="input_kms_key_deletion_window"></a> [kms\_key\_deletion\_window](#input\_kms\_key\_deletion\_window) | Deletion window for shared KMS key | `number` | `7` | no |
6363
| <a name="input_mgt_stackset"></a> [mgt\_stackset](#input\_mgt\_stackset) | (Optional) Indicates if the management stackset should be deployed | `bool` | `true` | no |
6464
| <a name="input_name"></a> [name](#input\_name) | The name of the installation. Assigned to most child resource(s) | `string` | `"sysdig-secure-scanning"` | no |
65-
| <a name="input_org_units"></a> [org\_units](#input\_org\_units) | TO BE DEPRECATED on 30th November, 2025: Please work with Sysdig to migrate to using `include_ouids` instead.<br>(Optional) List of Organization Unit IDs in which to setup Agentless Scanning. By default, Agentless Scanning will be setup in all accounts within the Organization. This field is ignored if `is_organizational = false` | `set(string)` | `[]` | no |
6665
| <a name="input_regions"></a> [regions](#input\_regions) | (Optional) List of regions in which to install Agentless Scanning | `set(string)` | `[]` | no |
6766
| <a name="input_scanning_account_id"></a> [scanning\_account\_id](#input\_scanning\_account\_id) | The identifier of the account that will receive volume snapshots | `string` | `"878070807337"` | no |
6867
| <a name="input_stackset_admin_role_arn"></a> [stackset\_admin\_role\_arn](#input\_stackset\_admin\_role\_arn) | (Optional) stackset admin role to run SELF\_MANAGED stackset | `string` | `""` | no |

‎modules/agentless-scanning/locals.tf‎

Lines changed: 23 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -7,41 +7,11 @@ data "aws_organizations_organization" "org" {
77
}
88

99
locals {
10-
# check if both old and new org parameters are provided, we fail early
11-
both_org_configuration_params = var.is_organizational && length(var.org_units) > 0 && (
12-
length(var.include_ouids) > 0 ||
13-
length(var.exclude_ouids) > 0 ||
14-
length(var.include_accounts) > 0 ||
15-
length(var.exclude_accounts) > 0
16-
)
17-
18-
# check if old org_units parameter is provided, for backwards compatibility we will always give preference to it
19-
check_old_ouid_param = var.is_organizational && length(var.org_units) > 0
20-
2110
# fetch the AWS Root OU under org
2211
# As per https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html#organization-structure, there can be only one root
2312
root_org_unit = var.is_organizational ? [for root in data.aws_organizations_organization.org[0].roots : root.id] : []
2413
}
2514

26-
check "validate_org_configuration_params" {
27-
assert {
28-
condition = length(var.org_units) == 0 # if this condition is false we throw warning
29-
error_message = <<-EOT
30-
WARNING: TO BE DEPRECATED 'org_units' on 30th November, 2025. Please work with Sysdig to migrate your Terraform installs to use 'include_ouids' instead.
31-
EOT
32-
}
33-
34-
assert {
35-
condition = !local.both_org_configuration_params # if this condition is false we throw error
36-
error_message = <<-EOT
37-
ERROR: If both org_units and include_ouids/exclude_ouids/include_accounts/exclude_accounts variables are populated,
38-
ONLY org_units will be considered. Please use only one of the two methods.
39-
40-
Note: org_units is going to be DEPRECATED on 30th November, 2025. Please work with Sysdig to migrate your Terraform installs.
41-
EOT
42-
}
43-
}
44-
4515
# *****************************************************************************************************************************************************
4616
# INCLUDE/EXCLUDE CONFIGURATION SUPPORT
4717
#
@@ -67,37 +37,29 @@ check "validate_org_configuration_params" {
6737
locals {
6838
# OU CONFIGURATION (determine user provided org configuration)
6939
org_configuration = (
70-
# case1 - if old method is used where ONLY org_units is provided, use those
71-
local.check_old_ouid_param ? (
72-
"old_ouid_param"
40+
# case1 - if no include/exclude ous provided, include entire org
41+
var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) == 0 ? (
42+
"entire_org"
7343
) : (
74-
# case2 - if no include/exclude ous provided, include entire org
75-
var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) == 0 ? (
76-
"entire_org"
44+
# case2 - if only included ouids provided, include those ous only
45+
var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) == 0 ? (
46+
"included_ous_only"
7747
) : (
78-
# case3 - if only included ouids provided, include those ous only
79-
var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) == 0 ? (
80-
"included_ous_only"
48+
# case3 - if only excluded ouids provided, exclude their accounts from rest of org
49+
var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) > 0 ? (
50+
"excluded_ous_only"
8151
) : (
82-
# case4 - if only excluded ouids provided, exclude their accounts from rest of org
83-
var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) > 0 ? (
84-
"excluded_ous_only"
85-
) : (
86-
# case5 - if both include and exclude ouids are provided, includes override excludes
87-
var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) > 0 ? (
88-
"mixed_ous"
89-
) : ""
90-
)
52+
# case4 - if both include and exclude ouids are provided, includes override excludes
53+
var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) > 0 ? (
54+
"mixed_ous"
55+
) : ""
9156
)
9257
)
9358
)
9459
)
9560

9661
# switch cases for various user provided org configuration to be onboarded
9762
deployment_options = {
98-
old_ouid_param = {
99-
org_units_to_deploy = var.org_units
100-
}
10163
entire_org = {
10264
org_units_to_deploy = local.root_org_unit
10365
}
@@ -137,23 +99,18 @@ data "aws_organizations_organizational_unit_descendant_accounts" "ou_accounts_to
13799
locals {
138100
# ACCOUNTS CONFIGURATION (determine user provided accounts configuration)
139101
accounts_configuration = (
140-
# case1 - if old method is used where ONLY org_units is provided, this configuration is a noop
141-
local.check_old_ouid_param ? (
142-
"NONE"
102+
# case1 - if only included accounts provided, include those accts as well
103+
var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) == 0 ? (
104+
"UNION"
143105
) : (
144-
# case2 - if only included accounts provided, include those accts as well
145-
var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) == 0 ? (
146-
"UNION"
106+
# case2 - if only excluded accounts or only excluded ouids provided, exclude those accounts
107+
var.is_organizational && length(var.include_accounts) == 0 && (length(var.exclude_accounts) > 0 || local.org_configuration == "excluded_ous_only") ? (
108+
"DIFFERENCE"
147109
) : (
148-
# case3 - if only excluded accounts or only excluded ouids provided, exclude those accounts
149-
var.is_organizational && length(var.include_accounts) == 0 && (length(var.exclude_accounts) > 0 || local.org_configuration == "excluded_ous_only") ? (
150-
"DIFFERENCE"
151-
) : (
152-
# case4 - if both include and exclude accounts are provided, includes override excludes
153-
var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) > 0 ? (
154-
"MIXED"
155-
) : ""
156-
)
110+
# case3 - if both include and exclude accounts are provided, includes override excludes
111+
var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) > 0 ? (
112+
"MIXED"
113+
) : ""
157114
)
158115
)
159116
)
@@ -163,10 +120,6 @@ locals {
163120

164121
# switch cases for various user provided accounts configuration to be onboarded
165122
deployment_account_options = {
166-
NONE = {
167-
accounts_to_deploy = []
168-
account_filter_type = "NONE"
169-
}
170123
UNION = {
171124
accounts_to_deploy = var.include_accounts
172125
account_filter_type = "UNION"

‎modules/agentless-scanning/organizational.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -192,8 +192,8 @@ resource "aws_cloudformation_stack_set_instance" "ou_stackset_instance" {
192192
stack_set_name = aws_cloudformation_stack_set.ou_resources_stackset[0].name
193193
deployment_targets {
194194
organizational_unit_ids = [each.value[1]]
195-
accounts = local.check_old_ouid_param ? null : (local.deployment_targets_accounts_filter == "NONE" ? null : local.deployment_targets_accounts.accounts_to_deploy)
196-
account_filter_type = local.check_old_ouid_param ? null : local.deployment_targets_accounts_filter
195+
accounts = local.deployment_targets_accounts_filter == "NONE" ? null : local.deployment_targets_accounts.accounts_to_deploy
196+
account_filter_type = local.deployment_targets_accounts_filter
197197
}
198198
operation_preferences {
199199
max_concurrent_percentage = 100

‎modules/agentless-scanning/variables.tf‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -30,16 +30,6 @@ variable "is_organizational" {
3030
default = false
3131
}
3232

33-
variable "org_units" {
34-
description = <<-EOF
35-
TO BE DEPRECATED on 30th November, 2025: Please work with Sysdig to migrate to using `include_ouids` instead.
36-
When set, list of Organization Unit IDs to setup Agentless Scanning. By default, Agentless Scanning will be setup in all accounts within the Organization.
37-
This field is ignored if `is_organizational = false`
38-
EOF
39-
type = set(string)
40-
default = []
41-
}
42-
4333
variable "regions" {
4434
description = "(Optional) List of regions in which to install Agentless Scanning"
4535
type = set(string)

‎modules/config-posture/README.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,6 @@ No modules.
5252
|----------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|-------------------------------------------------------------|:--------:|
5353
| <a name="input_failure_tolerance_percentage"></a> [failure\_tolerance\_percentage](#input\_failure\_tolerance\_percentage) | The percentage of accounts, per Region, for which stack operations can fail before AWS CloudFormation stops the operation in that Region | `number` | `90` | no |
5454
| <a name="input_is_organizational"></a> [is\_organizational](#input\_is\_organizational) | true/false whether secure-for-cloud should be deployed in an organizational setup (all accounts of org) or not (only on default aws provider account) | `bool` | `false` | no |
55-
| <a name="input_org_units"></a> [org\_units](#input\_org\_units) | TO BE DEPRECATED on 30th November, 2025: Please work with Sysdig to migrate to using `include_ouids` instead.<br>Org unit id to install cspm | `set(string)` | `[]` | no |
5655
| <a name="input_region"></a> [region](#input\_region) | Default region for resource creation in organization mode | `string` | `""` | no |
5756
| <a name="input_tags"></a> [tags](#input\_tags) | sysdig secure-for-cloud tags. always include 'product' default tag for resource-group proper functioning | `map(string)` | <pre>{<br> "product": "sysdig-secure-for-cloud"<br>}</pre> | no |
5857
| <a name="input_timeout"></a> [timeout](#input\_timeout) | Default timeout values for create, update, and delete operations | `string` | `"30m"` | no |

‎modules/config-posture/locals.tf‎

Lines changed: 23 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -7,41 +7,11 @@ data "aws_organizations_organization" "org" {
77
}
88

99
locals {
10-
# check if both old and new org parameters are provided, we fail early
11-
both_org_configuration_params = var.is_organizational && length(var.org_units) > 0 && (
12-
length(var.include_ouids) > 0 ||
13-
length(var.exclude_ouids) > 0 ||
14-
length(var.include_accounts) > 0 ||
15-
length(var.exclude_accounts) > 0
16-
)
17-
18-
# check if old org_units parameter is provided, for backwards compatibility we will always give preference to it
19-
check_old_ouid_param = var.is_organizational && length(var.org_units) > 0
20-
2110
# fetch the AWS Root OU under org
2211
# As per https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html#organization-structure, there can be only one root
2312
root_org_unit = var.is_organizational ? [for root in data.aws_organizations_organization.org[0].roots : root.id] : []
2413
}
2514

26-
check "validate_org_configuration_params" {
27-
assert {
28-
condition = length(var.org_units) == 0 # if this condition is false we throw warning
29-
error_message = <<-EOT
30-
WARNING: TO BE DEPRECATED 'org_units' on 30th November, 2025. Please work with Sysdig to migrate your Terraform installs to use 'include_ouids' instead.
31-
EOT
32-
}
33-
34-
assert {
35-
condition = !local.both_org_configuration_params # if this condition is false we throw error
36-
error_message = <<-EOT
37-
ERROR: If both org_units and include_ouids/exclude_ouids/include_accounts/exclude_accounts variables are populated,
38-
ONLY org_units will be considered. Please use only one of the two methods.
39-
40-
Note: org_units is going to be DEPRECATED on 30th November, 2025. Please work with Sysdig to migrate your Terraform installs.
41-
EOT
42-
}
43-
}
44-
4515
# *****************************************************************************************************************************************************
4616
# INCLUDE/EXCLUDE CONFIGURATION SUPPORT
4717
#
@@ -67,37 +37,29 @@ check "validate_org_configuration_params" {
6737
locals {
6838
# OU CONFIGURATION (determine user provided org configuration)
6939
org_configuration = (
70-
# case1 - if old method is used where ONLY org_units is provided, use those
71-
local.check_old_ouid_param ? (
72-
"old_ouid_param"
40+
# case1 - if no include/exclude ous provided, include entire org
41+
var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) == 0 ? (
42+
"entire_org"
7343
) : (
74-
# case2 - if no include/exclude ous provided, include entire org
75-
var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) == 0 ? (
76-
"entire_org"
44+
# case2 - if only included ouids provided, include those ous only
45+
var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) == 0 ? (
46+
"included_ous_only"
7747
) : (
78-
# case3 - if only included ouids provided, include those ous only
79-
var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) == 0 ? (
80-
"included_ous_only"
48+
# case3 - if only excluded ouids provided, exclude their accounts from rest of org
49+
var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) > 0 ? (
50+
"excluded_ous_only"
8151
) : (
82-
# case4 - if only excluded ouids provided, exclude their accounts from rest of org
83-
var.is_organizational && length(var.include_ouids) == 0 && length(var.exclude_ouids) > 0 ? (
84-
"excluded_ous_only"
85-
) : (
86-
# case5 - if both include and exclude ouids are provided, includes override excludes
87-
var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) > 0 ? (
88-
"mixed_ous"
89-
) : ""
90-
)
52+
# case4 - if both include and exclude ouids are provided, includes override excludes
53+
var.is_organizational && length(var.include_ouids) > 0 && length(var.exclude_ouids) > 0 ? (
54+
"mixed_ous"
55+
) : ""
9156
)
9257
)
9358
)
9459
)
9560

9661
# switch cases for various user provided org configuration to be onboarded
9762
deployment_options = {
98-
old_ouid_param = {
99-
org_units_to_deploy = var.org_units
100-
}
10163
entire_org = {
10264
org_units_to_deploy = local.root_org_unit
10365
}
@@ -135,23 +97,18 @@ data "aws_organizations_organizational_unit_descendant_accounts" "ou_accounts_to
13597
locals {
13698
# ACCOUNTS CONFIGURATION (determine user provided accounts configuration)
13799
accounts_configuration = (
138-
# case1 - if old method is used where ONLY org_units is provided, this configuration is a noop
139-
local.check_old_ouid_param ? (
140-
"NONE"
100+
# case1 - if only included accounts provided, include those accts as well
101+
var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) == 0 ? (
102+
"UNION"
141103
) : (
142-
# case2 - if only included accounts provided, include those accts as well
143-
var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) == 0 ? (
144-
"UNION"
104+
# case2 - if only excluded accounts or only excluded ouids provided, exclude those accounts
105+
var.is_organizational && length(var.include_accounts) == 0 && (length(var.exclude_accounts) > 0 || local.org_configuration == "excluded_ous_only") ? (
106+
"DIFFERENCE"
145107
) : (
146-
# case3 - if only excluded accounts or only excluded ouids provided, exclude those accounts
147-
var.is_organizational && length(var.include_accounts) == 0 && (length(var.exclude_accounts) > 0 || local.org_configuration == "excluded_ous_only") ? (
148-
"DIFFERENCE"
149-
) : (
150-
# case4 - if both include and exclude accounts are provided, includes override excludes
151-
var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) > 0 ? (
152-
"MIXED"
153-
) : ""
154-
)
108+
# case3 - if both include and exclude accounts are provided, includes override excludes
109+
var.is_organizational && length(var.include_accounts) > 0 && length(var.exclude_accounts) > 0 ? (
110+
"MIXED"
111+
) : ""
155112
)
156113
)
157114
)
@@ -161,10 +118,6 @@ locals {
161118

162119
# switch cases for various user provided accounts configuration to be onboarded
163120
deployment_account_options = {
164-
NONE = {
165-
accounts_to_deploy = []
166-
account_filter_type = "NONE"
167-
}
168121
UNION = {
169122
accounts_to_deploy = var.include_accounts
170123
account_filter_type = "UNION"

0 commit comments

Comments
 (0)