feat(GROW-2540): support integration folder customization for inclusion/exclusion

README.md

@@ -63,8 +63,10 @@ cloudresourcemanager.googleapis.com
 
 | Name | Type |
 |------|------|
+| [google_logging_folder_sink.lacework_folder_sink](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/logging_folder_sink) | resource |
 | [google_logging_organization_sink.lacework_organization_sink](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/logging_organization_sink) | resource |
 | [google_logging_project_sink.lacework_project_sink](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/logging_project_sink) | resource |
+| [google_logging_project_sink.lacework_root_project_sink](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/logging_project_sink) | resource |
 | [google_organization_iam_audit_config.organization_audit_logs](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/organization_iam_audit_config) | resource |
 | [google_organization_iam_member.for_lacework_service_account](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/organization_iam_member) | resource |
 | [google_project_iam_audit_config.project_audit_logs](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_iam_audit_config) | resource |
@@ -77,7 +79,9 @@ cloudresourcemanager.googleapis.com
 | [lacework_integration_gcp_pub_sub_audit_log.default](https://registry.terraform.io/providers/lacework/lacework/latest/docs/resources/integration_gcp_pub_sub_audit_log) | resource |
 | [random_id.uniq](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
 | [time_sleep.wait_time](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
+| [google_folders.my-org-folders](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/folders) | data source |
 | [google_project.selected](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/project) | data source |
+| [google_projects.my-org-projects](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/projects) | data source |
 | [lacework_metric_module.lwmetrics](https://registry.terraform.io/providers/lacework/lacework/latest/docs/data-sources/metric_module) | data source |
 
 ## Inputs
@@ -86,7 +90,10 @@ cloudresourcemanager.googleapis.com
 |------|-------------|------|---------|:--------:|
 | <a name="input_custom_filter"></a> [custom\_filter](#input\_custom\_filter) | Customer defined Audit Log filter which will supersede all other filter options when defined | `string` | `""` | no |
 | <a name="input_existing_sink_name"></a> [existing\_sink\_name](#input\_existing\_sink\_name) | The name of an existing sink to be re-used for this integration | `string` | `""` | no |
+| <a name="input_folders_to_exclude"></a> [folders\_to\_exclude](#input\_folders\_to\_exclude) | List of root folders to exclude in an organization-level integration.  Format is 'folders/1234567890' | `list(string)` | `[]` | no |
+| <a name="input_folders_to_include"></a> [folders\_to\_include](#input\_folders\_to\_include) | List of root folders to include in an organization-level integration.  Format is 'folders/1234567890' | `set(string)` | `[]` | no |
 | <a name="input_google_workspace_filter"></a> [google\_workspace\_filter](#input\_google\_workspace\_filter) | Filter out Google Workspace login logs from GCP Audit Log sinks.  Default is true | `bool` | `true` | no |
+| <a name="input_include_root_projects"></a> [include\_root\_projects](#input\_include\_root\_projects) | Enables logic to include root-level projects if excluding folders.  Default is true | `bool` | `true` | no |
 | <a name="input_integration_type"></a> [integration\_type](#input\_integration\_type) | Specify the integration type. Can only be PROJECT or ORGANIZATION. Defaults to PROJECT | `string` | `"PROJECT"` | no |
 | <a name="input_k8s_filter"></a> [k8s\_filter](#input\_k8s\_filter) | Filter out GKE logs from GCP Audit Log sinks.  Default is true | `bool` | `true` | no |
 | <a name="input_labels"></a> [labels](#input\_labels) | Set of labels which will be added to the resources managed by the module | `map(string)` | `{}` | no |

examples/organization-level-pub-sub-audit-exclude-folders/README.md

@@ -0,0 +1,32 @@
+# Integrate GCP Organization Pub Sub Audit logs with Lacework — Including only some organization folders
+The following provides an example of integrating a Google Cloud Project Audit Logs with 
+Lacework for analysis, but excludes some organization folders in the integration.
+
+
+```hcl
+terraform {
+  required_providers {
+    lacework = {
+      source = "lacework/lacework"
+    }
+  }
+}
+
+provider "google" {}
+
+provider "lacework" {}
+
+module "gcp_organization_level_pub_sub_audit_log" {
+  source           = "lacework/pub-sub-audit-log/gcp"
+  version          = "~> 0.1"
+  integration_type = "ORGANIZATION"
+  project_id       = "example-project-123"
+  organization_id  = "example-org-123"
+  folders_to_exclude = [
+    "folders/0000000000001",
+    "folders/0000000000002",
+    "folders/0000000000003",
+    "folders/0000000000004"
+  ]
+}
+```

examples/organization-level-pub-sub-audit-exclude-folders/main.tf

@@ -0,0 +1,26 @@
+terraform {
+  required_providers {
+    lacework = {
+      source = "lacework/lacework"
+    }
+  }
+}
+
+provider "google" {}
+
+provider "lacework" {}
+
+variable "organization_id" {
+  default = "my-organization-id"
+}
+
+variable "folders_to_exclude" {
+  type = list(string)
+}
+
+module "gcp_organization_level_pub_sub_audit_log" {
+  source             = "../../"
+  integration_type   = "ORGANIZATION"
+  organization_id    = var.organization_id
+  folders_to_exclude = var.folders_to_exclude
+}

examples/organization-level-pub-sub-audit-include-folders/README.md

@@ -0,0 +1,26 @@
+# Integrate GCP Organization Pub Sub Audit logs with Lacework — Including only some organization folders
+The following provides an example of integrating a Google Cloud Project Audit Logs with 
+Lacework for analysis, but includes only a subset of organization folders in the integration.
+
+```hcl
+terraform {
+  required_providers {
+    lacework = {
+      source = "lacework/lacework"
+    }
+  }
+}
+
+provider "google" {}
+
+provider "lacework" {}
+
+module "gcp_organization_level_pub_sub_audit_log" {
+  source           = "lacework/pub-sub-audit-log/gcp"
+  version          = "~> 0.1"
+  integration_type = "ORGANIZATION"
+  project_id       = "example-project-123"
+  organization_id  = "example-org-123"
+  folders_to_include = ["folders/000000000123"]
+}
+```

examples/organization-level-pub-sub-audit-include-folders/main.tf

@@ -0,0 +1,26 @@
+terraform {
+  required_providers {
+    lacework = {
+      source = "lacework/lacework"
+    }
+  }
+}
+
+provider "google" {}
+
+provider "lacework" {}
+
+variable "organization_id" {
+  default = "my-organization-id"
+}
+
+variable "folders_to_include" {
+  type = list(string)
+}
+
+module "gcp_organization_level_pub_sub_audit_log" {
+  source             = "../../"
+  integration_type   = "ORGANIZATION"
+  organization_id    = var.organization_id
+  folders_to_include = var.folders_to_include
+}

main.tf

@@ -4,11 +4,22 @@ locals {
   sink_name = length(var.existing_sink_name) > 0 ? var.existing_sink_name : (
     local.org_integration ? "${var.prefix}-${var.organization_id}-lacework-sink-${random_id.uniq.hex}" : "${var.prefix}-lacework-sink-${random_id.uniq.hex}"
   )
+
+  exclude_folders  = length(var.folders_to_exclude) != 0
+  explicit_folders = length(var.folders_to_include) != 0
+
   logging_sink_writer_identity = length(var.existing_sink_name) > 0 ? ["serviceAccount:${local.service_account_json_key.client_email}"] : (
-    (local.org_integration) ? (
+    (local.org_integration && !(local.exclude_folders || local.explicit_folders)) ? (
       [google_logging_organization_sink.lacework_organization_sink[0].writer_identity]
       ) : (
-      [google_logging_project_sink.lacework_project_sink[0].writer_identity]
+      (local.org_integration && (local.exclude_folders || local.explicit_folders)) ? (
+        concat(
+          [for v in google_logging_folder_sink.lacework_folder_sink : v.writer_identity],
+          [for v in google_logging_project_sink.lacework_root_project_sink : v.writer_identity]
+        )
+        ) : (
+        [google_logging_project_sink.lacework_project_sink[0].writer_identity]
+      )
     )
   )
 
@@ -42,6 +53,30 @@ locals {
     )
   )
 
+  folders = [
+    # if setting up an org-level integration and excluding folders
+    (local.org_integration && local.exclude_folders) ? (
+      # for the folders in the given org, get just the folders that haven't been excluded
+      setsubtract(data.google_folders.my-org-folders[0].folders[*].name, var.folders_to_exclude)
+      ) : ( # org integration but NOT excluding folders, including them; use the supplied foldes to include
+      local.org_integration && local.explicit_folders) ? (
+      var.folders_to_include
+      ) : (
+      # if we got this far, this is an org integration but no folder inclusions or exclusions have been set
+      # we'll return an empty set but the logic for lacework_organization_sink will deploy an org-wide sink
+      # that'll catch all folders (not true if inclusions/exclusions are set)
+      toset([])
+    )
+  ]
+
+  root_projects = [
+    (local.org_integration && local.exclude_folders && var.include_root_projects) ? (
+      toset(data.google_projects.my-org-projects[0].projects[*].project_id)
+      ) : (
+      toset([])
+    )
+  ]
+
   version_file   = "${abspath(path.module)}/VERSION"
   module_name    = "terraform-gcp-pub-sub-audit-log"
   module_version = fileexists(local.version_file) ? file(local.version_file) : ""
@@ -55,6 +90,16 @@ data "google_project" "selected" {
   count = length(var.project_id) > 0 ? 0 : 1
 }
 
+data "google_folders" "my-org-folders" {
+  count     = (local.org_integration && local.exclude_folders) ? 1 : 0
+  parent_id = "organizations/${var.organization_id}"
+}
+
+data "google_projects" "my-org-projects" {
+  count  = (local.exclude_folders && var.include_root_projects) ? 1 : 0
+  filter = "parent.id=${var.organization_id}"
+}
+
 resource "google_project_service" "required_apis" {
   for_each = var.required_apis
   project  = local.project_id
@@ -108,8 +153,29 @@ resource "google_logging_project_sink" "lacework_project_sink" {
   depends_on = [google_pubsub_topic.lacework_topic]
 }
 
+resource "google_logging_project_sink" "lacework_root_project_sink" {
+  for_each               = local.root_projects[0]
+  project                = each.value
+  name                   = local.sink_name
+  destination            = "pubsub.googleapis.com/${google_pubsub_topic.lacework_topic.id}"
+  unique_writer_identity = true
+
+  filter     = local.log_filter
+  depends_on = [google_pubsub_topic.lacework_topic]
+}
+
+resource "google_logging_folder_sink" "lacework_folder_sink" {
+  for_each         = local.folders[0]
+  name             = local.sink_name
+  folder           = each.value
+  destination      = "pubsub.googleapis.com/${google_pubsub_topic.lacework_topic.id}"
+  include_children = true
+
+  filter = local.log_filter
+}
+
 resource "google_logging_organization_sink" "lacework_organization_sink" {
-  count            = length(var.existing_sink_name) > 0 ? 0 : ((local.org_integration) ? 1 : 0)
+  count            = length(var.existing_sink_name) > 0 ? 0 : ((local.org_integration && !(local.exclude_folders || local.explicit_folders) ? 1 : 0))
   name             = local.sink_name
   org_id           = var.organization_id
   destination      = "pubsub.googleapis.com/${google_pubsub_topic.lacework_topic.id}"

variables.tf

@@ -13,7 +13,7 @@ variable "integration_type" {
   default     = "PROJECT"
   description = "Specify the integration type. Can only be PROJECT or ORGANIZATION. Defaults to PROJECT"
   validation {
-    condition =  contains(["PROJECT", "ORGANIZATION"], var.integration_type)
+    condition     = contains(["PROJECT", "ORGANIZATION"], var.integration_type)
     error_message = "The integration_type must be either PROJECT or ORGANIZATION."
   }
 }
@@ -114,5 +114,23 @@ variable "google_workspace_filter" {
 variable "custom_filter" {
   type        = string
   default     = ""
-  description = "Customer defined Audit Log filter which will supersede all other filter options when defined" 
+  description = "Customer defined Audit Log filter which will supersede all other filter options when defined"
+}
+
+variable "folders_to_include" {
+  type        = set(string)
+  default     = []
+  description = "List of root folders to include in an organization-level integration.  Format is 'folders/1234567890'"
+}
+
+variable "folders_to_exclude" {
+  type        = list(string)
+  default     = []
+  description = "List of root folders to exclude in an organization-level integration.  Format is 'folders/1234567890'"
+}
+
+variable "include_root_projects" {
+  type        = bool
+  default     = true
+  description = "Enables logic to include root-level projects if excluding folders.  Default is true"
 }