gbrembati / cloudguard-cnapp-aws-org-onboarding

CloudGuard AWS Organizational onboarding with Terraform

CloudGuard CNAPP AWS Organization Terraform Onboarding

This Terraform project is intended to be used to onboard an entire AWS organization accounts in one-shot.
What it does is configuring, via Terraform, an existing CloudGuard CSPM Portal and AWS master account.

How to start?

You would need to have a CloudGuard tenant, you can create one via Infinity Portal by clicking: Register Here

Get API credentials in your CloudGuard CNAP Portal

Then you will need to get the API credentials that you will be using with Terraform to onboard the accounts.

Remember to copy these two values, you will need to enter them in the .tfvars file later on.

Prerequisite

You would need to give as a parameter the External ID that you can obtain in the onboarding wizard:

You would need to enable Trust Access with AWS Organization:

How to use it

The only thing that you need to do is changing the terraform.tfvars file located in this directory.

# Set in this file your deployment variables
aws-access-key  = "xxxxxxxxxxxxxx"
aws-secret-key  = "xxxxxxxxxxxxxx"

cspm-key-id     = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
cspm-key-secret = "xxxxxxxxxxxxxxxxxxxx"
cspm-aws-external-id = "xxxxxxxxxxxxxxxxxxxx"

chkp-account-region = "Europe"     // Use either Europe / America / Singapore / Australia or India

If you want (or need) to further customize other project details, you can change defaults in the different name-variables.tf files. Here you will also able to find the descriptions that explains what each variable is used for.