Cyral Sidecar AWS module for Terraform

Usage

module "cyral_sidecar" {
    source  = "cyralinc/sidecar-aws/cyral"  
    version = "2.7.1" # terraform module version

    sidecar_version = ""
    sidecar_id      = ""

    name_prefix   = ""
    control_plane = ""

    sidecar_ports = [443, 3306, 5432, 27017, 27018, 27019]
    mongodb_port_alloc_range_low  = 27017
    mongodb_port_alloc_range_high = 27019

    vpc_id  = ""
    subnets = [""]

    ssh_inbound_cidr         = ["0.0.0.0/0"]
    db_inbound_cidr          = ["0.0.0.0/0"]
    healthcheck_inbound_cidr = ["0.0.0.0/0"]

    container_registry = ""
    client_id          = ""
    client_secret      = ""
}

Note:

name_prefix is filled automatically when you download the Terraform sidecar template from the Cyral control plane. If you wish to define a custom name_prefix, please keep in mind that its length must be at most 24 characters.

Upgrade Notes

Check the upgrade notes section if you are upgrading an existing sidecar.

Requirements

Name	Version
terraform	>= 0.12
aws	>= 3.22.0

Providers

Name	Version
aws	>= 3.22.0

Modules

No modules.

Resources

Name	Type
aws_autoscaling_group.cyral-sidecar-asg	resource
aws_cloudwatch_log_group.cyral-sidecar-lg	resource
aws_iam_instance_profile.sidecar_profile	resource
aws_iam_policy.init_script_policy	resource
aws_iam_policy.sidecar_created_certificate_lambda_execution	resource
aws_iam_policy.sidecar_custom_certificate_secrets_manager	resource
aws_iam_role.sidecar_created_certificate_lambda_execution	resource
aws_iam_role.sidecar_custom_certificate	resource
aws_iam_role.sidecar_role	resource
aws_iam_role_policy_attachment.init_script_policy	resource
aws_iam_role_policy_attachment.sidecar_created_certificate_lambda_execution	resource
aws_iam_role_policy_attachment.sidecar_custom_certificate	resource
aws_iam_role_policy_attachment.user_policies	resource
aws_lambda_function.sidecar_created_certificate	resource
aws_lambda_invocation.sidecar_created_certificate	resource
aws_launch_configuration.cyral-sidecar-lc	resource
aws_lb.cyral-lb	resource
aws_lb_listener.cyral-sidecar-lb-ls	resource
aws_lb_target_group.cyral-sidecar-tg	resource
aws_route53_record.cyral-sidecar-dns-record	resource
aws_secretsmanager_secret.cyral-sidecar-secret	resource
aws_secretsmanager_secret.sidecar_created_certificate	resource
aws_secretsmanager_secret.sidecar_custom_certificate	resource
aws_secretsmanager_secret_version.cyral-sidecar-secret-version	resource
aws_security_group.instance	resource
aws_ami.amazon_linux_2	data source
aws_arn.cw_lg	data source
aws_availability_zones.all	data source
aws_iam_policy_document.init_script_policy	data source
aws_iam_policy_document.kms	data source
aws_iam_policy_document.sidecar	data source
aws_iam_policy_document.sidecar_created_certificate_lambda_assume_role	data source
aws_iam_policy_document.sidecar_created_certificate_lambda_execution	data source
aws_iam_policy_document.sidecar_custom_certificate_assume_role	data source
aws_iam_policy_document.sidecar_custom_certificate_secrets_manager	data source
aws_region.current	data source

Inputs

Name	Description	Type	Default	Required
additional_security_groups	Additional security groups to attach to sidecar instances	`list(string)`	`[]`	no
ami_id	Amazon Linux 2 AMI ID for sidecar EC2 instances. The default behavior is to use the latest version. In order to define a new image, provide the desired image id.	`string`	`""`	no
asg_count	Set to 1 to enable the ASG, 0 to disable. Only for debugging.	`number`	`1`	no
asg_desired	The desired number of hosts to create in the auto scaling group	`number`	`1`	no
asg_max	The maximum number of hosts to create in the auto scaling group	`number`	`2`	no
asg_min	The minimum number of hosts to create in the auto scaling group	`number`	`1`	no
associate_public_ip_address	Associates a public IP to sidecar EC2 instances	`bool`	`false`	no
client_id	The client id assigned to the sidecar	`string`	n/a	yes
client_secret	The client secret assigned to the sidecar	`string`	n/a	yes
cloudwatch_logs_retention	Cloudwatch logs retention in days	`number`	`14`	no
container_registry	Address of the container registry where Cyral images are stored	`string`	n/a	yes
container_registry_key	Key provided by Cyral for authenticating on Cyral's container registry	`string`	`""`	no
container_registry_username	Username provided by Cyral for authenticating on Cyral's container registry	`string`	`""`	no
control_plane	Address of the control plane - .cyral.com	`string`	n/a	yes
custom_user_data	Auxiliary user-data script. Appended to existing user-data sidecar bootstrapping scripts (Approx Input Size = 19KB)	`string`	`""`	no
db_inbound_cidr	Allowed CIDR block for database access to the sidecar. Can't be combined with 'db_inbound_security_group'.	`list(string)`	n/a	yes
db_inbound_security_group	Pre-existing security group IDs allowed to connect to db in the EC2 host. Can't be combined with 'db_inbound_cidr'.	`list(string)`	`[]`	no
dd_api_key	API key to connect to DataDog	`string`	`""`	no
deploy_secrets	Create the AWS Secrets Manager resource at secret_location using client_id, client_secret and container_registry_key	`bool`	`true`	no
elk_address	Address to ship logs to ELK	`string`	`""`	no
elk_password	(Optional) Password to use to ship logs to ELK	`string`	`""`	no
elk_username	(Optional) Username to use to ship logs to ELK	`string`	`""`	no
enable_cross_zone_load_balancing	Enable cross zone load balancing	`bool`	`true`	no
external_tls_type	TLS mode for the control plane - tls, tls-skip-verify, no-tls	`string`	`"tls"`	no
hc_vault_integration_id	HashiCorp Vault integration ID	`string`	`""`	no
health_check_grace_period	The grace period in seconds before the health check will terminate the instance	`number`	`600`	no
healthcheck_inbound_cidr	Allowed CIDR block for health check requests to the sidecar	`list(string)`	n/a	yes
healthcheck_port	Port used for the healthcheck	`number`	`8888`	no
iam_policies	(Optional) List of IAM policies ARNs that will be attached to the sidecar IAM role	`list(string)`	`[]`	no
idp_certificate	(Optional) The certificate used to verify SAML assertions from the IdP being used with Snowflake. Enter this value as a one-line string with literal characters specifying the line breaks.	`string`	`""`	no
idp_sso_login_url	(Optional) The IdP SSO URL for the IdP being used with Snowflake.	`string`	`""`	no
instance_type	Amazon EC2 instance type for the sidecar instances	`string`	`"t3.medium"`	no
key_name	AWS key name	`string`	`""`	no
load_balancer_certificate_arn	(Optional) ARN of SSL certificate that will be used for client connections to Snowflake.	`string`	`""`	no
load_balancer_scheme	EC2 network load balancer scheme ('internal' or 'internet-facing')	`string`	`"internal"`	no
load_balancer_sticky_ports	List of ports that will have session stickiness enabled. This parameter must be a subset of 'sidecar_ports'.	`list(number)`	`[]`	no
load_balancer_subnets	Subnets to add load balancer to. If not provided, the load balancer will assume the subnets specified in the `subnets` parameter.	`list(string)`	`[]`	no
load_balancer_tls_ports	List of ports that will have TLS terminated at load balancer level (snowflake support, for example). If assigned, 'load_balancer_certificate_arn' must also be provided. This parameter must be a subset of 'sidecar_ports'.	`list(number)`	`[]`	no
log_integration	Logs destination	`string`	`"cloudwatch"`	no
metrics_integration	Metrics destination	`string`	`""`	no
mongodb_port_alloc_range_high	Final value for MongoDB port allocation range. The consecutive ports in the range `mongodb_port_alloc_range_low:mongodb_port_alloc_range_high` will be used for mongodb cluster monitoring. All the ports in this range must be listed in `sidecar_ports`.	`number`	n/a	yes
mongodb_port_alloc_range_low	Initial value for MongoDB port allocation range. The consecutive ports in the range `mongodb_port_alloc_range_low:mongodb_port_alloc_range_high` will be used for mongodb cluster monitoring. All the ports in this range must be listed in `sidecar_ports`.	`number`	n/a	yes
mysql_multiplexed_port	Port that will be used by the sidecar to multiplex connections to MySQL	`number`	`0`	no
name_prefix	Prefix for names of created resources in AWS. Maximum length is 24 characters.	`string`	n/a	yes
reduce_security_group_rules_count	If set to `false`, each port in `sidecar_ports` will be used individually for each CIDR in `db_inbound_cidr` to create inbound rules in the sidecar security group, resulting in a number of inbound rules that is equal to the number of `sidecar_ports` * `db_inbound_cidr`. If set to `true`, the entire sidecar port range from `min(sidecar_ports)` to `max(sidecar_ports)` will be used to configure each inbound rule for each CIDR in `db_inbound_cidr` for the sidecar security group. Setting it to `true` can be useful if you need to use multiple sequential sidecar ports and different CIDRs for DB inbound (`db_inbound_cidr`) since it will significantly reduce the number of inbound rules and avoid hitting AWS quotas. As a side effect, it will open all the ports between `min(sidecar_ports)` and `max(sidecar_ports)` in the security group created by this module.	`bool`	`false`	no
repositories_supported	List of all repositories that will be supported by the sidecar (lower case only)	`list(string)`	[ "denodo", "dremio", "mongodb", "mysql", "oracle", "postgresql", "redshift", "rest", "snowflake", "sqlserver", "s3" ]	no
secrets_kms_key_id	ARN of the KMS key used to encrypt secrets. If not set, secrets will use the default KMS key.	`string`	`""`	no
secrets_location	Location in AWS Secrets Manager to store client_id, client_secret and container_registry_key	`string`	n/a	yes
sidecar_certificate_lambda_version	Version of the lambda used to create the sidecar certificate.	`string`	`"v0.1.0"`	no
sidecar_custom_certificate_account_id	(Optional) AWS Account ID where the custom certificate module will be deployed.	`string`	`""`	no
sidecar_dns_hosted_zone_id	(Optional) Route53 hosted zone ID for the corresponding 'sidecar_dns_name' provided	`string`	`""`	no
sidecar_dns_name	(Optional) Fully qualified domain name that will be automatically created/updated to reference the sidecar LB	`string`	`""`	no
sidecar_dns_overwrite	(Optional) Update an existing DNS name informed in 'sidecar_dns_name' variable	`bool`	`false`	no
sidecar_id	Sidecar identifier	`string`	n/a	yes
sidecar_ports	List of ports allowed to connect to the sidecar. See also 'load_balancer_tls_ports'.	`list(number)`	n/a	yes
sidecar_version	Version of the sidecar	`string`	n/a	yes
splunk_host	Splunk host	`string`	`""`	no
splunk_index	Splunk index	`string`	`""`	no
splunk_port	Splunk port	`number`	`0`	no
splunk_tls	Splunk TLS	`bool`	`false`	no
splunk_token	Splunk token	`string`	`""`	no
ssh_inbound_cidr	Allowed CIDR block for SSH access to the sidecar. Can't be combined with 'ssh_inbound_security_group'.	`list(string)`	n/a	yes
ssh_inbound_security_group	Pre-existing security group IDs allowed to ssh into the EC2 host. Can't be combined with 'ssh_inbound_cidr'.	`list(string)`	`[]`	no
subnets	Subnets to add sidecar to (list of string)	`list(string)`	n/a	yes
sumologic_host	Sumologic host	`string`	`""`	no
sumologic_uri	Sumologic uri	`string`	`""`	no
volume_size	Size of the sidecar disk	`number`	`15`	no
vpc_id	AWS VPC ID to deploy sidecar to	`string`	n/a	yes

Outputs

Name	Description
aws_iam_role_arn	Sidecar IAM role ARN
aws_security_group_id	Sidecar security group id
sidecar_custom_certificate_role_arn	IAM role ARN to use in the Sidecar Custom Certificate modules.
sidecar_custom_certificate_secret_arn	Secret ARN to use in the Sidecar Custom Certificate modules.
sidecar_dns	Sidecar DNS endpoint
sidecar_load_balancer_dns	Sidecar load balancer DNS endpoint

rgoomar/terraform-cyral-sidecar-aws

Cyral Sidecar AWS module for Terraform

Usage

Upgrade Notes

Requirements

Providers

Modules

Resources

Inputs

Outputs