Skip to content

Commit

Permalink
Updates
Browse files Browse the repository at this point in the history
  • Loading branch information
rajlearner17 committed Jan 28, 2025
1 parent 9ff8150 commit 321cbf0
Show file tree
Hide file tree
Showing 30 changed files with 45 additions and 42 deletions.
6 changes: 6 additions & 0 deletions docs/guides/aws/aws-sidebar.json
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,12 @@
"id": "aws",
"link": "guides/aws",
"items": [
{
"type": "category",
"id": "import-aws-account",
"link": "guides/aws/import-aws-account",
"items": ["guides/aws/import-aws-account/gov-cloud"]
},
"guides/aws/import-aws-organization",
{
"type": "category",
Expand Down
3 changes: 0 additions & 3 deletions docs/guides/aws/import-aws-organization/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,6 @@ sidebar_label: Import Organization

# Importing an AWS Organization

> [!IMPORTANT]
This guide is intended for use by customers running TE version `5.48.0` or higher. If you are running an earlier version of Guardrails please use [Importing an AWS account](guides/aws/import-aws-account).

In this guide, you will:

- Learn how to import an entire AWS Organization into Turbot Guardrails, enabling Guardrails to discover, govern, and manage resources across all accounts under a single AWS Organization.
Expand Down
6 changes: 3 additions & 3 deletions docs/guides/azure/import/active-directory/index.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
---
title: "Import Azure Entra ID into Guardrails"
title: "Import Azure Entra ID"
template: Documentation
nav:
title: "Entra ID"
Expand Down Expand Up @@ -65,8 +65,8 @@ resource "turbot_resource" "active_directory_resource" {
resource "turbot_policy_setting" "environment" {
resource = turbot_resource.active_directory_resource.id
type = "tmod:@turbot/azure#/policy/types/environment"
value = "Global Cloud"
# value = "US Government"
value = "Global Cloud"
# value = "US Government"
}
resource "turbot_policy_setting" "clientKey" {
Expand Down
8 changes: 4 additions & 4 deletions docs/guides/azure/import/subscription/index.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
---
title: "Import Azure Subscription into Guardrails"
title: "Import Azure Subscription"
template: Documentation
nav:
title: "Subscription"
Expand Down Expand Up @@ -61,19 +61,19 @@ resource "turbot_policy_setting" "environment" {
resource = turbot_resource.subscription_resource.id
type = "tmod:@turbot/azure#/policy/types/environment"
value = "Global Cloud"
# value = "US Government"
# value = "US Government"
}
# Azure > Client Key
resource "turbot_policy_setting" "clientKey" {
resource = turbot_resource.subscription_resource.id
type = "tmod:@turbot/azure#/policy/types/clientKey"
value = "{turbot application client key}"
value = "{turbot application client key}"
}
# Azure > Client ID
resource "turbot_policy_setting" "clientId" {
resource = turbot_resource.subscription_resource.id
type = "tmod:@turbot/azure#/policy/types/clientId"
value = "{turbot application client id}"
value = "{turbot application client id}"
}
# Azure > Tenant ID
resource "turbot_policy_setting" "tenantId" {
Expand Down
12 changes: 6 additions & 6 deletions docs/guides/azure/import/tenant/index.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
---
title: "Import Azure Tenant into Guardrails"
title: "Import Azure Tenant"
template: Documentation
nav:
title: "Tenant"
Expand All @@ -21,8 +21,8 @@ ease of management. Define a Folder hierarchy prior to import.
## Import Azure Tenant via Guardrails Console

1. At the main Guardrails landing page after logging in with `Turbot/Admin` permissions,
click the purple **IMPORT** card in the top right corner.
2. Select **Azure Tenant** on the left.
click the purple **CONNECT** card in the top right corner.
2. Select **Azure** from the .
3. Use the **Parent Resource** dropdown menu to select the parent resource for the Azure Tenant.
4. Enter the **Tenant (directory) ID**, **Client (application) ID**, and
**Client Key (secret)**, as well as the **Environment** type then click
Expand All @@ -36,7 +36,7 @@ right away, and resource discovery will continue to run in the background.
## Management Group Event Pollers

Guardrails uses Management Group event pollers to detect new, updated or deleted subscriptions in the
management group. Management Group event pollers are enabled by default. No action is required.
management group. Management Group event pollers are enabled by default. No action is required.


## Import Tenant via Terraform
Expand Down Expand Up @@ -66,14 +66,14 @@ resource "turbot_resource" "tenant_resource" {
resource "turbot_policy_setting" "environment" {
resource = turbot_resource.tenant_resource.id
type = "tmod:@turbot/azure#/policy/types/environment"
value = "Global Cloud"
value = "Global Cloud"
# value = "US Government"
}
resource "turbot_policy_setting" "clientKey" {
resource = turbot_resource.tenant_resource.id
type = "tmod:@turbot/azure#/policy/types/clientKey"
value = "{Guardrails application client key}"
value = "{Guardrails application client key}"
}
resource "turbot_policy_setting" "clientId" {
Expand Down
2 changes: 1 addition & 1 deletion docs/guides/gcp/gcp-sidebar.json
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
"id": "import-org",
"link": "guides/gcp/import-gcp-organization",
"items": [
"guides/gcp/import-gcp-organization/enterprise-hosted-workspace",
"guides/gcp/import-gcp-organization/self-hosted-workspace",
"guides/gcp/import-gcp-organization/saas-workspace"
]
},
Expand Down
2 changes: 1 addition & 1 deletion docs/guides/gcp/import-gcp-organization/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,5 +9,5 @@ This section offers step-by-step guides for importing GCP organizations into Gua

| **Section** | **Description** |
|-------------|-----------------|
| [Import to Enterprise (Hosted) Workspace](guides/gcp/import-gcp-organization/enterprise-hosted-workspace) | Learn how to import a GCP organization into an enterprise-hosted workspace using the Guardrails Console. |
| [Import to Enterprise (Hosted) Workspace](guides/gcp/import-gcp-organization/self-hosted-workspace) | Learn how to import a GCP organization into an enterprise-hosted workspace using the Guardrails Console. |
| [Import to SaaS Workspace](guides/gcp/import-gcp-organization/saas-workspace) | Learn how to import a GCP organization into a SaaS workspace using the Guardrails Console. |
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
---
title: To SaaS Workspace
sidebar_label: To SaaS Workspace
title: SaaS Workspace
sidebar_label: SaaS Workspace
---

# Importing Organization to SaaS Workspace
# Importing GCP Organization to SaaS Workspace

In this guide, you will:

Expand Down
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
---
title: To Enterprise (Hosted) Workspace
sidebar_label: To Enterprise (Hosted) Workspace
title: Self-Hosted Workspace
sidebar_label: Self-Hosted Workspace
---

# Importing Organization to Enterprise (Hosted) Workspace
# Importing GCP Organization to Self-Hosted Workspace

In this guide, you will:

Expand Down Expand Up @@ -42,7 +42,7 @@ Guardrails requires access to the `Cloud Resource Manager` and `Service Manageme

Refer to the image below as example using as example in GCP `Console`.

![Enable API](/images/docs/guardrails/guides/gcp/import-gcp-organization/enterprise-hosted-workspace/enable-api.png)
![Enable API](/images/docs/guardrails/guides/gcp/import-gcp-organization/self-hosted-workspace/enable-api.png)

## Step 2: Create Service Account

Expand Down Expand Up @@ -75,7 +75,7 @@ Follow these steps to assign the required roles at the `Organization` scope to t

Refer to the image below:

![Service Account with Organization Scope](/images/docs/guardrails/guides/gcp/import-gcp-organization/enterprise-hosted-workspace/service-account-with-org-scope.png)
![Service Account with Organization Scope](/images/docs/guardrails/guides/gcp/import-gcp-organization/self-hosted-workspace/service-account-with-org-scope.png)

> [!NOTE]
> To import an organization, you need only `Organization Viewer`, `Project Viewer`, and `Folder Viewer` roles to allow the discovery of all resources under the organization.
Expand All @@ -93,7 +93,7 @@ Now, proceed with the following steps to prepare enterprise configurations.

## Step 4: Enterprise Configurations

To import a GCP organization into an enterprise-hosted environment, the following activities must be completed:
To import a GCP organization into an self-hosted(enterprise) environment, the following activities must be completed:

### Prerequisites

Expand All @@ -107,17 +107,17 @@ AWS Systems Manager (SSM) `Parameter Store` feature enables the creation of key-

Log in to the Guardrails primary AWS account and navigate to the `AWS Systems Manager` service.

![Create Parameter](/images/docs/guardrails/guides/gcp/import-gcp-organization/enterprise-hosted-workspace/create-paramater.png)
![Create Parameter](/images/docs/guardrails/guides/gcp/import-gcp-organization/self-hosted-workspace/create-paramater.png)

Create a `Secure String` with the `Tier` set to `Standard`.

![Paste JSON Credential](/images/docs/guardrails/guides/gcp/import-gcp-organization/enterprise-hosted-workspace/create-secure-standard-string.png)
![Paste JSON Credential](/images/docs/guardrails/guides/gcp/import-gcp-organization/self-hosted-workspace/create-secure-standard-string.png)

See [**here**](/guardrails/docs/getting-started/getting-started-gcp/prepare-project#step-9-create-key) how to create and download JSON credential file.

Paste the JSON credential content into the **Value** field and select **Create parameter**.

![Paste JSON Value](/images/docs/guardrails/guides/gcp/import-gcp-organization/enterprise-hosted-workspace/add-parameter-value-in-console.png)
![Paste JSON Value](/images/docs/guardrails/guides/gcp/import-gcp-organization/self-hosted-workspace/add-parameter-value-in-console.png)

For more details, refer to the AWS guide on [Creating a Parameter Store parameter using the console](https://docs.aws.amazon.com/systems-manager/latest/userguide/create-parameter-in-console.html).

Expand All @@ -127,29 +127,29 @@ It's time to update the created SSM parameter name in the TED. Follow the steps

Navigate to the `GCP Service Account Private Key SSM Parameter` section of the TED stack (towards the end) and update the manually created SSM parameter name as shown below. Select **Update** to proceed.

![Update TED Stack Parameter](/images/docs/guardrails/guides/gcp/import-gcp-organization/enterprise-hosted-workspace/update-ted-stack-parameter.png)
![Update TED Stack Parameter](/images/docs/guardrails/guides/gcp/import-gcp-organization/self-hosted-workspace/update-ted-stack-parameter.png)

## Step 5: Get Organization ID

In the GCP console, select your organization. Navigate to **All** to view the list of projects, folders, and the organization itself. Locate and copy the `ID` of the organization.

![Get GCP Organization ID](/images/docs/guardrails/guides/gcp/import-gcp-organization/enterprise-hosted-workspace/get-gcp-org-id.png)
![Get GCP Organization ID](/images/docs/guardrails/guides/gcp/import-gcp-organization/self-hosted-workspace/get-gcp-org-id.png)

## Step 6: Import Organization into Guardrails

Log into the Guardrails console with provided local credentials or by using any SAML based login and select the **CONNECT** card.

![Select Connect](/images/docs/guardrails/guides/gcp/import-gcp-organization/enterprise-hosted-workspace/select-connect.png)
![Select Connect](/images/docs/guardrails/guides/gcp/import-gcp-organization/self-hosted-workspace/select-connect.png)

Select **GCP** and then choose the **GCP Organization** option.

![Select GCP](/images/docs/guardrails/guides/gcp/import-gcp-organization/enterprise-hosted-workspace/select-gcp.png)
![Select GCP](/images/docs/guardrails/guides/gcp/import-gcp-organization/self-hosted-workspace/select-gcp.png)

- Choose the [folder](/guardrails/docs/concepts/resources/hierarchy#folders) where the GCP organization will be imported.
- Choose one of the `Access modes` from the provided list. In this guide, **Service Account impersonation** is demonstrated.
- Provide the `Organization ID` for your GCP organization and the `Client email`. Guardrails will use this email ID for impersonation.

![Provide GCP Org Details](/images/docs/guardrails/guides/gcp/import-gcp-organization/enterprise-hosted-workspace/gcp-org-details.png)
![Provide GCP Org Details](/images/docs/guardrails/guides/gcp/import-gcp-organization/self-hosted-workspace/gcp-org-details.png)

Proceed for setting up Service Account Impersonation.

Expand All @@ -161,7 +161,7 @@ Proceed for setting up Service Account Impersonation.

In the same page, select **Copy gcloud command**.

![Generate Service Account Impersonation](/images/docs/guardrails/guides/gcp/import-gcp-organization/enterprise-hosted-workspace/generate-service-account-impersonation.png)
![Generate Service Account Impersonation](/images/docs/guardrails/guides/gcp/import-gcp-organization/self-hosted-workspace/generate-service-account-impersonation.png)

Now execute copied command using [gcloud CLI](https://cloud.google.com/sdk/docs/install) in your local environment.

Expand Down Expand Up @@ -197,11 +197,11 @@ The `External ID label` acts as a key service account identifier within the proj
> [!NOTE]
> The `Label` key and the highlighted portion of the value (i.e., `turbot_162167737252865` in the format `turbot_{current workspace id}`) cannot be modified. However, the third part of the text can be customized by clicking the `Customize` icon.
![Generate External ID Label](/images/docs/guardrails/guides/gcp/import-gcp-organization/enterprise-hosted-workspace/generate-external-id-label-and-create.png)
![Generate External ID Label](/images/docs/guardrails/guides/gcp/import-gcp-organization/self-hosted-workspace/generate-external-id-label-and-create.png)
Log in to the GCP console and navigate to the project where the configured service account resides. Select **Labels** from the side navigation panel, add `guardrails_external_id` as the label key, and `turbot_162167737252865_f1da2779-92c8-46b1-83dd-95d629023211` as the value. Click **+Add label** to save the label.
![Create GCP Label](/images/docs/guardrails/guides/gcp/import-gcp-organization/enterprise-hosted-workspace/gcp-label-creation.png)
![Create GCP Label](/images/docs/guardrails/guides/gcp/import-gcp-organization/self-hosted-workspace/gcp-label-creation.png)
> [!WARNING]
> The `External ID` label created for this organization import must be retained within the respective GCP project to prevent errors in Guardrails.
Expand All @@ -215,15 +215,15 @@ This step is required if you wish to exclude specific projects or folder under o
Click the **Edit** button to provide a list of project IDs or folder names under the organization to be excluded.
![Edit Exception List](/images/docs/guardrails/guides/gcp/import-gcp-organization/enterprise-hosted-workspace/exception-list-with-connect.png)
![Edit Exception List](/images/docs/guardrails/guides/gcp/import-gcp-organization/self-hosted-workspace/exception-list-with-connect.png)
Click the **Preview** button to ensure no errors are displayed. Move to [Step 14](#step-14-initiate-connect).
## Step 10: Start Import
Click **Connect** to begin the import process.
![Connect to Import](/images/docs/guardrails/guides/gcp/import-gcp-organization/enterprise-hosted-workspace/connect.png)
![Connect to Import](/images/docs/guardrails/guides/gcp/import-gcp-organization/self-hosted-workspace/connect.png)
Guardrails will create and execute discovery controls for your GCP Organization, scanning each folder, project and resources under it.
Expand All @@ -239,13 +239,13 @@ If you plan to allow Guardrails to enable new APIs or create resources that may
Navigate to the **Resources** tab, search for the organization name, then select **Controls** tab besides to check the controls are on `OK` state.
![Review Org CMDB and Discovery Controls](/images/docs/guardrails/guides/gcp/import-gcp-organization/enterprise-hosted-workspace/review-org-cmdb-discovery-controls.png)
![Review Org CMDB and Discovery Controls](/images/docs/guardrails/guides/gcp/import-gcp-organization/self-hosted-workspace/review-org-cmdb-discovery-controls.png)
- [ ] Verify that the projects and folders are successfully imported into Guardrails and match the GCP console.
Navigate to the **Resources** tab, search for the organization name to check the list of resources the import process is discovered matching to the structure in GCP console.
![Review GCP Org Resources](/images/docs/guardrails/guides/gcp/import-gcp-organization/enterprise-hosted-workspace/review-gcp-org-resources-imported.png)
![Review GCP Org Resources](/images/docs/guardrails/guides/gcp/import-gcp-organization/self-hosted-workspace/review-gcp-org-resources-imported.png)
## Next Steps
Expand Down

0 comments on commit 321cbf0

Please sign in to comment.