Skip to content
This repository has been archived by the owner on Oct 4, 2024. It is now read-only.

Submodule Updates and rebranding #45

Open
wants to merge 25 commits into
base: gh-pages-BAK
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
25 commits
Select commit Hold shift + click to select a range
2692ad2
Rebranding
andrew-glenn Dec 12, 2022
4e147a1
docs for https://github.com/aws-quickstart/quickstart-snyk-security/p…
schottsfired Apr 5, 2023
b32fbb9
update .gitignore
schottsfired Apr 7, 2023
0a77c73
more accurate description above architecture diagram
schottsfired Apr 7, 2023
43d1d65
Update deployment_options.adoc
censullo May 2, 2023
ec3efbe
Update architecture.adoc
censullo May 2, 2023
df894e4
Update overview.adoc
censullo May 2, 2023
62875e7
Update post_deployment.adoc
censullo May 2, 2023
8eb0558
Update post_deployment.adoc
censullo May 2, 2023
d8d8a2e
Update post_deployment.adoc
censullo May 2, 2023
9b26a1f
Update pre_deployment.adoc
censullo May 2, 2023
071e96b
Update licenses.adoc
censullo May 2, 2023
00714e3
Merge pull request #48 from schottsfired/doc-edits
censullo May 2, 2023
01bcaaf
TW edits to images, diagrams
censullo May 2, 2023
debd527
TW edits to images, diagram
censullo May 2, 2023
4c5d404
TW edits
censullo May 4, 2023
fdc8481
TW edits
censullo May 4, 2023
52ac03f
Merge pull request #49 from censullo/doc-edits
censullo May 4, 2023
ca2a8f4
edit to do doc build
censullo May 4, 2023
94362d2
Merge pull request #50 from censullo/doc-edits
dowen12 May 4, 2023
cd50862
Delete .gitignore
dowen12 May 4, 2023
e981ddd
tw swap out diagram to match landing page
censullo May 4, 2023
7d7c436
Merge pull request #53 from censullo/doc-edits
censullo May 4, 2023
e84d3c3
edit to do doc build
censullo May 4, 2023
b61f366
Merge pull request #55 from censullo/doc-edits
censullo May 4, 2023
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 0 additions & 39 deletions .gitignore

This file was deleted.

Binary file not shown.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file added docs/deployment_guide/images/cfn-outputs.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file not shown.
Binary file not shown.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file not shown.
Binary file modified docs/deployment_guide/images/snyk_api_token_settings.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified docs/deployment_guide/images/snyk_org_id_settings.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified docs/deployment_guide/images/snyk_service_account_settings.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
12 changes: 5 additions & 7 deletions docs/deployment_guide/partner_editable/_settings.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -3,12 +3,10 @@
:partner-product-name: Snyk Developer-First Security
:partner-product-short-name: Snyk
:partner-company-name: Snyk
:doc-month: February
:doc-year: 2022
:partner-contributors: John Smith and Carwin Young, {partner-company-name}
//:other-contributors: Akua Mansa, Trek10
//:aws-contributors: Carwin Young, {partner-company-name}
:doc-month: May
:doc-year: 2023
:partner-contributors: Jay Yeras, John Smith, Carwin Young, David Schott, {partner-company-name}
:aws-ia-contributors: Dylan Owen, AWS Integration & Automation team
:deployment_time: 15 minutes
:deployment_time: 5 minutes
:default_deployment_region: us-east-1
//:private_repo:

18 changes: 8 additions & 10 deletions docs/deployment_guide/partner_editable/architecture.adoc
Original file line number Diff line number Diff line change
@@ -1,18 +1,16 @@
:xrefstyle: short

Deploying this Quick Start for a new virtual private cloud (VPC) with
default parameters builds the following {partner-product-short-name} environment in the
AWS Cloud.
The following resources may be created in your AWS account depending on how you configure and deploy this Partner Solution.

// Replace this example diagram with your own. Follow our wiki guidelines: https://w.amazon.com/bin/view/AWS_Quick_Starts/Process_for_PSAs/#HPrepareyourarchitecturediagram. Upload your source PowerPoint file to the GitHub {deployment name}/docs/images/ directory in this repo.
// Replace this example diagram with your own. Follow our wiki guidelines: https://w.amazon.com/bin/view/AWS_Quick_Starts/Process_for_PSAs/#HPrepareyourarchitecturediagram. Upload your source PowerPoint file to the GitHub {deployment name}/docs/images/ directory in this repo.

[#architecture1]
.Quick Start architecture for {partner-product-short-name} on AWS
.Partner Solution architecture for {partner-product-short-name} on AWS
image::../docs/deployment_guide/images/snyk-security-architecture-diagram.png[Architecture]

As shown in <<architecture1>>, this Quick Start for {partner-product-short-name} Security provides the following deployment options:
As shown in <<architecture1>>, this Partner Solution for {partner-product-short-name} provides the following deployment options:

* AWS Lambda and Amazon ECR full integration with {partner-product-short-name}, including two cross-account AWS Identity and Access Management (IAM) roles for each product.
* AWS Lambda integration with {partner-product-short-name}, including one cross-account IAM role.
* Amazon ECR integration with {partner-product-short-name}, including one cross-account IAM role.
* Amazon ECR integration with {partner-product-short-name} with automated configuration, including one cross-account IAM role.
* Snyk Cloud and Snyk Container integration in a single deployment with Amazon Elastic Container Registry (Amazon ECR) and cross-account AWS Identity and Access Management (IAM) roles.
* A Snyk Cloud-only integration option with cross-account IAM role for Snyk Container.
* A Snyk Container-only integration option with Amazon ECR and cross-account IAM role for Snyk Container.
* A Snyk Container-only integration option with Amazon ECR, a cross-account IAM role for Snyk Container, and AWS Lambda. This deployment option uses Lambda to create and configure a new organization in Snyk's system.
12 changes: 6 additions & 6 deletions docs/deployment_guide/partner_editable/deployment_options.adoc
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
// Edit this placeholder text to accurately describe your architecture.

This Quick Start provides four deployment options:
This Partner Solution provides four deployment options:

* https://fwd.aws/E4m9w?[Deploy {partner-product-short-name} Security full integration^]. This option deploys both Amazon ECR and AWS Lambda integrations for {partner-product-short-name} as a single deployment.
* https://fwd.aws/8rKEy?[Deploy {partner-product-short-name} Security integration with AWS Lambda^]. This option deploys only the AWS Lambda integration for {partner-product-short-name}.
* https://fwd.aws/Nx5kQ?[Deploy {partner-product-short-name} Security integration with Amazon ECR^]. This option deploys only the Amazon ECR integration for {partner-product-short-name}.
* https://fwd.aws/9P7vj?[Deploy {partner-product-short-name} Security integration with Amazon ECR and automated Snyk integration^]. This option deploys the Amazon ECR integration for {partner-product-short-name}. It creates a new organization within a Snyk account that's preconfigured with an Amazon ECR integration.
* https://fwd.aws/E4m9w?[Deploy Snyk full integration^]. This option deploys both Snyk Container and Snyk Cloud integrations as a single deployment.
* https://fwd.aws/eAv97?[Deploy Snyk Cloud integration^]. This option deploys only the Snyk Cloud integration.
* https://fwd.aws/A9jbM?[Deploy Snyk Container integration^]. This option deploys only the Snyk Container integration.
* https://fwd.aws/eeAky?[Deploy Snyk Container integration with automatic installation^]. This option deploys the Snyk Container integration and creates a new Snyk organization that's preconfigured with an Amazon ECR integration.

The Quick Start provides separate templates for these options. It also lets you configure Classless Inter-Domain Routing (CIDR) blocks, instance types, and {partner-product-short-name} settings.
The Partner Solution provides separate AWS CloudFormation templates for each of these options.
6 changes: 4 additions & 2 deletions docs/deployment_guide/partner_editable/licenses.adoc
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
// Include details about any licenses and how to sign up. Provide links as appropriate.

This Quick Start is available to Snyk customers of all pricing plans. If you're not a Snyk customer, you can register for a free account from https://app.snyk.io/login?utm_campaign=Snyk-Security-QS&utm_medium=Partner&utm_source=AWS[Snyk^]. For information about payment plans (required for Amazon ECR on AWS Control Tower option), refer to https://aws.amazon.com/marketplace/pp/prodview-nw2naibu6b2ks?sr=0-1&ref_=beagle&applicationId=AWSMPContessa[Snyk: Developer Security Platform (Business and Enterprise Tiers)^].
The Snyk Container portion of this Partner Solution is available to Snyk customers of all pricing plans, including the free plan. If you're not a Snyk customer, you can create a free account on the https://app.snyk.io/login?utm_campaign=Snyk-Security-QS&utm_medium=Partner&utm_source=AWS[Snyk^] web page.

There is no cost to use this Quick Start, but you will be billed for any AWS resources it deploys. For more information, refer to the https://fwd.aws/rA69w?[AWS Quick Start General Information Guide^].
Other portions of this Partner Solution, such as Snyk Cloud integration and the automated configuration template for Amazon ECR, require a paid plan. For information about payment plans, refer to https://aws.amazon.com/marketplace/pp/prodview-nw2naibu6b2ks?sr=0-1&ref_=beagle&applicationId=AWSMPContessa[Snyk: Developer Security Platform (Team and Enterprise Tiers)^].

There is no cost to use this Partner Solution, but you will be billed for any AWS resources it deploys. For more information, refer to the https://fwd.aws/rA69w?[AWS Partner Solution General Information Guide^].
8 changes: 4 additions & 4 deletions docs/deployment_guide/partner_editable/overview.adoc
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
This guide provides instructions for deploying {partner-product-short-name} on the AWS Cloud. If you are unfamiliar with AWS Quick Starts, refer to the https://fwd.aws/rA69w?[AWS Quick Start General Information Guide^].
This guide provides instructions for deploying {partner-product-short-name} integration resources in the AWS Cloud. If you are unfamiliar with AWS Partner Solutions, refer to the https://fwd.aws/rA69w?[AWS Partner Solution General Information Guide^].

// This deployment guide covers the steps necessary to deploy the Quick Start. For more advanced information on the product, troubleshooting, or additional functionality, refer to the https://{quickstart-github-org}.github.io/{quickstart-project-name}/operational/index.html[Operational guide].
// This deployment guide covers the steps necessary to deploy the Partner Solution. For more advanced information on the product, troubleshooting, or additional functionality, refer to the https://{quickstart-github-org}.github.io/{quickstart-project-name}/operational/index.html[Operational guide].

// For information on using this Quick Start for migrations, refer to the https://{quickstart-github-org}.github.io/{quickstart-project-name}/migration/index.html[Migration guide].
// For information on using this Partner Solution for migrations, refer to the https://{quickstart-github-org}.github.io/{quickstart-project-name}/migration/index.html[Migration guide].

This Quick Start is for developers, DevOps, security teams, and others who build, deploy, and maintain serverless applications or container images that use AWS Lambda and Amazon Elastic Container Registry (Amazon ECR).
This Partner Solution is for developers, DevOps, security teams, and others who want to quickly integrate the https://snyk.io/product/container-vulnerability-management?utm_campaign=Snyk-Security-QS&utm_medium=Partner&utm_source=AWS[Snyk Container^] and https://snyk.io/product/snyk-cloud?utm_campaign=Snyk-Security-QS&utm_medium=Partner&utm_source=AWS[Snyk Cloud^] products with their AWS environment.
56 changes: 41 additions & 15 deletions docs/deployment_guide/partner_editable/post_deployment.adoc
Original file line number Diff line number Diff line change
@@ -1,27 +1,53 @@
//Include any postdeployment steps here, such as steps necessary to test that the deployment was successful. If there are no postdeployment steps leave this file empty.
:xrefstyle: short

== Postdeployment steps
== Post-deployment steps

=== Snyk integration with Amazon ECR
Deploying the Snyk security Quick Start for Amazon Elastic Container Registry (Amazon ECR) creates
an integration for your Snyk organization. After it deploys, you can
add repositories for Snyk to scan by following these steps:
=== Check CloudFormation outputs

In the AWS CloudFormation console, navigate to the *Outputs* tab on the root stack that you deployed, as shown in <<cfn-outputs>>. You will copy and paste these values into the Snyk UI in subsequent steps.

[#cfn-outputs]
.CloudFormation Outputs tab
image::../docs/deployment_guide/images/cfn-outputs.png[CloudFormation Outputs tab,width=100%,height=100%]

=== Snyk Contaner integration

==== Configure the integration in Snyk

NOTE: If you used the *Snyk Container integration with automatic installation* option to deploy Snyk Container integration with Amazon ECR, you can ignore this section.

In the Snyk UI, navigate to your organization's *Integrations* page, then click on *ECR* in the *Container registries* section. Copy the values from the CloudFormation outputs into the Snyk UI as shown in <<ecr-configuration>>.

[#ecr-configuration]
.ECR configuration
image::../docs/deployment_guide/images/ecr-configuration.png[ECR configuration,width=100%,height=100%]

==== Import your container images into Snyk

After installing Snyk Container integration with Amazon ECR, import your container images into Snyk.

. Log in to your Snyk account.
. Navigate to *Projects*, choose *Add projects*, and then choose *Amazon ECR*.
. Select either single or multiple images.
. Choose *Add selected repositories*.
. Choose *Add selected images*.

For more information, refer to https://support.snyk.io/hc/en-us/articles/360003947077-Amazon-Elastic-Container-Registry-ECR-add-images-to-Snyk[Amazon ECR: add images to Snyk^].
For more information, refer to https://docs.snyk.io/scan-containers?utm_campaign=Snyk-Security-QS&utm_medium=Partner&utm_source=AWS[Scan Containers^].

NOTE: Both integration options connect the deployed Amazon ECR instance to the Snyk organization provided in the Quick Start parameters. Deployment may fail, however, if your chosen Snyk organization has an existing ECR integration or if the authentication token you provide in the parameters has insufficient permissions.
=== Snyk Cloud integration

=== Snyk integration with AWS Lambda
. Log in to your Snyk account.
. Navigate to *Projects*, choose *Add projects*, and then choose *AWS Lambda*.
. Select the relevant functions.
. Choose *Add selected functions*.
==== Configure the integration in Snyk

. In the Snyk UI, navigate to your organization's *Integrations* page.
. In the *Cloud platforms* section, choose *AWS*.
. Copy the values from the CloudFormation outputs to the AWS configuration user interface, as shown in <<aws-configuration>>.

[#aws-configuration]
.AWS configuration
image::../docs/deployment_guide/images/aws-configuration.png[ECR configuration,width=100%,height=100%]

==== Scan your AWS Cloud environment with Snyk

NOTE: Snyk supports integrating with AWS Lambda for Node.js, Ruby, and Java projects.
After you install Snyk Cloud integration and Snyk scans your AWS environment, it may take several minutes for scan results to appear. In your Snyk organization, choose *Cloud* to view the scan results.

For more information, refer to https://support.snyk.io/hc/en-us/articles/360004002418-AWS-Lambda-integration[AWS Lambda integration^].
For more information, refer to https://docs.snyk.io/scan-cloud-deployment/snyk-cloud?utm_campaign=Snyk-Security-QS&utm_medium=Partner&utm_source=AWS[Snyk Cloud^].
42 changes: 17 additions & 25 deletions docs/deployment_guide/partner_editable/pre_deployment.adoc
Original file line number Diff line number Diff line change
@@ -1,42 +1,34 @@
//Include any predeployment steps here, such as signing up for a Marketplace AMI or making any changes to a Partner account. If there are none leave this file empty.

== Predeployment steps

== Pre-deployment steps

=== Prepare your AWS account

This Quick Start assumes that you already have Amazon ECR repositories or Lambda functions provisioned in your account.
This Partner Solution assumes that you already have at least one Amazon Elastic Container Registry (ECR) as well as other AWS resources deployed in your account.

=== Prepare your {partner-company-name} account
:xrefstyle: short
Regardless of which Quick Start option you choose, log in to your https://app.snyk.io/[Snyk account^], as shown in <<settings1>>, and obtain your organization ID.
[#settings1]
.Snyk Settings page
image::../docs/deployment_guide/images/snyk_org_id_settings.png[Snyk Organization ID,width=100%,height=100%]
During deployment, you must enter your Snyk organization ID. To find your Snyk organization ID, refer to https://docs.snyk.io/scan-application-code/snyk-code/cli-for-snyk-code/before-you-start-set-the-organization-for-the-cli-tests/finding-the-snyk-id-and-internal-name-of-an-organization[Finding the Snyk ID and internal name of an Organization^].

=== Snyk AWS account numbers

During deployment, enter the folllowing values for the *Snyk Container AWS account number* and *Snyk Cloud AWS account number* parameters. These parameters are required to enable the deployed IAM roles to function.

=== Automated configuration for Amazon ECR
If you deploy Snyk security using the automated configuration option for Amazon ECR, obtain an API authentication token. The token automates the creation of organizations and ECR integrations within Snyk.
* Snyk Container AWS account number: `198361731867`
* Snyk Cloud AWS account number: `370134896156`

You may use either your personal account token, available through your Snyk account's settings page, as shown in <<settings2>>, or a service-account token. Service-account tokens can be generated through the **Settings** page for your organization within Snyk, as shown in <<settings3>>. For more information, refer to https://docs.snyk.io/features/integrations/managing-integrations/service-accounts[Service accounts^].
WARNING: This deployment enables Snyk to assume an IAM role in your AWS account.

NOTE: An automated integration of Amazon ECR with Snyk requires a paid Snyk subscription.
=== [Optional] Automatic installation for Amazon ECR
To deploy the automatic installation option for Amazon ECR, obtain an API authentication token. AWS Lambda and the Snyk API are used to automate the creation of organizations and ECR integrations within Snyk.

You may use either your personal account token, available through your Snyk account's settings page, as shown in <<settings2>>, or a service account token. Service account tokens can be generated through the **Settings** page for your organization within Snyk, as shown in <<settings3>>. For more information, refer to https://docs.snyk.io/snyk-admin/service-accounts?utm_campaign=Snyk-Security-QS&utm_medium=Partner&utm_source=AWS[Service accounts^].

NOTE: Automatic installation requires a paid Snyk subscription to use the Snyk API.

[#settings2]
.Snyk account settings page
image::../docs/deployment_guide/images/snyk_api_token_settings.png[Snyk account API token,width=100%,height=100%]

[#settings3]
.Snyk organization service account settings
image::../docs/deployment_guide/images/snyk_service_account_settings.png[Snyk Service Account settings,width=100%,height=100%]


=== Snyk account access

For IAM roles to function, you must connect your Snyk account to your AWS Lambda account. Enter your Snyk ID for the *Snyk AWS account ID* parameter, as shown in <<snyk-aws-account-id>>.


WARNING: This deployment enables Snyk to assume an IAM role in your account.

[#snyk-aws-account-id]
.Snyk account ID for AWS Lambda
image::../docs/deployment_guide/images/snyk-lambda-account-id.png[Snyk account ID for AWS Lambda,width=60%,height=60%]
image::../docs/deployment_guide/images/snyk_service_account_settings.png[Snyk service account settings,width=100%,height=100%]
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
//Add any unique troubleshooting steps here.

For common Quick Start issues, refer to the https://fwd.aws/rA69w?[AWS Quick Start General Information Guide^] and https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/troubleshooting.html[Troubleshooting CloudFormation^].
For common Partner Solution issues, refer to the https://fwd.aws/rA69w?[AWS Partner Solution General Information Guide^] and https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/troubleshooting.html[Troubleshooting CloudFormation^].