Creating custom controls

Before you begin

You can create custom controls for all services and resources that Workload Protection supports by using API and Terraform. To create custom controls, make sure that you have the following prerequisites:

• Terraform version higher than 0.12.x
• Go version higher than the one specified in go.mod and $GOPATH
• Terraform Provider for IBM Cloud Security and Compliance Center Workload Protection.

Getting a list of services

To get the list of services, you can target in resourceKind by using the following example command:

GET https://<url>/api/cspm/v1/policy/controls/resource-template/kinds

To view the complete list of resources that are available in the API endpoints, see Resource kinds. For more information, see Workload Protection API

Configuring tokens and keys

• Get the API tokens.

• Replace the Sysdig API tokens in the following code snippet:

   required_providers {
    sysdig = {
      source = "local/sysdiglabs/sysdig"
      version = "~> 1.0.0"
    }
  }
}
provider "sysdig" {
  sysdig_secure_url="https://us-south.security-compliance-secure.cloud.ibm.com"
  sysdig_secure_api_token = "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXXX"
}

Creating resources for custom controls

Workload Protection uses the sysdig_secure_posture_control resource to define custom controls. For more information, see Creating posture control.The following are the resource attributes:

• name: The name of the custom control
• description: A detailed behaviour of custom control
• resource_kind: The type of resource the control applies to (for example, IBM Cloud Internet Services, Kubernetes pods). To create new controls, the resource_kind value must be written in lowercase. For example, resource_kind = "ibm_user-management_user".
• severity: The severity level (High, Medium, Low) that defines the control's importance
• rego: The Rego policy code that defines the control logic
• remediation_details: Instructions for remediating any issues identified by the control

Applying your custom control

You can assign the new custom control to a new or existing Workload Protection posture policy based on your enterprise needs. The following example is created by using these steps:

1. Navigate to Policies > Posture | Policies.
2. Select New Policy.
3. Configure the policy and click Save
   • Duplicate from: None. Start from scratch.
   • Name: Custom Controls_DDoS protection is active on IBM Cloud Internet Services.
   • Description: Add a description.
4. Click Publish on the policy details page.
5. Workload Protection prompts you to edit the policy. Alternatively, you can find the policy from the posture policies list, and select Edit.
6. In the Policy Details tab, select Add Zones, and choose the infrastructure scope across which the new control must apply.
7. In the Requirements & Controls, link your custom control to evaluate the posture compliance of your defined infrastructure.

To roll back, delete the resource definitions from your Terraform file and reapply. It updates the posture controls library and detaches the defined controls from the policies.

List of resource Kinds

The following is the complete list of resource kinds: