Sym

Sym Docs

Welcome to the Sym docs!

Sym is the security workflow platform made for engineers, by engineers. We build primitives for best-practice controls so you don't have to!

If you're not sure where to start, check out Sym Concepts, or read the Sym Manifesto.
If you're implementing a Sym Flow, you might also want to check out our SDK Docs.

    

Setup the Runtime

The Sym Runtime can be deployed to your cloud or ours, and is where sensitive operations take place.

To get your instance of the Sym Runtime set up, there's some one-time provisioning to do with our Terraform provider. Before following this guide, please make sure you have deployed the platform.

📘

Sym Hosted vs Hosted by You

This guide assumes that you are using the Sym-hosted version of the Runtime. You can also deploy the Runtime to your cloud as a virtual appliance.

Provision a Runtime instance

Setup Provider

We'll start by creating a new Terraform file, sym/integration/main.tf. First, we'll add the Sym Terraform provider.

terraform {
  required_version = ">= 0.14"
  required_providers {
    sym = {
      source = "terraform.symops.com/symopsio/sym"
      version = "0.1"
    }
  }
}

You'll need to specify your org, which you will be provided when you sign up for Sym. Your API key will be pulled from symflow CLI.

provider "sym" {
  org = "healthy-health"
}

# The resources in this configuration are all provisioned into an environment
# keyed off of the local.environment variable. More complex Terraform
# configurations can parameterize the environment so you can manage Sym
# resources using your SDLC.
locals {
  environment = "prod"
}

Declare Integrations

Next, we'll declare an instance of the Sym runtime, and a connector for your Slack install.

# The runtime environment where your workflows execute.
# This runtime will write audit logs to an S3 bucket managed by you, so
# that you can ship those logs to places like Splunk.
#
# This runtime is hosted by Sym, but you can also choose to self-host your
# runtime while still using the centralized Sym control plane. You can also
# tune the permissions that each runtime has when required.
resource "sym_runtime" "this" {
  name = local.environment

  settings = {
    log_bucket = "log-bucket-shared-to-sym"
    log_prefix = "/sym/${local.environment}"
  }
}

# Declare the Slack app that your workflows will use.
# When you install the Slack app, you'll be prompted for 
# the ID of this sym_integration.
resource "sym_integration" "slack" {
  type = "slack"
  name = local.environment
}

For convenience, we'll also add an output with the integration_id of our Slack integration, so we can easily feed it to symflow later.

# Output the Slack integration_id for use in `symflow add-to-slack`
output "slack_integration_id" {
  description = "Slack Integration ID"
  value       = sym_integration.slack.id
}

Provision Sym

All that's left is to run terraform apply and let Sym handle the rest.

$ symflow login
Email: [email protected]
Successfully loaded org: healthy-health
Login succeeded
Credentials stored to ~/.config/symflow

$ terraform init

Initializing the backend...

Initializing provider plugins...
- Installing terraform.symops.com/symopsio/sym v0.1.0...
- Installed terraform.symops.com/symopsio/sym v0.1.0 

$ terraform apply

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # sym_runtime.this will be created
  + resource "sym_runtime" "this" {
    ...
  }
  
  # sym_integration.slack will be created
  + resource "sym_integration" "slack" {
    ...
  }

Plan: 2 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

sym_runtime.this: Creating...
sym_runtime.this: Creation complete after 1s [id=8f77b7c9-c93f-4cb8-815e-6f0570dbb155]
sym_integration.slack: Creating...
sym_integration.slack: Creation complete after 1s [id=75f4dba1-cdeb-4903-a5dd-377761430a1c]

Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

Outputs:

slack_integration_id = 75f4dba1-cdeb-4903-a5dd-377761430a1c

Install Slack Bot

I lied, one more step! You'll now want to install the slack bot.

symflow add-to-slack 75f4dba1-cdeb-4903-a5dd-377761430a1c

Updated about a month ago


What's Next

If you'd like to see all the code we just wrote as one file, check out the next section!

Runtime Setup Terraform

Setup the Runtime


The Sym Runtime can be deployed to your cloud or ours, and is where sensitive operations take place.

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.