Skip to content

Commit 5edd4ca

Browse files
author
Matt Cadorette
authored
fix(GROW-2950): disable use of gcp storage audit from generate (#1643)
* fix(GROW-2950): disable use of gcp storage audit from generate * fix(GROW-2950): remove gcp audit log storage references * fix(GROW-2950): remove unused gcp pubsub func * fix(GROW-2950): all generation tests should use pub/sub * fix(GROW-2950): fix help text * fix(GROW-2950): remove ubla flags * fix(GROW-2950): remove references to gcp bucket_region * fix(GROW-2950): remove unused validateGcpRegion func * chore(GROW-2950): temporarily disable test * fix(GROW-2950): fix int tests not using pubsub audit * fix: re-enable test
1 parent 889c40a commit 5edd4ca

File tree

3 files changed

+36
-468
lines changed

3 files changed

+36
-468
lines changed

‎cli/cmd/generate_gcp.go‎

Lines changed: 11 additions & 180 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ var (
1919
QuestionGcpEnableAgentless = "Enable Agentless integration?"
2020
QuestionGcpEnableConfiguration = "Enable Configuration integration?"
2121
QuestionGcpEnableAuditLog = "Enable Audit Log integration?"
22-
QuestionUsePubSubAudit = "Use Pub Sub Audit Log?"
2322
QuestionGcpOrganizationIntegration = "Organization integration?"
2423
QuestionGcpOrganizationID = "Specify the GCP organization ID:"
2524
QuestionGcpProjectID = "Specify the project ID to be used to provision Lacework resources:"
@@ -35,16 +34,9 @@ var (
3534
"you want to monitor: (optional)"
3635
QuestionGcpRegions = "Specify a comma separated list of regions to deploy Agentless:"
3736

38-
GcpAdvancedOptAuditLog = "Configure additional Audit Log options"
39-
QuestionGcpUseExistingBucket = "Use an existing bucket?"
40-
QuestionGcpExistingBucketName = "Specify an existing bucket name:"
41-
QuestionGcpConfigureNewBucket = "Configure settings for new bucket?"
42-
QuestionGcpBucketRegion = "Specify the bucket region: (optional)"
43-
QuestionGcpCustomBucketName = "Specify a custom bucket name: (optional)"
44-
QuestionGcpBucketLifecycle = "Specify the bucket lifecycle rule age: (optional)"
45-
QuestionGcpEnableUBLA = "Enable uniform bucket level access(UBLA)?"
46-
QuestionGcpUseExistingSink = "Use an existing sink?"
47-
QuestionGcpExistingSinkName = "Specify the existing sink name"
37+
GcpAdvancedOptAuditLog = "Configure additional Audit Log options"
38+
QuestionGcpUseExistingSink = "Use an existing sink?"
39+
QuestionGcpExistingSinkName = "Specify the existing sink name"
4840

4941
GcpAdvancedOptIntegrationName = "Customize integration name(s)"
5042
QuestionGcpConfigurationIntegrationName = "Specify a custom configuration integration name: (optional)"
@@ -111,27 +103,22 @@ See help output for more details on the parameter value(s) required for Terrafor
111103
gcp.WithExistingServiceAccount(GenerateGcpCommandState.ExistingServiceAccount),
112104
gcp.WithConfigurationIntegrationName(GenerateGcpCommandState.ConfigurationIntegrationName),
113105
gcp.WithAuditLogLabels(GenerateGcpCommandState.AuditLogLabels),
114-
gcp.WithBucketLabels(GenerateGcpCommandState.BucketLabels),
115106
gcp.WithPubSubSubscriptionLabels(GenerateGcpCommandState.PubSubSubscriptionLabels),
116107
gcp.WithPubSubTopicLabels(GenerateGcpCommandState.PubSubTopicLabels),
117-
gcp.WithCustomBucketName(GenerateGcpCommandState.CustomBucketName),
118-
gcp.WithBucketRegion(GenerateGcpCommandState.BucketRegion),
119-
gcp.WithExistingLogBucketName(GenerateGcpCommandState.ExistingLogBucketName),
120108
gcp.WithExistingLogSinkName(GenerateGcpCommandState.ExistingLogSinkName),
121109
gcp.WithAuditLogIntegrationName(GenerateGcpCommandState.AuditLogIntegrationName),
122110
gcp.WithLaceworkProfile(GenerateGcpCommandState.LaceworkProfile),
123-
gcp.WithLogBucketLifecycleRuleAge(GenerateGcpCommandState.LogBucketLifecycleRuleAge),
124111
gcp.WithFoldersToInclude(GenerateGcpCommandState.FoldersToInclude),
125112
gcp.WithFoldersToExclude(GenerateGcpCommandState.FoldersToExclude),
126113
gcp.WithCustomFilter(GenerateGcpCommandState.CustomFilter),
127114
gcp.WithGoogleWorkspaceFilter(GenerateGcpCommandState.GoogleWorkspaceFilter),
128115
gcp.WithK8sFilter(GenerateGcpCommandState.K8sFilter),
129116
gcp.WithPrefix(GenerateGcpCommandState.Prefix),
130117
gcp.WithWaitTime(GenerateGcpCommandState.WaitTime),
131-
gcp.WithEnableUBLA(GenerateGcpCommandState.EnableUBLA),
132118
gcp.WithMultipleProject(GenerateGcpCommandState.Projects),
133119
gcp.WithProjectFilterList(GenerateGcpCommandState.ProjectFilterList),
134120
gcp.WithRegions(GenerateGcpCommandState.Regions),
121+
gcp.WithUsePubSubAudit(true), // always set to true, storage based integration deprecated
135122
}
136123

137124
if GenerateGcpCommandState.OrganizationIntegration {
@@ -212,15 +199,6 @@ See help output for more details on the parameter value(s) required for Terrafor
212199
}
213200
}
214201

215-
// Validate gcp region, if passed
216-
region, err := cmd.Flags().GetString("bucket_region")
217-
if err != nil {
218-
return errors.Wrap(err, "failed to load command flags")
219-
}
220-
if err := validateGcpRegion(region); err != nil {
221-
return err
222-
}
223-
224202
projectId, err := cmd.Flags().GetString("project_id")
225203
if err != nil {
226204
return errors.Wrap(err, "failed to load command flags")
@@ -283,20 +261,17 @@ See help output for more details on the parameter value(s) required for Terrafor
283261
)
284262

285263
type GcpGenerateCommandExtraState struct {
286-
AskAdvanced bool
287-
Output string
288-
ConfigureNewBucketSettings bool
289-
UseExistingServiceAccount bool
290-
UseExistingBucket bool
291-
UseExistingSink bool
292-
TerraformApply bool
264+
AskAdvanced bool
265+
Output string
266+
UseExistingServiceAccount bool
267+
UseExistingSink bool
268+
TerraformApply bool
293269
}
294270

295271
func (gcp *GcpGenerateCommandExtraState) isEmpty() bool {
296272
return gcp.Output == "" &&
297273
!gcp.AskAdvanced &&
298274
!gcp.UseExistingServiceAccount &&
299-
!gcp.UseExistingBucket &&
300275
!gcp.UseExistingSink &&
301276
!gcp.TerraformApply
302277
}
@@ -361,22 +336,6 @@ func initGenerateGcpTfCommandFlags() {
361336
"configuration_integration_name",
362337
"",
363338
"specify a custom configuration integration name")
364-
generateGcpTfCommand.PersistentFlags().StringVar(
365-
&GenerateGcpCommandState.CustomBucketName,
366-
"custom_bucket_name",
367-
"",
368-
"override prefix based storage bucket name generation with a custom name")
369-
// TODO: Implement AuditLogLabels, BucketLabels, PubSubSubscriptionLabels & PubSubTopicLabels
370-
generateGcpTfCommand.PersistentFlags().StringVar(
371-
&GenerateGcpCommandState.BucketRegion,
372-
"bucket_region",
373-
"",
374-
"specify bucket region")
375-
generateGcpTfCommand.PersistentFlags().StringVar(
376-
&GenerateGcpCommandState.ExistingLogBucketName,
377-
"existing_bucket_name",
378-
"",
379-
"specify existing bucket name")
380339
generateGcpTfCommand.PersistentFlags().StringVar(
381340
&GenerateGcpCommandState.ExistingLogSinkName,
382341
"existing_sink_name",
@@ -393,27 +352,8 @@ func initGenerateGcpTfCommandFlags() {
393352
[]string{},
394353
"List of GCP regions to deploy for Agentless integration")
395354

396-
// DEPRECATED
397-
generateGcpTfCommand.PersistentFlags().BoolVar(
398-
&GenerateGcpCommandState.EnableForceDestroyBucket,
399-
"enable_force_destroy_bucket",
400-
true,
401-
"enable force bucket destroy")
402-
errcheckWARN(generateGcpTfCommand.PersistentFlags().MarkDeprecated(
403-
"enable_force_destroy_bucket", "by default, force destroy is enabled.",
404-
))
405355
// ---
406356

407-
generateGcpTfCommand.PersistentFlags().BoolVar(
408-
&GenerateGcpCommandState.EnableUBLA,
409-
"enable_ubla",
410-
true,
411-
"enable universal bucket level access(ubla)")
412-
generateGcpTfCommand.PersistentFlags().IntVar(
413-
&GenerateGcpCommandState.LogBucketLifecycleRuleAge,
414-
"bucket_lifecycle_rule_age",
415-
-1,
416-
"specify the lifecycle rule age")
417357
generateGcpTfCommand.PersistentFlags().StringVar(
418358
&GenerateGcpCommandState.CustomFilter,
419359
"custom_filter",
@@ -476,39 +416,15 @@ func initGenerateGcpTfCommandFlags() {
476416
generateGcpTfCommand.PersistentFlags().BoolVar(
477417
&GenerateGcpCommandState.UsePubSubAudit,
478418
"use_pub_sub",
479-
false,
480-
"use pub/sub for the audit log data rather than bucket")
419+
true,
420+
"deprecated: pub/sub audit log integration is always used and only supported type")
481421
generateGcpTfCommand.PersistentFlags().StringSliceVar(
482422
&GenerateGcpCommandState.Projects,
483423
"projects",
484424
[]string{},
485425
"list of project IDs to integrate with (project-level integrations)")
486426
}
487427

488-
// survey.Validator for gcp region
489-
func validateGcpRegion(val interface{}) error {
490-
switch value := val.(type) {
491-
case string:
492-
// as this field is optional, it is valid for this field to be empty
493-
if value != "" {
494-
// if value doesn't match regex, return invalid arn
495-
ok, err := regexp.MatchString(GcpRegionRegex, value)
496-
if err != nil {
497-
return errors.Wrap(err, "failed to validate input")
498-
}
499-
500-
if !ok {
501-
return errors.New("invalid region name supplied")
502-
}
503-
}
504-
default:
505-
// if the value passed is not a string
506-
return errors.New("value must be a string")
507-
}
508-
509-
return nil
510-
}
511-
512428
func promptGcpAgentlessQuestions(
513429
config *gcp.GenerateGcpTfConfigurationArgs,
514430
extraState *GcpGenerateCommandExtraState,
@@ -534,20 +450,6 @@ func promptGcpAuditLogQuestions(
534450
extraState *GcpGenerateCommandExtraState,
535451
) error {
536452

537-
// Only ask these questions if configure audit log is true
538-
if err := SurveyMultipleQuestionWithValidation([]SurveyQuestionWithValidationArgs{
539-
{
540-
Prompt: &survey.Confirm{Message: QuestionUsePubSubAudit, Default: config.UsePubSubAudit},
541-
Checks: []*bool{&config.AuditLog},
542-
Response: &config.UsePubSubAudit,
543-
},
544-
}, config.AuditLog); err != nil {
545-
return err
546-
}
547-
// Present the user with Bucket Configuration options, if required
548-
if err := promptGcpBucketConfiguration(config, extraState); err != nil {
549-
return err
550-
}
551453
err := SurveyMultipleQuestionWithValidation([]SurveyQuestionWithValidationArgs{
552454
{
553455
Prompt: &survey.Confirm{Message: QuestionGcpUseExistingSink, Default: extraState.UseExistingSink},
@@ -571,77 +473,6 @@ func promptGcpAuditLogQuestions(
571473
return err
572474
}
573475

574-
func promptGcpBucketConfiguration(
575-
config *gcp.GenerateGcpTfConfigurationArgs, extraState *GcpGenerateCommandExtraState,
576-
) error {
577-
// Prompt to configure bucket information (not required when using the Pub Sub Audit Log)
578-
if err := SurveyMultipleQuestionWithValidation([]SurveyQuestionWithValidationArgs{
579-
{
580-
Prompt: &survey.Confirm{Message: QuestionGcpUseExistingBucket, Default: extraState.UseExistingBucket},
581-
Checks: []*bool{&config.AuditLog, usePubSubActivityDisabled(config)},
582-
Response: &extraState.UseExistingBucket,
583-
},
584-
{
585-
Prompt: &survey.Input{Message: QuestionGcpExistingBucketName, Default: config.ExistingLogBucketName},
586-
Checks: []*bool{&config.AuditLog, &extraState.UseExistingBucket, usePubSubActivityDisabled(config)},
587-
Required: true,
588-
Response: &config.ExistingLogBucketName,
589-
},
590-
}, config.AuditLog); err != nil {
591-
return err
592-
}
593-
594-
newBucket := !extraState.UseExistingBucket
595-
err := SurveyMultipleQuestionWithValidation([]SurveyQuestionWithValidationArgs{
596-
{
597-
Prompt: &survey.Confirm{Message: QuestionGcpConfigureNewBucket, Default: extraState.ConfigureNewBucketSettings},
598-
Checks: []*bool{&config.AuditLog, &newBucket, usePubSubActivityDisabled(config)},
599-
Required: true,
600-
Response: &extraState.ConfigureNewBucketSettings,
601-
},
602-
{
603-
Prompt: &survey.Input{Message: QuestionGcpBucketRegion, Default: config.BucketRegion},
604-
Checks: []*bool{&config.AuditLog,
605-
&newBucket,
606-
&extraState.ConfigureNewBucketSettings,
607-
usePubSubActivityDisabled(config)},
608-
Opts: []survey.AskOpt{survey.WithValidator(validateGcpRegion)},
609-
Response: &config.BucketRegion,
610-
},
611-
{
612-
Prompt: &survey.Input{Message: QuestionGcpCustomBucketName, Default: config.CustomBucketName},
613-
Checks: []*bool{&config.AuditLog,
614-
&newBucket,
615-
&extraState.ConfigureNewBucketSettings,
616-
usePubSubActivityDisabled(config)},
617-
Response: &config.CustomBucketName,
618-
},
619-
{
620-
Prompt: &survey.Input{Message: QuestionGcpBucketLifecycle, Default: "-1"},
621-
Checks: []*bool{&config.AuditLog,
622-
&newBucket,
623-
&extraState.ConfigureNewBucketSettings,
624-
usePubSubActivityDisabled(config)},
625-
Response: &config.LogBucketLifecycleRuleAge,
626-
},
627-
{
628-
Prompt: &survey.Confirm{Message: QuestionGcpEnableUBLA, Default: config.EnableUBLA},
629-
Checks: []*bool{&config.AuditLog,
630-
&newBucket,
631-
&extraState.ConfigureNewBucketSettings,
632-
usePubSubActivityDisabled(config)},
633-
Required: true,
634-
Response: &config.EnableUBLA,
635-
},
636-
}, config.AuditLog)
637-
638-
return err
639-
}
640-
641-
func usePubSubActivityDisabled(config *gcp.GenerateGcpTfConfigurationArgs) *bool {
642-
usePubSubActivityDisabled := !config.UsePubSubAudit
643-
return &usePubSubActivityDisabled
644-
}
645476
func promptGcpExistingServiceAccountQuestions(config *gcp.GenerateGcpTfConfigurationArgs) error {
646477
// ensure struct is initialized
647478
if config.ExistingServiceAccount == nil {

0 commit comments

Comments
 (0)