Skip to content

Commit 9db20b6

Browse files
vijaykanthmiyabchen
vijaykanthm
authored and
iyabchen
committed
Add Resource v1 SCC Findings Export to BQ Project Config (GoogleCloudPlatform#11595)
1 parent 15a5b1e commit 9db20b6

File tree

3 files changed

+278
-0
lines changed

3 files changed

+278
-0
lines changed

‎mmv1/products/securitycenter/ProjectSccBigQueryExport.yaml

+130
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
# Copyright 2024 Google Inc.
2+
# Licensed under the Apache License, Version 2.0 (the "License");
3+
# you may not use this file except in compliance with the License.
4+
# You may obtain a copy of the License at
5+
#
6+
# http://www.apache.org/licenses/LICENSE-2.0
7+
#
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
14+
--- !ruby/object:Api::Resource
15+
name: 'ProjectSccBigQueryExport'
16+
base_url: projects/{{project}}/bigQueryExports
17+
self_link: projects/{{project}}/bigQueryExports/{{big_query_export_id}}
18+
create_url: projects/{{project}}/bigQueryExports?bigQueryExportId={{big_query_export_id}}
19+
update_verb: :PATCH
20+
update_mask: true
21+
import_format:
22+
- 'projects/{{project}}/bigQueryExports/{{big_query_export_id}}'
23+
description: |
24+
A Cloud Security Command Center (Cloud SCC) Big Query Export Config.
25+
It represents exporting Security Command Center data, including assets, findings, and security marks
26+
using gcloud scc bqexports
27+
~> **Note:** In order to use Cloud SCC resources, your organization must be enrolled
28+
in [SCC Standard/Premium](https://cloud.google.com/security-command-center/docs/quickstart-security-command-center).
29+
Without doing so, you may run into errors during resource creation.
30+
references: !ruby/object:Api::Resource::ReferenceLinks
31+
guides:
32+
'Official Documentation': 'https://cloud.google.com/security-command-center/docs/how-to-analyze-findings-in-big-query'
33+
api: 'https://cloud.google.com/security-command-center/docs/reference/rest/v1/projects.bigQueryExports'
34+
examples:
35+
- !ruby/object:Provider::Terraform::Examples
36+
name: 'scc_project_big_query_export_config_basic'
37+
primary_resource_id: 'custom_big_query_export_config'
38+
external_providers: ["random", "time"]
39+
skip_test: true
40+
vars:
41+
big_query_export_id: 'my-export'
42+
dataset: 'my-dataset'
43+
dataset_id: 'my_dataset_id'
44+
name: 'my-export'
45+
test_env_vars:
46+
org_id: :ORG_ID
47+
project: :PROJECT_NAME
48+
ignore_read_extra:
49+
- 'project'
50+
parameters:
51+
- !ruby/object:Api::Type::String
52+
name: bigQueryExportId
53+
required: true
54+
immutable: true
55+
url_param_only: true
56+
description: |
57+
This must be unique within the organization.
58+
properties:
59+
- !ruby/object:Api::Type::String
60+
name: name
61+
output: true
62+
description: |
63+
The resource name of this export, in the format
64+
`projects/{{project}}/bigQueryExports/{{big_query_export_id}}`.
65+
This field is provided in responses, and is ignored when provided in create requests.
66+
- !ruby/object:Api::Type::String
67+
name: description
68+
description: |
69+
The description of the notification config (max of 1024 characters).
70+
validation: !ruby/object:Provider::Terraform::Validation
71+
function: 'validation.StringLenBetween(0, 1024)'
72+
- !ruby/object:Api::Type::String
73+
name: dataset
74+
description: |
75+
The dataset to write findings' updates to.
76+
Its format is "projects/[projectId]/datasets/[bigquery_dataset_id]".
77+
BigQuery Dataset unique ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_).
78+
- !ruby/object:Api::Type::String
79+
name: createTime
80+
output: true
81+
description: |
82+
The time at which the BigQuery export was created. This field is set by the server and will be ignored if provided on export on creation.
83+
A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
84+
Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
85+
- !ruby/object:Api::Type::String
86+
name: updateTime
87+
output: true
88+
description: |
89+
The most recent time at which the BigQuery export was updated. This field is set by the server and will be ignored if provided on export creation or update.
90+
A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
91+
Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
92+
- !ruby/object:Api::Type::String
93+
name: mostRecentEditor
94+
output: true
95+
description: |
96+
Email address of the user who last edited the BigQuery export.
97+
This field is set by the server and will be ignored if provided on export creation or update.
98+
- !ruby/object:Api::Type::String
99+
name: principal
100+
output: true
101+
description: |
102+
The service account that needs permission to create table and upload data to the BigQuery dataset.
103+
- !ruby/object:Api::Type::String
104+
name: filter
105+
description: |
106+
Expression that defines the filter to apply across create/update
107+
events of findings. The
108+
expression is a list of zero or more restrictions combined via
109+
logical operators AND and OR. Parentheses are supported, and OR
110+
has higher precedence than AND.
111+
112+
Restrictions have the form <field> <operator> <value> and may have
113+
a - character in front of them to indicate negation. The fields
114+
map to those defined in the corresponding resource.
115+
116+
The supported operators are:
117+
118+
* = for all value types.
119+
* \>, <, >=, <= for integer values.
120+
* :, meaning substring matching, for strings.
121+
122+
The supported value types are:
123+
124+
* string literals in quotes.
125+
* integer literals without quotes.
126+
* boolean literals true and false without quotes.
127+
128+
See
129+
[Filtering notifications](https://cloud.google.com/security-command-center/docs/how-to-api-filter-notifications)
130+
for information on how to write a filter.

‎mmv1/templates/terraform/examples/scc_project_big_query_export_config_basic.tf.erb

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
resource "google_bigquery_dataset" "default" {
2+
dataset_id = "<%= ctx[:vars]['dataset_id'] %>"
3+
friendly_name = "test"
4+
description = "This is a test description"
5+
location = "US"
6+
default_table_expiration_ms = 3600000
7+
default_partition_expiration_ms = null
8+
9+
labels = {
10+
env = "default"
11+
}
12+
13+
lifecycle {
14+
ignore_changes = [default_partition_expiration_ms]
15+
}
16+
}
17+
18+
resource "google_scc_project_scc_big_query_export" "<%= ctx[:primary_resource_id] %>" {
19+
name = "<%= ctx[:vars]['name'] %>"
20+
big_query_export_id = "<%= ctx[:vars]['big_query_export_id'] %>"
21+
project = "<%= ctx[:test_env_vars]['project'] %>"
22+
dataset = google_bigquery_dataset.default.id
23+
description = "Cloud Security Command Center Findings Big Query Export Config"
24+
filter = "state=\"ACTIVE\" AND NOT mute=\"MUTED\""
25+
}

‎mmv1/third_party/terraform/services/securitycenter/resource_scc_project_big_query_export_config_test.go

+123
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
package securitycenter_test
2+
3+
import (
4+
"testing"
5+
6+
"github.com/hashicorp/terraform-plugin-testing/helper/resource"
7+
"github.com/hashicorp/terraform-provider-google/google/acctest"
8+
"github.com/hashicorp/terraform-provider-google/google/envvar"
9+
)
10+
11+
func TestAccSecurityCenterProjectBigQueryExportConfig_basic(t *testing.T) {
12+
t.Parallel()
13+
14+
randomSuffix := acctest.RandString(t, 10)
15+
dataset_id := "tf_test_" + randomSuffix
16+
orgID := envvar.GetTestOrgFromEnv(t)
17+
18+
context := map[string]interface{}{
19+
"org_id": orgID,
20+
"random_suffix": randomSuffix,
21+
"dataset_id": dataset_id,
22+
"big_query_export_id": "tf-test-export-" + randomSuffix,
23+
"project": envvar.GetTestProjectFromEnv(),
24+
}
25+
26+
acctest.VcrTest(t, resource.TestCase{
27+
PreCheck: func() { acctest.AccTestPreCheck(t) },
28+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
29+
ExternalProviders: map[string]resource.ExternalProvider{
30+
"random": {},
31+
"time": {},
32+
},
33+
Steps: []resource.TestStep{
34+
{
35+
Config: testAccSecurityCenterProjectBigQueryExportConfig_basic(context),
36+
},
37+
{
38+
ResourceName: "google_scc_project_scc_big_query_export.default",
39+
ImportState: true,
40+
ImportStateVerify: true,
41+
ImportStateVerifyIgnore: []string{"update_time", "project"},
42+
},
43+
{
44+
Config: testAccSecurityCenterProjectBigQueryExportConfig_update(context),
45+
},
46+
{
47+
ResourceName: "google_scc_project_scc_big_query_export.default",
48+
ImportState: true,
49+
ImportStateVerify: true,
50+
ImportStateVerifyIgnore: []string{"update_time", "project"},
51+
},
52+
},
53+
})
54+
}
55+
56+
func testAccSecurityCenterProjectBigQueryExportConfig_basic(context map[string]interface{}) string {
57+
return acctest.Nprintf(`
58+
59+
resource "google_bigquery_dataset" "default" {
60+
dataset_id = "%{dataset_id}"
61+
friendly_name = "test"
62+
description = "This is a test description"
63+
location = "US"
64+
default_table_expiration_ms = 3600000
65+
default_partition_expiration_ms = null
66+
67+
labels = {
68+
env = "default"
69+
}
70+
71+
lifecycle {
72+
ignore_changes = [default_partition_expiration_ms]
73+
}
74+
}
75+
76+
resource "time_sleep" "wait_1_minute" {
77+
depends_on = [google_bigquery_dataset.default]
78+
create_duration = "3m"
79+
}
80+
81+
resource "google_scc_project_scc_big_query_export" "default" {
82+
big_query_export_id = "%{big_query_export_id}"
83+
project = "%{project}"
84+
dataset = google_bigquery_dataset.default.id
85+
description = "Cloud Security Command Center Findings Big Query Export Config"
86+
filter = "state=\"ACTIVE\" AND NOT mute=\"MUTED\""
87+
88+
depends_on = [time_sleep.wait_1_minute]
89+
}
90+
91+
`, context)
92+
}
93+
94+
func testAccSecurityCenterProjectBigQueryExportConfig_update(context map[string]interface{}) string {
95+
return acctest.Nprintf(`
96+
97+
resource "google_bigquery_dataset" "default" {
98+
dataset_id = "%{dataset_id}"
99+
friendly_name = "test"
100+
description = "This is a test description"
101+
location = "US"
102+
default_table_expiration_ms = 3600000
103+
default_partition_expiration_ms = null
104+
105+
labels = {
106+
env = "default"
107+
}
108+
109+
lifecycle {
110+
ignore_changes = [default_partition_expiration_ms]
111+
}
112+
}
113+
114+
resource "google_scc_project_scc_big_query_export" "default" {
115+
big_query_export_id = "%{big_query_export_id}"
116+
project = "%{project}"
117+
dataset = google_bigquery_dataset.default.id
118+
description = "SCC Findings Big Query Export Update"
119+
filter = "state=\"ACTIVE\" AND NOT mute=\"MUTED\""
120+
}
121+
122+
`, context)
123+
}

0 commit comments

Comments
 (0)