Merge "new rule: Bigquery Concurrent api requests"

-- Branch commit log --
commit 4da64b727a1a5178745068a57cfeeaeb7d9de706
Author:  gcpdiag team <noreply@google.com>
Date:    2024-07-01T07:44:04Z

    new rule: Bigquery Concurrent api requests

fixes: b/309421725

Change-Id: I72680452cee076192df1e8f957fc89a10fab6f94
GitOrigin-RevId: 41bfd1352b49b3cdd625ba82f6df78bb77c82479

gcpdiag/lint/bigquery/snapshots/WARN_2024_003.txt

@@ -0,0 +1,4 @@
+*  bigquery/WARN/2024_003: BigQuery job does not fail due to Maximum API requests per user per method exceeded.
+   - gcpdiag-cloudsql1-aaaa                                               [SKIP]
+     logging api is disabled
+

gcpdiag/lint/bigquery/warn_2024_003_too_many_concurrent_api_requests.py

@@ -0,0 +1,75 @@
+#
+# Copyright 2024 Google LLC
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Lint as: python3
+"""BigQuery job does not fail due to Maximum API requests per user per method exceeded.
+
+BigQuery returns Quota exceeded or Exceeded rate limits error when you hit the
+rate limit for the number of API requests to a BigQuery API per user per method.
+"""
+
+from boltons.iterutils import get_path
+
+from gcpdiag import lint, models
+from gcpdiag.queries import apis, crm, logs
+
+MATCH_STR = 'too many API requests per user per method for this user_method'
+
+TOO_MANY_API_REQUESTS_FILTER = [
+    'severity=ERROR',
+    f'protoPayload.status.message =~ ("{MATCH_STR}")',
+]
+
+logs_by_project = {}
+
+
+def prepare_rule(context: models.Context):
+  logs_by_project[context.project_id] = logs.query(
+      project_id=context.project_id,
+      resource_type='bigquery_resource',
+      log_name='log_id("cloudaudit.googleapis.com/activity")',
+      filter_str=' AND '.join(TOO_MANY_API_REQUESTS_FILTER),
+  )
+
+
+def run_rule(context: models.Context, report: lint.LintReportRuleInterface):
+
+  project = crm.get_project(context.project_id)
+
+  # skip entire rule is logging disabled
+  if not apis.is_enabled(context.project_id, 'logging'):
+    report.add_skipped(project, 'logging api is disabled')
+    return
+
+  if not apis.is_enabled(context.project_id, 'bigquery'):
+    report.add_skipped(project, 'bigquery api is disabled')
+    return
+
+  if (logs_by_project.get(context.project_id) and
+      logs_by_project[context.project_id].entries):
+    for log_entry in logs_by_project[context.project_id].entries:
+      # Filter out non-relevant log entries.
+      if log_entry['severity'] != 'ERROR' or MATCH_STR not in get_path(
+          log_entry, ('protoPayload', 'status', 'message'), default=''):
+        continue
+      method_name = get_path(log_entry, ('protoPayload', 'methodName'))
+      report.add_failed(
+          project,
+          f'BigQuery user_method ({method_name}) exceeded quota for concurrent'
+          ' api requests per user per method',
+      )
+      return
+
+  # in case of there is no log or all logs are non-relevant
+  report.add_ok(project)

website/content/en/rules/bigquery/WARN/2024_003.md

@@ -0,0 +1,27 @@
+---
+title: "bigquery/WARN/2024_003"
+linkTitle: "WARN/2024_003"
+weight: 1
+type: docs
+description: >
+  BigQuery job does not fail due to Maximum API requests per user per method exceeded.
+---
+
+**Product**: [BigQuery](https://cloud.google.com/bigquery)\
+**Rule class**: WARN - Something that is possibly wrong
+
+### Description
+
+BigQuery returns Quota exceeded or Exceeded rate limits error when you hit the
+rate limit for the number of API requests to a BigQuery API per user per method.
+
+### Remediation
+
+The quota for a few calls for example, the ```tables.get``` method calls from a service account, or the ```jobs.insert``` method calls. The default quota considered for these calls is 100 calls per second and is enforced per user and not per project.
+The error thrown when this limit is breached is as follows:
+```Exceeded rate limits: too many api requests per user per method for this user_method```
+When you encounter this error, [diagnose](https://cloud.google.com/bigquery/docs/troubleshoot-quotas#ts-maximum-api-request-limit-diagnose) the issue and then follow the [recommended](https://cloud.google.com/bigquery/docs/troubleshoot-quotas#ts-maximum-api-request-limit-resolution) steps to resolve it.
+
+### Further information
+
+- [API quotas and limits](https://cloud.google.com/bigquery/quotas#api_quotas_and_limits)