-
Notifications
You must be signed in to change notification settings - Fork 1.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add Resource Organization, folder and project Mute Config #10772
Changes from 63 commits
ab2df03
7b4dda8
abf1168
4526193
778ec3e
4f649a1
ad1a7fc
001fec7
a85efb1
b9a9ff5
78a719a
7607454
90e178b
db9de8e
d6cfd8d
cc229c5
8f8f3ff
6af7992
fb3efad
bdae90e
5bf5760
fd5657d
f17aa1f
4eb984a
9aa1f3f
bbfb1d0
4010782
4a26a96
6a37681
2c3127a
9573d9a
e5542ef
32c7ee9
320b0ca
d90ecaf
dc0f536
d1ad972
790fe46
3eae539
701cca0
842293f
3a56a16
0cd1e3e
66066df
454aa91
11a5846
46428c0
5f7bb8b
31d1346
f9690f3
4bee56e
cdfaf05
1223fdd
6e51a34
2ea48eb
af1d43e
d551817
b580677
17c4f41
831be14
4e4a83e
10fd1ac
24407b6
e210f8c
a87c6e3
0d5b494
ed35c4c
79066bf
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,114 @@ | ||
# Copyright 2024 Google Inc. | ||
# Licensed under the Apache License, Version 2.0 (the "License"); | ||
# you may not use this file except in compliance with the License. | ||
# You may obtain a copy of the License at | ||
# | ||
# http://www.apache.org/licenses/LICENSE-2.0 | ||
# | ||
# Unless required by applicable law or agreed to in writing, software | ||
# distributed under the License is distributed on an "AS IS" BASIS, | ||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
# See the License for the specific language governing permissions and | ||
# limitations under the License. | ||
|
||
--- !ruby/object:Api::Resource | ||
name: 'FolderMuteConfig' | ||
base_url: 'folders/{{folder}}/locations/{{location}}/muteConfigs' | ||
self_link: '{{name}}' | ||
create_url: 'folders/{{folder}}/locations/{{location}}/muteConfigs?muteConfigId={{mute_config_id}}' | ||
update_verb: :PATCH | ||
update_mask: true | ||
description: | | ||
Mute Findings is a volume management feature in Security Command Center | ||
that lets you manually or programmatically hide irrelevant findings, | ||
and create filters to automatically silence existing and future | ||
findings based on criteria you specify. | ||
references: !ruby/object:Api::Resource::ReferenceLinks | ||
api: 'https://cloud.google.com/security-command-center/docs/reference/rest/v2/folders.locations.muteConfigs' | ||
examples: | ||
- !ruby/object:Provider::Terraform::Examples | ||
name: 'scc_v2_folder_mute_config_basic' | ||
primary_resource_id: 'default' | ||
vars: | ||
mute_config_id: 'my-config' | ||
test_env_vars: | ||
org_id: :ORG_ID | ||
# Skipping sweeper since this is a child resource | ||
skip_sweeper: true | ||
import_format: ['{{name}}'] | ||
custom_code: !ruby/object:Provider::Terraform::CustomCode | ||
custom_import: templates/terraform/custom_import/scc_mute_config.go.erb | ||
parameters: | ||
- !ruby/object:Api::Type::String | ||
name: muteConfigId | ||
required: true | ||
immutable: true | ||
url_param_only: true | ||
description: | | ||
Unique identifier provided by the client within the parent scope. | ||
- !ruby/object:Api::Type::String | ||
name: location | ||
required: false | ||
immutable: true | ||
url_param_only: true | ||
default_value: global | ||
description: | | ||
location Id is provided by organization. If not provided, Use global as default. | ||
- !ruby/object:Api::Type::String | ||
name: folder | ||
required: true | ||
immutable: true | ||
url_param_only: true | ||
description: | | ||
Resource name of the new organization mute configs's parent. Its format is | ||
"[folder_id]" | ||
properties: | ||
- !ruby/object:Api::Type::String | ||
name: 'name' | ||
output: true | ||
description: | | ||
Name of the mute config. Its format is | ||
organizations/{organization}/muteConfigs/{configId}, | ||
folders/{folder}/muteConfigs/{configId}, | ||
or projects/{project}/muteConfigs/{configId} | ||
- !ruby/object:Api::Type::String | ||
name: 'description' | ||
description: A description of the mute config. | ||
- !ruby/object:Api::Type::String | ||
name: 'filter' | ||
description: | | ||
An expression that defines the filter to apply across create/update | ||
events of findings. While creating a filter string, be mindful of | ||
the scope in which the mute configuration is being created. E.g., | ||
If a filter contains project = X but is created under the | ||
project = Y scope, it might not match any findings. | ||
required: true | ||
- !ruby/object:Api::Type::String | ||
name: 'createTime' | ||
description: | | ||
The time at which the mute config was created. This field is set by | ||
the server and will be ignored if provided on config creation. | ||
output: true | ||
- !ruby/object:Api::Type::String | ||
name: 'updateTime' | ||
description: | | ||
Output only. The most recent time at which the mute config was | ||
updated. This field is set by the server and will be ignored if | ||
provided on config creation or update. | ||
output: true | ||
- !ruby/object:Api::Type::String | ||
name: 'mostRecentEditor' | ||
description: | | ||
Email address of the user who last edited the mute config. This | ||
field is set by the server and will be ignored if provided on | ||
config creation or update. | ||
output: true | ||
- !ruby/object:Api::Type::Enum | ||
name: 'type' | ||
required: true | ||
description: | | ||
Required. The type of the mute config, | ||
which determines what type of mute state the config affects. Immutable after creation. | ||
values: | ||
- :MUTE_CONFIG_TYPE_UNSPECIFIED | ||
- :STATIC |
Original file line number | Diff line number | Diff line change | ||||
---|---|---|---|---|---|---|
@@ -0,0 +1,112 @@ | ||||||
# Copyright 2024 Google Inc. | ||||||
# Licensed under the Apache License, Version 2.0 (the "License"); | ||||||
# you may not use this file except in compliance with the License. | ||||||
# You may obtain a copy of the License at | ||||||
# | ||||||
# http://www.apache.org/licenses/LICENSE-2.0 | ||||||
# | ||||||
# Unless required by applicable law or agreed to in writing, software | ||||||
# distributed under the License is distributed on an "AS IS" BASIS, | ||||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||||||
# See the License for the specific language governing permissions and | ||||||
# limitations under the License. | ||||||
|
||||||
--- !ruby/object:Api::Resource | ||||||
name: 'OrganizationMuteConfig' | ||||||
base_url: '{{organization}}/locations/{{location}}/muteConfigs' | ||||||
self_link: '{{name}}' | ||||||
create_url: '{{organization}}/locations/{{location}}/muteConfigs?muteConfigId={{name}}' | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. addressed There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This was never addressed. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Re addresed |
||||||
update_verb: :PATCH | ||||||
update_mask: true | ||||||
description: | | ||||||
Mute Findings is a volume management feature in Security Command Center | ||||||
that lets you manually or programmatically hide irrelevant findings, | ||||||
and create filters to automatically silence existing and future | ||||||
findings based on criteria you specify. | ||||||
references: !ruby/object:Api::Resource::ReferenceLinks | ||||||
api: 'https://cloud.google.com/security-command-center/docs/reference/rest/v2/organizations.locations.muteConfigs' | ||||||
examples: | ||||||
- !ruby/object:Provider::Terraform::Examples | ||||||
name: 'scc_v2_organization_mute_config_basic' | ||||||
primary_resource_id: 'default' | ||||||
vars: | ||||||
mute_config_id: 'my-config' | ||||||
test_env_vars: | ||||||
org_id: :ORG_ID | ||||||
# Skipping sweeper since this is a child resource | ||||||
skip_sweeper: true | ||||||
import_format: ['{{name}}'] | ||||||
custom_code: !ruby/object:Provider::Terraform::CustomCode | ||||||
custom_import: templates/terraform/custom_import/scc_mute_config.go.erb | ||||||
parameters: | ||||||
- !ruby/object:Api::Type::String | ||||||
name: muteConfigId | ||||||
required: true | ||||||
immutable: true | ||||||
url_param_only: true | ||||||
description: | | ||||||
Unique identifier provided by the client within the parent scope. | ||||||
- !ruby/object:Api::Type::String | ||||||
name: organization | ||||||
required: true | ||||||
immutable: true | ||||||
url_param_only: true | ||||||
description: | | ||||||
Resource name of the new organization mute configs's parent. Its format is | ||||||
"organizations/[organization_id]" | ||||||
- !ruby/object:Api::Type::String | ||||||
name: location | ||||||
required: false | ||||||
immutable: true | ||||||
url_param_only: true | ||||||
default_value: global | ||||||
description: | | ||||||
location Id is provided by organization. If not provided, Use global as default. | ||||||
properties: | ||||||
- !ruby/object:Api::Type::String | ||||||
name: 'name' | ||||||
output: true | ||||||
description: | | ||||||
Name of the Organization mute config. Its format is | ||||||
organizations/{organization}/muteConfigs/{muteConfigId}, | ||||||
- !ruby/object:Api::Type::String | ||||||
name: 'description' | ||||||
description: A description of the Organization mute config. | ||||||
- !ruby/object:Api::Type::String | ||||||
name: 'filter' | ||||||
description: | | ||||||
An expression that defines the filter to apply across create/update | ||||||
events of findings. While creating a filter string, be mindful of | ||||||
the scope in which the mute configuration is being created. E.g., | ||||||
If a filter contains project = X but is created under the | ||||||
project = Y scope, it might not match any findings. | ||||||
required: true | ||||||
- !ruby/object:Api::Type::String | ||||||
name: 'createTime' | ||||||
description: | | ||||||
The time at which the mute config was created. This field is set by | ||||||
the server and will be ignored if provided on config creation. | ||||||
output: true | ||||||
- !ruby/object:Api::Type::String | ||||||
name: 'updateTime' | ||||||
description: | | ||||||
Output only. The most recent time at which the mute config was | ||||||
updated. This field is set by the server and will be ignored if | ||||||
provided on config creation or update. | ||||||
output: true | ||||||
- !ruby/object:Api::Type::String | ||||||
name: 'mostRecentEditor' | ||||||
description: | | ||||||
Email address of the user who last edited the mute config. This | ||||||
field is set by the server and will be ignored if provided on | ||||||
config creation or update. | ||||||
output: true | ||||||
- !ruby/object:Api::Type::Enum | ||||||
name: 'type' | ||||||
required: true | ||||||
description: | | ||||||
Required. The type of the mute config, | ||||||
which determines what type of mute state the config affects. Immutable after creation. | ||||||
values: | ||||||
- :MUTE_CONFIG_TYPE_UNSPECIFIED | ||||||
- :STATIC |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,115 @@ | ||
# Copyright 2024 Google Inc. | ||
# Licensed under the Apache License, Version 2.0 (the "License"); | ||
# you may not use this file except in compliance with the License. | ||
# You may obtain a copy of the License at | ||
# | ||
# http://www.apache.org/licenses/LICENSE-2.0 | ||
# | ||
# Unless required by applicable law or agreed to in writing, software | ||
# distributed under the License is distributed on an "AS IS" BASIS, | ||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
# See the License for the specific language governing permissions and | ||
# limitations under the License. | ||
|
||
--- !ruby/object:Api::Resource | ||
name: 'projectMuteConfig' | ||
base_url: '{{project}}/locations/{{location}}/muteConfigs' | ||
self_link: '{{name}}' | ||
create_url: '{{project}}/locations/{{location}}/muteConfigs?muteConfigId={{mute_config_id}}' | ||
update_verb: :PATCH | ||
update_mask: true | ||
description: | | ||
Mute Findings is a volume management feature in Security Command Center | ||
that lets you manually or programmatically hide irrelevant findings, | ||
and create filters to automatically silence existing and future | ||
findings based on criteria you specify. | ||
references: !ruby/object:Api::Resource::ReferenceLinks | ||
api: 'https://cloud.google.com/security-command-center/docs/reference/rest/v2/projects.locations.muteConfigs' | ||
examples: | ||
- !ruby/object:Provider::Terraform::Examples | ||
name: 'scc_v2_project_mute_config_basic' | ||
primary_resource_id: 'default' | ||
vars: | ||
mute_config_id: 'my-config' | ||
test_env_vars: | ||
org_id: :ORG_ID | ||
# Skipping sweeper since this is a child resource | ||
skip_sweeper: true | ||
import_format: ['{{name}}'] | ||
custom_code: !ruby/object:Provider::Terraform::CustomCode | ||
custom_import: templates/terraform/custom_import/scc_mute_config.go.erb | ||
parameters: | ||
- !ruby/object:Api::Type::String | ||
name: muteConfigId | ||
required: true | ||
immutable: true | ||
url_param_only: true | ||
description: | | ||
Unique identifier provided by the client within the parent scope. | ||
- !ruby/object:Api::Type::String | ||
name: location | ||
required: false | ||
immutable: true | ||
url_param_only: true | ||
default_value: global | ||
description: | | ||
location Id is provided by organization. If not provided, Use global as default. | ||
- !ruby/object:Api::Type::String | ||
name: project_parent | ||
required: true | ||
immutable: true | ||
url_param_only: true | ||
description: | | ||
Resource name of the new mute configs's parent. Its format is | ||
"organizations/[organization_id]", "folders/[folder_id]", or | ||
"projects/[project_id]". | ||
properties: | ||
- !ruby/object:Api::Type::String | ||
name: 'name' | ||
output: true | ||
description: | | ||
Name of the mute config. Its format is | ||
organizations/{organization}/muteConfigs/{configId}, | ||
folders/{folder}/muteConfigs/{configId}, | ||
or projects/{project}/muteConfigs/{configId} | ||
- !ruby/object:Api::Type::String | ||
name: 'description' | ||
description: A description of the mute config. | ||
- !ruby/object:Api::Type::String | ||
name: 'filter' | ||
description: | | ||
An expression that defines the filter to apply across create/update | ||
events of findings. While creating a filter string, be mindful of | ||
the scope in which the mute configuration is being created. E.g., | ||
If a filter contains project = X but is created under the | ||
project = Y scope, it might not match any findings. | ||
required: true | ||
- !ruby/object:Api::Type::String | ||
name: 'createTime' | ||
description: | | ||
The time at which the mute config was created. This field is set by | ||
the server and will be ignored if provided on config creation. | ||
output: true | ||
- !ruby/object:Api::Type::String | ||
name: 'updateTime' | ||
description: | | ||
Output only. The most recent time at which the mute config was | ||
updated. This field is set by the server and will be ignored if | ||
provided on config creation or update. | ||
output: true | ||
- !ruby/object:Api::Type::String | ||
name: 'mostRecentEditor' | ||
description: | | ||
Email address of the user who last edited the mute config. This | ||
field is set by the server and will be ignored if provided on | ||
config creation or update. | ||
output: true | ||
- !ruby/object:Api::Type::Enum | ||
name: 'type' | ||
required: true | ||
description: | | ||
Required. The type of the mute config, | ||
which determines what type of mute state the config affects. Immutable after creation. | ||
values: | ||
- :MUTE_CONFIG_TYPE_UNSPECIFIED | ||
- :STATIC |
thokalavinod marked this conversation as resolved.
Show resolved
Hide resolved
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,19 @@ | ||
resource "google_folder" "folder" { | ||
display_name = "A test folder mute config" | ||
parent = "organizations/${var.org_id}" | ||
thokalavinod marked this conversation as resolved.
Show resolved
Hide resolved
|
||
} | ||
|
||
resource "google_folder_iam_member" "scc_folder_mute_config" { | ||
folder = google_folder.folder.id | ||
role = "roles/securitycenter.admin" | ||
member = "serviceAccount:<%= ctx[:vars]['service_account_email'] %>" | ||
} | ||
|
||
thokalavinod marked this conversation as resolved.
Show resolved
Hide resolved
|
||
resource "google_scc_v2_folder_mute_config" "<%= ctx[:primary_resource_id] %>" { | ||
trodge marked this conversation as resolved.
Show resolved
Hide resolved
|
||
mute_config_id = "<%= ctx[:vars]['mute_config_id'] %>" | ||
folder = google_folder.folder.folder_id | ||
description = "My custom Cloud Security Command Center Mute Configuration" | ||
filter = "severity = \"HIGH\"" | ||
type = "STATIC" | ||
thokalavinod marked this conversation as resolved.
Show resolved
Hide resolved
|
||
depends_on = [google_folder_iam_member.scc_folder_mute_config] | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,6 @@ | ||
resource "google_scc_v2_organization_mute_config" "<%= ctx[:primary_resource_id] %>" { | ||
mute_config_id = "<%= ctx[:vars]['mute_config_id'] %>" | ||
organization = "organizations/<%= ctx[:test_env_vars]['org_id'] %>" | ||
description = "My custom Cloud Security Command Center Organization Mute Configuration" | ||
filter = "severity = \"HIGH\"" | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,20 @@ | ||
resource "google_project" "project" { | ||
name = "My Test Project" | ||
thokalavinod marked this conversation as resolved.
Show resolved
Hide resolved
|
||
project_id = "<%= ctx[:vars]['project_id'] %>" | ||
parent = "<%= ctx[:vars]['org_id'] %>" | ||
} | ||
|
||
resource "google_project_iam_member" "scc_project_mute_config" { | ||
project = google_project.project.project_id | ||
role = "roles/securitycenter.admin" | ||
member = "serviceAccount:<%= ctx[:vars]['service_account_email'] %>" | ||
} | ||
|
||
thokalavinod marked this conversation as resolved.
Show resolved
Hide resolved
|
||
resource "google_scc_v2_project_mute_config" "<%= ctx[:primary_resource_id] %>" { | ||
mute_config_id = "<%= ctx[:vars]['mute_config_id'] %>" | ||
project = google_project.project.project_id | ||
description = "My custom Cloud Security Command Center Project Mute Configuration" | ||
filter = "severity = \"HIGH\"" | ||
type = "STATIC" | ||
thokalavinod marked this conversation as resolved.
Show resolved
Hide resolved
|
||
depends_on = [google_project_iam_member.scc_project_mute_config] | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It would probably be simpler to add the
folders/
part to the url and remove it from this field. That way the field doesn't need to preserve a forward slash in its value.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
addressed