getting "googleapi: got HTTP response code 404 with body: Not Found" error #204
Comments
|
Could you please paste the error message showing which API call responded with a 404 and what resource was not found? |
|
Below is series of events from Cloud Logging. This is all what i see in the logs every-time i create a test bucket with public access enabled. |
|
@onetwopunch @deepakdimri-ce Just a detail that may help the investigation. The minimal deployment for the security response automation is the Only the Router function knows how to read SCC findings. The router function is the one that reads the finding and generates a struct with only the project name + the bucket name that is used by the The SCC notification must send messages to the The error may be related to trying to get the bucket policy from an bucket name that is the empty string |
|
thanks @daniel-cit - i have got Router cloud function deployed, with scc notifications going to Router function. but now i see Router function reporting "finding already remediated" message and not doing any thing. i am testing it with having a test GCS bucket wide open for public access. there are no logs showing up in CloseBucket function. any idea? i am still trying to investigate |
|
this is my sra.yaml file looks like replaced with dummy org and folder ids: |
|
Hi @deepakdimri-ce , The You can try to force the execution by going to the Console and deleting the security mark Regarding the yaml file, you should use this file as an initial version https://github.com/GoogleCloudPlatform/security-response-automation/wiki/Sample-configuration. A trick point is that It is an yaml file and preserving the indentation is importante. |
|
thanks @daniel-cit for helping me with this. I have tried deleting the mark against the finding in SCC but then it just comes back again on the console. is there any other pointers you could offer? i am kinda stuck with this.. and i need it working for a demo to my customers. |
|
Hi @deepakdimri-ce until #197 is fixed what you could do as a temporary workaround would be to comment the code that is marking the finding as remediated, something like this: Go to the function that mark the finding as remediated And comment its body from: func markAsRemediated(ctx context.Context, name, eventTime string, services *Services) error {
m := map[string]string{"sra-remediated-event-time": eventTime}
if _, err := services.SecurityCommandCenter.AddSecurityMarks(ctx, name, m); err != nil {
return err
}
return nil
}to: func markAsRemediated(ctx context.Context, name, eventTime string, services *Services) error {
// m := map[string]string{"sra-remediated-event-time": eventTime}
// if _, err := services.SecurityCommandCenter.AddSecurityMarks(ctx, name, m); err != nil {
// return err
// }
return nil
}This would prevent then security mark to return after you delete it in the console |
|
hi @daniel-cit - thanks again. i tried commenting the code as you suggested and now i see its not marking the findings. But it still does not do anything. |
|
Searching form part of the error message in your log func publish(ctx context.Context, services *Services, action, topic, projectID string, target, exclude []string, values interface{}) error {
ok, err := services.Resource.CheckMatches(ctx, projectID, target, exclude)
if err != nil {
return errors.Wrapf(err, "failed to check if project %q is within the target or is excluded", projectID)
}The projectID subistituition in the message is Since the code was able to hit the publish method it means it was able to find the correct automation and the issue looks like to be related to the reading the project from the finding. Looking at real findings in the Security Command Center we can see Now the only place to find the project id is in the
It looks like to be a general change over all the SHA findings. Because of this the SHA findings remediations will not work until the parsing of the findings is fixed. |
|
Yeah i see |
|
thanks @deepakdimri-ce for reporting this and @daniel-cit for identifying the cause. really appreciate it
|
|
@deepakdimri-ce can u give #206 a test? it should work, but i have not actually tested it myself other than just locally |
|
Thanks @tomscript for your help - i will test it later today and will let you know. In the meanwhile i have got this from SHA engineering team when asked for example finding event: Example: |
|
ah oops ok, so my change had resource under finding where this sample has it before it. np. ill adjust, let me fix it before u test |
|
ok the pr has been updated to reflect this sample (thanks for grabbing that!) |
|
hi @tomscript - many thanks for working on this. I was able to test the closebucket function. the remediation is happening within a second - Its like i open the bucket for public access and with in that very second it removes the permissions. |
|
awesome to hear :) i'll update the other sha findings on monday, but you should be good to use the current pr for your demo so that shouldn't block you further. thanks for reporting :) |
|
Yes, I am all set for now - thank you for the great support @tomscript |
i have CloseBucket Cloud Function deployed as per the instructions from the repo and its getting triggered from SCC notification as well but when its comes to action its throwing "googleapi: got HTTP response code 404 with body: Not Found" error. what could be the reason for this error?
The text was updated successfully, but these errors were encountered: