google_compute_firewall does not allow you to determine the On/Off status of the logs

[lhasadreams]

Detailed Description

google_compute_firewall missing the status of logs

Context

I would like to be able to check that a firewall rule has logs turned on (or not off)

Possible Implementation

The google API returns this log data, adjust google_compute_firewall do that it exposes it as well.

[slevenick]

Which field are you looking for? logConfig.enable on the firewall rule?

Should be easy enough to add a custom method to check that

[lhasadreams]

Yes please.
This is what the GCP API returns when a firewall rule is interrogated:

{
"id": "3490606707767354763",
"creationTimestamp": "2019-11-01T04:47:48.724-07:00",
"name": "firewalllogdisabled",
"description": "",
"network": "https://www.googleapis.com/compute/v1/projects/compliance1-infraprov-9cc2/global/networks/default",
"priority": 1000,
"sourceRanges": [
"10.0.0.1"
],
"targetTags": [
"firewalllogdisabled"
],
"allowed": [
{
"IPProtocol": "all"
}
],
"direction": "INGRESS",
"logConfig": {
"enable": false
},
"disabled": false,
"selfLink": "https://www.googleapis.com/compute/v1/projects/compliance1-infraprov-9cc2/global/firewalls/firewalllogdisabled",
"kind": "compute#firewall"
}

Thanks Sam

[skpaterson]

Turns out the logConfig value is only returned by a later version of the google-api-client. Bumping the version allows e.g.

    its('log_config.enable') {should be true}

Opened inspec/train#531 to track this.

[slevenick]

This is now available in 1.0 google_compute_firewall via log_config.enable_logging