aquasecurity / aquasecurity/cloudsploit
GCP - Log metric for VPC network route changes not found
- Dominant language
- JavaScript
- Stars
- 3.8k
- Forks
- 751
- Avg merge
- 11d 9h
- Merged PRs (30d)
- 3
Description
Cloudsplit version v2.0.0
We have the following metric created:
```
{
"createTime": "2021-01-31T16:28:15.779423987Z",
"description": "Ensures that logging and log alerts exist for VPC network route changes",
"filter": "resource.type=\"gce_route\" AND jsonPayload.event_subtype=\"compute.routes.delete\" OR jsonPayload.event_subtype=\"compute.routes.insert\"",
"metricDescriptor": {
"description": "Ensures that logging and log alerts exist for VPC network route changes",
"metricKind": "DELTA",
"name": "projects/OUR_GCP_PROJECT_NAME/metricDescriptors/logging.googleapis.com/user/VPC_Network_Route_Logging",
"type": "logging.googleapis.com/user/VPC_Network_Route_Logging",
"unit": "1",
"valueType": "INT64"
},
"name": "VPC_Network_Route_Logging",
"updateTime": "2021-01-31T17:20:55.629349665Z"
}
```
The filter matches what is shown here: https://github.com/aquasecurity/cloudsploit/blob/master/plugins/google/logging/vpcNetworkRouteLogging.spec.js#L81
However, running a scan shows a FAIL:
Logging | VPC Network Route Logging | Ensures that logging and log alerts exist for VPC network route changes | Log metric for VPC network route changes not found | OUR_GCP_PROJECT_NAME | global | N/A | FAIL
-- | -- | -- | -- | -- | -- | -- | --
Are we doing something wrong or is there an issue with the metric detection here: https://github.com/aquasecurity/cloudsploit/blob/master/plugins/google/logging/vpcNetworkRouteLogging.js#L57-L86
Contributor guide
Research direction
Start with plugins/google/logging/vpcNetworkRouteLogging.js lines 57-86 and compare its metric detection with the filter and descriptor in the issue. Check the referenced vpcNetworkRouteLogging.spec.js lines 81 onward and reproduce the scan against the supplied metric. Done means the existing VPC route metric is detected correctly or the issue documents the required metric shape.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- gcp, javascript
- Domain
- cloud, observability, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100