aquasecurity / aquasecurity/cloudsploit

GCP - Log metric for VPC network route changes not found

Open
#523 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
3.8k
Forks
751
Avg merge
11d 9h
Merged PRs (30d)
3

Description

Cloudsplit version v2.0.0

We have the following metric created:

```
{
"createTime": "2021-01-31T16:28:15.779423987Z",
"description": "Ensures that logging and log alerts exist for VPC network route changes",
"filter": "resource.type=\"gce_route\" AND jsonPayload.event_subtype=\"compute.routes.delete\" OR jsonPayload.event_subtype=\"compute.routes.insert\"",
"metricDescriptor": {
"description": "Ensures that logging and log alerts exist for VPC network route changes",
"metricKind": "DELTA",
"name": "projects/OUR_GCP_PROJECT_NAME/metricDescriptors/logging.googleapis.com/user/VPC_Network_Route_Logging",
"type": "logging.googleapis.com/user/VPC_Network_Route_Logging",
"unit": "1",
"valueType": "INT64"
},
"name": "VPC_Network_Route_Logging",
"updateTime": "2021-01-31T17:20:55.629349665Z"
}
```

The filter matches what is shown here: https://github.com/aquasecurity/cloudsploit/blob/master/plugins/google/logging/vpcNetworkRouteLogging.spec.js#L81

However, running a scan shows a FAIL:

Logging | VPC Network Route Logging | Ensures that logging and log alerts exist for VPC network route changes | Log metric for VPC network route changes not found | OUR_GCP_PROJECT_NAME | global | N/A | FAIL
-- | -- | -- | -- | -- | -- | -- | --

Are we doing something wrong or is there an issue with the metric detection here: https://github.com/aquasecurity/cloudsploit/blob/master/plugins/google/logging/vpcNetworkRouteLogging.js#L57-L86

Contributor guide

Open the contributing guide

Research direction

Start with plugins/google/logging/vpcNetworkRouteLogging.js lines 57-86 and compare its metric detection with the filter and descriptor in the issue. Check the referenced vpcNetworkRouteLogging.spec.js lines 81 onward and reproduce the scan against the supplied metric. Done means the existing VPC route metric is detected correctly or the issue documents the required metric shape.

Written by the indexing model from the issue text.

Assessment

Tech stack
gcp, javascript
Domain
cloud, observability, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.