fix(AWLS2-398): Add get project permission to org snapshot role #91
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
kirklandnuts
requested review from
marktabry,
zekisherif and
michaelhsiehlw
and removed request for
a team
zekisherif
approved these changes
Nov 13, 2024
zekisherif
requested review from
PengyuanZhao and
leijin-lw
and removed request for
michaelhsiehlw
kirklandnuts
force-pushed
the
fix/AWLS2-398/org-snapshot-role
branch
from
7a450c7 to
32f87bb
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Add permission required by org-level agentless scanning integration to call the GCP Get Project API.
#52 modified the Lacework Agentless Workload Scanning Role for monitored project (Create Snapshots), adding a required permission used to call Get Project GCP API. This resolved an issue in the case of project-level agentless scanning integrations, but the issue is still present in the case of org-level agentless scanning integrations.
The same permission should've also been added to the role used by org-level integrations in that PR, but it wasn't — this PR adds the required permission in that role to resolve the issue in the case of org-level integrations as well.
How did you test this change?
Prior to this change, we were seeing the get project call fail with a permission error — these logs show that this issue occurs for several customers.
I ran
terraform applywith my changes to add the permission for my org-level integration deployed against tn-dev.qan.corp.lacework.net, and once the change took effect, logs showed that the calls to get project were succeeding rather than failing (ref).Issue
AWLS2-398