-
Notifications
You must be signed in to change notification settings - Fork 14
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(GcpGkeAudit): Add support for GcpGkeAudit apiv2 cloud account in…
…tegration (#327) * feat(GcpGkeAudit): Add support for GcpGkeAudit apiv2 cloud account integration Signed-off-by: Ross <[email protected]> * chore(test): re-enable TestIntegrationAwsEksAuditLog Signed-off-by: Ross <[email protected]> * feat(GcpGkeAudit): Resolve errors in gke_audit_log integration resource Signed-off-by: Ross <[email protected]> * feat(GcpGkeAudit): Make organization_id optional Signed-off-by: Ross <[email protected]> * feat(GcpGkeAudit): Mark private_key output as sensitive Signed-off-by: Ross <[email protected]> * feat(GcpGkeAudit): Update GcpGkeAudit integration tests to use google creds Signed-off-by: Ross <[email protected]> * feat(GcpGkeAudit): Update GcpGkeAudit integration test to use real pubsub subscription Signed-off-by: Ross <[email protected]> * feat(GcpGkeAudit): Update DiffSuppressFunc to check for correct fields Signed-off-by: Ross <[email protected]> * chore(GcpGkeAudit): Update go.mod & go.sum with latest go-sdk Signed-off-by: Ross <[email protected]> * feat(GcpGkeAudit): Set cred fields in Read func. Also remove PrivateKey & PrivateKeyId from tests Signed-off-by: Ross <[email protected]> * chore(docs): Add gcp_gke_audit_log resource docs Signed-off-by: Ross <[email protected]> * feat(GcpGkeAuditLog): Add create and update validation on organization_id when integration_type is ORGANIZATION Signed-off-by: Ross <[email protected]>
- Loading branch information
Showing
23 changed files
with
923 additions
and
16 deletions.
There are no files selected for viewing
85 changes: 85 additions & 0 deletions
85
examples/resource_lacework_integration_gcp_gke_audit_log/main.tf
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,85 @@ | ||
| terraform { | ||
| required_providers { | ||
| lacework = { | ||
| source = "lacework/lacework" | ||
| } | ||
| } | ||
| } | ||
|
|
||
| variable "name" { | ||
| type = string | ||
| default = "GCP GKE audit log integration example" | ||
| } | ||
|
|
||
| variable "client_id" { | ||
| type = string | ||
| default = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" | ||
| } | ||
|
|
||
| variable "client_email" { | ||
| type = string | ||
| default = "[email protected]" | ||
| } | ||
|
|
||
| variable "private_key_id" { | ||
| type = string | ||
| default = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" | ||
| } | ||
|
|
||
| variable "private_key" { | ||
| type = string | ||
| default = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" | ||
| } | ||
|
|
||
| variable "integration_type" { | ||
| type = string | ||
| default = "PROJECT" | ||
| } | ||
|
|
||
| variable "project_id" { | ||
| type = string | ||
| default = "example-project-id" | ||
| } | ||
|
|
||
| variable "subscription" { | ||
| type = string | ||
| default = "projects/example-project-id/subscriptions/example-subscription" | ||
| } | ||
|
|
||
| resource "lacework_integration_gcp_gke_audit_log" "example" { | ||
| name = var.name | ||
| credentials { | ||
| client_id = var.client_id | ||
| client_email = var.client_email | ||
| private_key_id = var.private_key_id | ||
| private_key = var.private_key | ||
| } | ||
| integration_type = var.integration_type | ||
| project_id = var.project_id | ||
| subscription = var.subscription | ||
| retries = 10 | ||
| } | ||
|
|
||
| output "name" { | ||
| value = lacework_integration_gcp_gke_audit_log.example.name | ||
| } | ||
|
|
||
| output "client_id" { | ||
| value = lacework_integration_gcp_gke_audit_log.example.credentials[0].client_id | ||
| } | ||
|
|
||
| output "client_email" { | ||
| value = lacework_integration_gcp_gke_audit_log.example.credentials[0].client_email | ||
| } | ||
|
|
||
| output "integration_type" { | ||
| value = lacework_integration_gcp_gke_audit_log.example.integration_type | ||
| } | ||
|
|
||
| output "project_id" { | ||
| value = lacework_integration_gcp_gke_audit_log.example.project_id | ||
| } | ||
|
|
||
| output "subscription" { | ||
| value = lacework_integration_gcp_gke_audit_log.example.subscription | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
97 changes: 97 additions & 0 deletions
97
integration/resource_lacework_integration_gcp_gke_audit_log_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,97 @@ | ||
| package integration | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| "github.com/gruntwork-io/terratest/modules/terraform" | ||
| "github.com/stretchr/testify/assert" | ||
| ) | ||
|
|
||
| // TestIntegrationGcpGkeAuditLog applies integration terraform: | ||
| // => '../examples/resource_lacework_integration_gcp_gke_audit_log' | ||
| // | ||
| // It uses the go-sdk to verify the created integration, | ||
| // applies an update with new integration name and destroys it | ||
| func TestIntegrationGcpGkeAuditLog(t *testing.T) { | ||
| gcreds, err := googleLoadDefaultCredentials() | ||
| if assert.Nil(t, err, "this test requires you to set GOOGLE_CREDENTIALS environment variable") { | ||
| terraformOptions := terraform.WithDefaultRetryableErrors(t, &terraform.Options{ | ||
| TerraformDir: "../examples/resource_lacework_integration_gcp_gke_audit_log", | ||
| Vars: map[string]interface{}{ | ||
| "name": "GCP GKE audit log integration example", | ||
| "client_id": gcreds.ClientID, | ||
| "client_email": gcreds.ClientEmail, | ||
| "private_key_id": gcreds.PrivateKeyID, | ||
| "private_key": gcreds.PrivateKey, | ||
| "integration_type": "PROJECT", | ||
| "project_id": gcreds.ProjectID, | ||
| "subscription": "projects/techally-hipstershop-275821/subscriptions/gcp-gke-audit-log-subscription", | ||
| }, | ||
| }) | ||
| defer terraform.Destroy(t, terraformOptions) | ||
|
|
||
| // Create new GcpGkeAudit Integration | ||
| create := terraform.InitAndApplyAndIdempotent(t, terraformOptions) | ||
| actualClientId := terraform.Output(t, terraformOptions, "client_id") | ||
| actualClientEmail := terraform.Output(t, terraformOptions, "client_email") | ||
| actualIntegrationType := terraform.Output(t, terraformOptions, "integration_type") | ||
| actualProjectId := terraform.Output(t, terraformOptions, "project_id") | ||
| actualSubscription := terraform.Output(t, terraformOptions, "subscription") | ||
| assert.Equal( | ||
| t, | ||
| "GCP GKE audit log integration example", | ||
| GetCloudAccountIntegrationName(create), | ||
| ) | ||
| assert.Equal(t, gcreds.ClientID, actualClientId) | ||
| assert.Equal(t, gcreds.ClientEmail, actualClientEmail) | ||
| assert.Equal(t, "PROJECT", actualIntegrationType) | ||
| assert.Equal(t, gcreds.ProjectID, actualProjectId) | ||
| assert.Equal(t, "projects/techally-hipstershop-275821/subscriptions/gcp-gke-audit-log-subscription", actualSubscription) | ||
|
|
||
| // Update GcpGkeAudit Integration | ||
| terraformOptions.Vars = map[string]interface{}{ | ||
| "name": "GcpGkeAudit log integration updated", | ||
| "client_id": gcreds.ClientID, | ||
| "client_email": gcreds.ClientEmail, | ||
| "private_key_id": gcreds.PrivateKeyID, | ||
| "private_key": gcreds.PrivateKey, | ||
| "integration_type": "PROJECT", | ||
| "project_id": gcreds.ProjectID, | ||
| "subscription": "projects/techally-hipstershop-275821/subscriptions/gcp-gke-audit-log-subscription", | ||
| } | ||
|
|
||
| update := terraform.ApplyAndIdempotent(t, terraformOptions) | ||
| actualClientId = terraform.Output(t, terraformOptions, "client_id") | ||
| actualClientEmail = terraform.Output(t, terraformOptions, "client_email") | ||
| actualIntegrationType = terraform.Output(t, terraformOptions, "integration_type") | ||
| actualProjectId = terraform.Output(t, terraformOptions, "project_id") | ||
| actualSubscription = terraform.Output(t, terraformOptions, "subscription") | ||
| assert.Equal( | ||
| t, | ||
| "GcpGkeAudit log integration updated", | ||
| GetCloudAccountIntegrationName(update), | ||
| ) | ||
| assert.Equal(t, gcreds.ClientID, actualClientId) | ||
| assert.Equal(t, gcreds.ClientEmail, actualClientEmail) | ||
| assert.Equal(t, "PROJECT", actualIntegrationType) | ||
| assert.Equal(t, gcreds.ProjectID, actualProjectId) | ||
| assert.Equal(t, "projects/techally-hipstershop-275821/subscriptions/gcp-gke-audit-log-subscription", actualSubscription) | ||
|
|
||
| // Update GcpGkeAudit with invalid configuration | ||
| terraformOptions.Vars = map[string]interface{}{ | ||
| "name": "GcpGkeAudit log integration updated", | ||
| "client_id": gcreds.ClientID, | ||
| "client_email": gcreds.ClientEmail, | ||
| "private_key_id": gcreds.PrivateKeyID, | ||
| "private_key": gcreds.PrivateKey, | ||
| "integration_type": "ORGANIZATION", | ||
| "project_id": gcreds.ProjectID, | ||
| "subscription": "projects/techally-hipstershop-275821/subscriptions/gcp-gke-audit-log-subscription", | ||
| } | ||
|
|
||
| _, err = terraform.ApplyAndIdempotentE(t, terraformOptions) | ||
| assert.Contains(t, err.Error(), | ||
| "error updating cloud account integration: organization_id MUST be"+ | ||
| " set when integration_type is ORGANIZATION") | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.