Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Add log export GCS bucket object versioning #317

Merged
merged 2 commits into from
Jan 22, 2021
Merged

feat: Add log export GCS bucket object versioning #317

merged 2 commits into from
Jan 22, 2021

Conversation

vovinacci
Copy link
Contributor

As per original issue, the storage bucket created by the storage_destination module does not have object versioning enabled, which is generating a finding in SHA against the CIS Benchmark for GCP. This PR:

  • Updates underlying log-export module version to 5.1.0 as GCS object versioning is supported starting this version.
  • Adds a note on GCS object versioning in general README.

Closes #274

@vovinacci
Copy link
Contributor Author

@rjerrems @bharathkkb Integration tests failed, checked the test spec - didn't find anything that may have been broken by this PR. As I don't have access to cloud build for this project, could you please take a look on what it failed? Much appreciated.

@rjerrems
Copy link
Collaborator

rjerrems commented Jan 19, 2021

Thanks for this @vovinacci ! I think we may need to merge this PR first, as a number of changes have been made to how tests are run to accommodate it #298 (which are likely breaking your build)

@vovinacci
Copy link
Contributor Author

vovinacci commented Jan 19, 2021

@rjerrems Thanks much for the heads-up. I've tested this change against master in our repository and it was just fine. Should be reasonably safe to merge. Thanks!

P.S. Alternatively, I can target it to master and then backport to develop after #298 is merged.

Edit: Please disregard this comment, I've completely misread written above.

Copy link
Member

@bharathkkb bharathkkb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR @vovinacci
LGTM, we can rebase this on dev once #298 merged, which should fix the tests.

README.md Outdated Show resolved Hide resolved
vovinacci and others added 2 commits January 20, 2021 12:39
Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com>
@vovinacci
Copy link
Contributor Author

@bharathkkb Rebased, tests still failing. Could you please take a look? Many thanks in advance.

@rjerrems
Copy link
Collaborator

It looks like both are failing on shared with

       Error: Invalid value for input variable
       
       The environment variable TF_VAR_policy_id does not contain a valid value for
       variable "policy_id": a number is required.

@vovinacci
Copy link
Contributor Author

vovinacci commented Jan 21, 2021

export TF_VAR_policy_id=$(gcloud access-context-manager policies list --organization="${TF_VAR_org_id:?}" --format="value(name)") is used quite a lot in terraform modules (build/int.cloudbuild.yaml). Tried this command locally, very rare after the expected number output it asks if user want to provide a feedback. May this be an issue? I didn't have a chance to look at the source to determine the frequency/randomness of this event, but will do it later on this week.

@bharathkkb
Copy link
Member

/gcbrun

@bharathkkb
Copy link
Member

@vovinacci one of the other CFT module tests removes the access-context-manager policy during teardown and that caused an issue. I have restarted the tests.

@vovinacci
Copy link
Contributor Author

@bharathkkb Looks good now!

P.S. Are there any plans to make cloudbuild test output available for everyone to view? I do miss it really. :)

@bharathkkb
Copy link
Member

@vovinacci we recently added the ability for contributors to get feedback from the cloudbuild lint tests (should now be enabled for this repo), but not for the integration tests. I'll add this to our backlog.

@bharathkkb bharathkkb merged commit 753f695 into terraform-google-modules:develop Jan 22, 2021
@vovinacci vovinacci deleted the feature/add-log-export-gcp-object-versioning branch January 22, 2021 18:32
bharathkkb added a commit that referenced this pull request Mar 30, 2021
* Add log export GCS bucket object versioning

* Improve wording

Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com>

Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com>
bharathkkb added a commit that referenced this pull request Mar 30, 2021
* Add log export GCS bucket object versioning

* Improve wording

Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com>

Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com>
bharathkkb added a commit that referenced this pull request Mar 30, 2021
* Add log export GCS bucket object versioning

* Improve wording

Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com>

Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com>
bharathkkb added a commit that referenced this pull request Mar 31, 2021
* Add log export GCS bucket object versioning

* Improve wording

Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com>

Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants