Control: Ensure log metric filter and alerts exist for project ownership assignments/changes

Description

In order to prevent unnecessary project ownership assignments to users/service-accounts and further misuses of projects and resources, all roles/Owner assignments should be monitored. Members (users/Service-Accounts) with a role assignment to primitive role roles/Owner are project owners.

Usage

Run the control in your terminal:

powerpipe control run gcp_compliance.control.logging_metric_alert_project_ownership_assignment

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run gcp_compliance.control.logging_metric_alert_project_ownership_assignment --share

SQL

This control uses a named query:

with filter_data as (
  select
    m.project as project,
    display_name alert_name,
    count(m.name) metric_name
  from
    gcp_monitoring_alert_policy,
    jsonb_array_elements(conditions) as filter_condition
    join gcp_logging_metric m on m.filter ~ '\s*\(protoPayload.serviceName\s*=\s*"cloudresourcemanager.googleapis.com"\s*\)\s*AND\s*\(\s*ProjectOwnership\s*OR\s*projectOwnerInvitee\s*\)\s*OR\s*\(\s*protoPayload.serviceData.policyDelta.bindingDeltas.action\s*=\s*"REMOVE"\s*AND\s*protoPayload.serviceData.policyDelta.bindingDeltas.role\s*=\s*"roles/owner"\s*\)\s*OR\s*\(\s*protoPayload.serviceData.policyDelta.bindingDeltas.action\s*=\s*"ADD"\s*AND\s*protoPayload.serviceData.policyDelta.bindingDeltas.role\s*=\s*"roles/owner"\s*\)\s*'
    and filter_condition -> 'conditionThreshold' ->> 'filter' like '%metric.type="' || m.metric_descriptor_type || '"%'
  where
    enabled
  group by
    m.project, display_name, m.name
)
select
  'https://cloudresourcemanager.googleapis.com/v1/projects/' || project_id resource,
  case
    when d.metric_name > 0  then 'ok'
    else 'alarm'
  end as status,
  case
    when d.metric_name > 0
      then 'Log metric and alert exist for project ownership assignments/changes.'
    else 'Log metric and alert do not exist exist for project ownership assignments/changes.'
  end as reason
  
  , project_id as project
from
  gcp_project as p
  left join filter_data as d on d.project = p.name;

Control: Ensure log metric filter and alerts exist for project ownership assignments/changes

Description

Usage

SQL

Tags