turbot/tailpipe-mod-gcp-audit-log-detections

Query: compute_disk_iam_policy_set

Usage

powerpipe query gcp_audit_log_detections.query.compute_disk_iam_policy_set

SQL

select
tp_timestamp as timestamp,
method_name as operation,
resource_name as resource,
authentication_info.principal_email as actor,
tp_source_ip as source_ip,
tp_index as project,
tp_id as source_id,
-- Create new aliases to preserve original row data
operation as operation_src,
resource as resource_src,
* exclude operation,
resource
from
gcp_audit_log
where
method_name ilike '%.compute.disks.setiampolicy'
and severity != 'Error' -- TODO: Do we need to check operation?
-- and (operation_src is null or operation_src.last = true)
order by
timestamp desc;

Detections

The query is being used by the following detections: