feat(query): implements "Beta - Logs And Alerts Missing Project Ownership Assignment And Changes"

[cx-andre-pereira]

Reason for Proposed Changes

• Currently there are no queries addressing the Terraform/gcp "google_logging_metric" and "google_monitoring_alert_policy" resources's "filter" fields. This query is meant to ensure those resources's filters properly check for roles/Owner assignments.

• Quoting CIS_Google_Cloud_Platform_Foundation_Benchmark_v4.0.0 page 81: "Project ownership has the highest level of privileges on a project. To avoid misuse of project resources, the project ownership assignment/change actions mentioned above should be monitored and alerted to concerned recipients. • Sending project ownership invites • Acceptance/Rejection of project ownership invite by user • Adding role\Owner to a user/service-account • Removing a user/Service account from role\Owner"

• Additionally page 82 states the specific filter that should be present :

(protoPayload.serviceName="cloudresourcemanager.googleapis.com")
AND (ProjectOwnership OR projectOwnerInvitee)
OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="REMOVE"
AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner")
OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="ADD"
AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner")

Proposed Changes

• Developed an initial implementation for a query that ensures "roles/Owner assignments" are accounted for by a given filter.

• Based on the audit described by the CIS entry the query will flag if :

  • There is at least one"google_logging_metric" resource in the project and none contain the correct filter
  • There is at least one "google_monitoring_alert_policy" resource in the project and none contain the filter/reference a logging metric that contains the correct filter
  • There is at least one "google_monitoring_alert_policy" resource that contains the filter but none of them declare "notification_channels".

Note: there are currently issues with the search values, i could not get them to point to the "filter" field for either of the target resources in the scan results.

Tenable Reference

I submit this contribution under the Apache-2.0 license.

[github-actions]

KICS version: v2.1.13

Category Results CRITICAL 0 HIGH 0 MEDIUM 0 LOW 0 INFO 0 TRACE 0 TOTAL 0	Metric Values Files scanned 1 Files parsed 1 Files failed to scan 0 Total executed queries 47 Queries failed to execute 0 Execution time 0