feat(securitycenter): Add Resource SCC Mgmt API Org SHA Custom Modules (Create, Get, List, Delete, Update) #13004

vijaykanthm · 2024-12-17T20:36:11Z

Description

Fixes b/347347639, b/347347585, b/347347681, b/347347739, b/347347584
This PR adds SCC Managament API Org SHA Custom Module Samples to Create, Get, List, Delete & Update.

Note: Before submitting a pull request, please open an issue for discussion if you are not associated with Google.

Checklist

I have followed Sample Guidelines from AUTHORING_GUIDE.MD
README is updated to include all relevant information
Tests pass: nox -s py-3.9 (see Test Environment Setup)
Lint pass: nox -s lint (see Test Environment Setup)
These samples need a new API enabled in testing projects to pass (let us know which ones)
These samples need a new/updated env vars in testing projects set to pass (let us know which ones)
This sample adds a new sample directory, and I updated the CODEOWNERS file with the codeowners for this sample
This sample adds a new Product API, and I updated the Blunderbuss issue/PR auto-assigner with the codeowners for this sample
Please merge this PR for me once it is approved

…Create, Get, Delete, List, Update)

ghost

Hi @vijaykanthm and reviewers,

Gemini is currently reviewing this pull request and will post a full review in a few minutes. In the meantime, here's a quick summary to help everyone get up to speed:

This pull request adds Python sample code for interacting with the Security Health Analytics Custom Modules API. Specifically, it provides examples for creating, getting, listing, deleting, and updating custom modules within an organization. The intent is to improve the documentation and provide developers with readily available code snippets for common tasks related to Security Health Analytics Custom Modules. The changes include the addition of several new Python files (securitycenter/snippets_management_api/noxfile_config.py, securitycenter/snippets_management_api/requirements-test.txt, securitycenter/snippets_management_api/requirements.txt, securitycenter/snippets_management_api/security_health_analytics_custom_module_test.py, securitycenter/snippets_management_api/security_health_analytics_custom_modules.py) containing the sample code and associated test files, along with updates to the requirements.txt and requirements-test.txt files to include necessary dependencies.

The code is well-structured and includes comprehensive unit tests to ensure functionality. The noxfile_config.py file configures the testing environment, and the security_health_analytics_custom_modules.py file contains the core functions for interacting with the API. The tests in security_health_analytics_custom_module_test.py cover all the CRUD operations (Create, Read, Update, Delete).

Here's a little something to brighten your day:

Code flows like a stream,
Tests catch bugs, a helpful gleam,
Clean code, a joyful dream.

Thanks,
Gemini

ghost

This pull request introduces new functionality to manage Security Health Analytics custom modules. Overall, the code is well-organized and the tests are comprehensive. A few minor improvements are suggested below.

ghost · 2024-12-17T20:40:49Z

securitycenter/snippets_management_api/noxfile_config.py

+
+TEST_CONFIG_OVERRIDE = {
+    # You can opt out from the test for specific Python versions.
+    "ignored_versions": ["2.7", "3.7", "3.9", "3.10", "3.11"],


Since this sample supports Python 3.8, consider removing 3.8 from the ignored_versions list to enable testing for this version. Per the authoring guide, samples should support Python 3.8 unless the API or service has specific requirements otherwise.

ghost · 2024-12-17T20:40:49Z

securitycenter/snippets_management_api/security_health_analytics_custom_module_test.py

+import time
+import random
+
+#Replace these variables before running the sample.


Consider adding a comment explaining the purpose of each environment variable. This will improve readability and make it easier for others to understand how to configure the tests.

Suggested change

#Replace these variables before running the sample.

#Replace these variables before running the sample.

# GCLOUD_ORGANIZATION: The organization ID.

ORGANIZATION_ID = os.environ["GCLOUD_ORGANIZATION"]

LOCATION = "global"

PREFIX = "python_sample_sha_custom_module" # Prefix used for identifying test modules

ghost · 2024-12-17T20:40:50Z

securitycenter/snippets_management_api/security_health_analytics_custom_modules.py

+        "custom_config": {
+            "description": "Sample custom module for testing purpose. Please do not delete.",
+            "predicate": {
+                "expression": "has(resource.rotationPeriod) && (resource.rotationPeriod > duration('2592000s'))",


The predicate expression is quite generic. Could you clarify what resource.rotationPeriod refers to and why 2592000 seconds (30 days) is used as a threshold? A more specific example or a detailed explanation in the docstring would be helpful.

ghost · 2024-12-17T20:40:50Z

securitycenter/snippets_management_api/security_health_analytics_custom_modules.py

+                "title": "GCE Instance High Severity",
+                "description": "Custom module to detect high severity issues on GCE instances.",
+            },
+            "recommendation": "Ensure proper security configurations on GCE instances.",


The title and description in the predicate refer to "GCE Instance High Severity", but the resource selector targets cloudkms.googleapis.com/CryptoKey. This is a mismatch. Change the title and description to accurately reflect that the predicate applies to Cloud KMS CryptoKeys, not GCE instances.

Suggested change

"title": "GCE Instance High Severity",

"description": "Custom module to detect high severity issues on GCE instances.",

},

"recommendation": "Ensure proper security configurations on GCE instances.",

"title": "Cloud KMS CryptoKey Rotation Period",

"description": "Custom module to check if the rotation period of a Cloud KMS CryptoKey exceeds 30 days.",

},

"recommendation": "Review and adjust the rotation period for Cloud KMS CryptoKeys to align with your security policies.",

ghost · 2024-12-17T20:40:50Z

securitycenter/snippets_management_api/security_health_analytics_custom_modules.py

+                            "description": "The name of the instance",
+                            "expression": "resource.name",
+                            "location": "global",
+                            "title": "Instance Name",


The description, expression, and title in value_expression seem generic. Consider providing more context by relating them to the Cloud KMS CryptoKey example. For instance, instead of "The name of the instance", use "The resource name of the CryptoKey".

snippet-bot · 2024-12-17T20:53:25Z

Here is the summary of changes.

You are about to add 5 region tags.

securitycenter/snippets_management_api/security_health_analytics_custom_modules.py:23, tag securitycenter_create_security_health_analytics_custom_module
securitycenter/snippets_management_api/security_health_analytics_custom_modules.py:101, tag securitycenter_get_security_health_analytics_custom_module
securitycenter/snippets_management_api/security_health_analytics_custom_modules.py:131, tag securitycenter_list_security_health_analytics_custom_module
securitycenter/snippets_management_api/security_health_analytics_custom_modules.py:169, tag securitycenter_delete_security_health_analytics_custom_module
securitycenter/snippets_management_api/security_health_analytics_custom_modules.py:198, tag securitycenter_update_security_health_analytics_custom_module

This comment is generated by snippet-bot.
If you find problems with this result, please file an issue at:
https://github.com/googleapis/repo-automation-bots/issues.
To update this comment, add snippet-bot:force-run label or use the checkbox below:

Refresh this comment

…t session

glasnt · 2025-02-05T09:28:42Z

This PR conflicts with #13023 in it's current state. Discussing offline

Merge remote to local.

feat(securitycenter): Add Resource SCC Mgt API Org SHA Cust Modules (…

9a19f99

…Create, Get, Delete, List, Update)

vijaykanthm requested review from a team as code owners December 17, 2024 20:36

product-auto-label bot added the api: securitycenter Issues related to the Security Command Center API. label Dec 17, 2024

ghost reviewed Dec 17, 2024

View reviewed changes

product-auto-label bot added the samples Issues that are directly related to samples. label Dec 17, 2024

blunderbuss-gcf bot assigned Sita04 Dec 17, 2024

ghost reviewed Dec 17, 2024

View reviewed changes

vijaykanthm added 10 commits December 18, 2024 20:23

fix lint and address comments

3b2b41c

fix lint errors

382b52d

fix the ci python version errors

9d7658e

lint fix

1b0ff27

fix linting

655829e

Refactor the filename of the testfile

f4b538a

Trigger CI pipeline

5aba8dd

Refactor the cleaning up of created custom modules in the current tes…

fc3efcc

…t session

Refactor the module creation and clean up

fdb733b

Remove commented code

dbbc6c6

vijaykanthm added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Jan 22, 2025

kokoro-team removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Jan 22, 2025

anissa-abu approved these changes Jan 23, 2025

View reviewed changes

Merge remote-tracking branch 'origin/main' into scc-mgt-org-create-get

ce1c968

Merge remote to local.

glasnt approved these changes Feb 7, 2025

View reviewed changes

glasnt merged commit 2cb8866 into main Feb 7, 2025
14 checks passed

glasnt deleted the scc-mgt-org-create-get branch February 7, 2025 09:36

glasnt mentioned this pull request Feb 7, 2025

feat(securitycenter): Add Resource SCC Org Mgmt API SHA Custom Modules (GetEff, ListEff, ListDesc, Simulate) #13023

Merged

9 tasks

This was referenced Feb 7, 2025

feat(securitycenter): Add Resource SCC Org Mgmt API ETD Custom Modules (Create, Get, List, Delete, Update) #13040

Merged

feat(securitycenter): Add Resource SCC Org Mgt API ETD Custom Modules (GetEff, ListEff, ListDesc, Validate) #13081

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(securitycenter): Add Resource SCC Mgmt API Org SHA Custom Modules (Create, Get, List, Delete, Update) #13004

feat(securitycenter): Add Resource SCC Mgmt API Org SHA Custom Modules (Create, Get, List, Delete, Update) #13004

vijaykanthm commented Dec 17, 2024 •

edited

Loading

ghost left a comment

ghost left a comment

ghost Dec 17, 2024

ghost Dec 17, 2024

vijaykanthm Dec 19, 2024

ghost Dec 17, 2024

vijaykanthm Dec 19, 2024

ghost Dec 17, 2024

vijaykanthm Dec 19, 2024

ghost Dec 17, 2024

vijaykanthm Dec 19, 2024

snippet-bot bot commented Dec 17, 2024 •

edited

Loading

glasnt commented Feb 5, 2025

-#Replace these variables before running the sample.
+#Replace these variables before running the sample.
+# GCLOUD_ORGANIZATION: The organization ID.
+ORGANIZATION_ID = os.environ["GCLOUD_ORGANIZATION"]
+LOCATION = "global"
+PREFIX = "python_sample_sha_custom_module"  # Prefix used for identifying test modules

feat(securitycenter): Add Resource SCC Mgmt API Org SHA Custom Modules (Create, Get, List, Delete, Update) #13004

feat(securitycenter): Add Resource SCC Mgmt API Org SHA Custom Modules (Create, Get, List, Delete, Update) #13004

Conversation

vijaykanthm commented Dec 17, 2024 • edited Loading

Description

Checklist

ghost left a comment

Choose a reason for hiding this comment

ghost left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

snippet-bot bot commented Dec 17, 2024 • edited Loading

glasnt commented Feb 5, 2025

vijaykanthm commented Dec 17, 2024 •

edited

Loading

snippet-bot bot commented Dec 17, 2024 •

edited

Loading