Added directions for Heimdall Lite #59

aaronlippold · 2020-09-20T02:24:56Z

updated README to add the JSON reporter to the process
updated Walkthrough to create a JSON result and then load into Heimdall Lite

Signed-off-by: Aaron Lippold [email protected]

… looad into Heimdall Lite Signed-off-by: Aaron Lippold <[email protected]>

Signed-off-by: Aaron Lippold <[email protected]>

binamov · 2020-09-21T20:47:27Z

/gcbrun

binamov

@aaronlippold thank you for this! I have a small suggestion to make the walkthrough experience better. LMK if it doesn't make sense.

walkthrough.md

…for action steps Signed-off-by: Aaron Lippold <[email protected]>

aaronlippold · 2020-09-24T15:21:30Z

If we agree on the communication and presentation here, I will merge it into the other PRs as well. Please feel free to edit on your side if you see anything. Once merged, we can update the other profiles.

binamov · 2020-09-24T18:21:33Z

/gcbrun

aaronlippold · 2020-09-25T15:23:37Z

inspec.yml

+copyright_email: '[email protected]'
+license: 'Apache-2.0'
+summary: 'Inspec Google Cloud Platform Center for Internet Security Benchmark v1.1 Profile'
+version: 1.1.0-17


This will need to be bumped with the changes we have made to ensure folks profiles update

binamov · 2020-10-01T18:37:54Z

/gcbrun

binamov · 2020-10-01T18:40:21Z

@aaronlippold seems we have a problem in inspec.yml

/usr/local/bundle/gems/inspec-core-4.22.0/lib/source_readers/inspec.rb:38:in `rescue in load_metadata': Unable to parse inspec.yml: line 50, did not find expected key while parsing a block mapping (RuntimeError)
	from /usr/local/bundle/gems/inspec-core-4.22.0/lib/source_readers/inspec.rb:31:in `load_metadata'
	from /usr/local/bundle/gems/inspec-core-4.22.0/lib/source_readers/inspec.rb:23:in `initialize'
	from /usr/local/bundle/gems/inspec-core-4.22.0/lib/source_readers/inspec.rb:10:in `new'
	from /usr/local/bundle/gems/inspec-core-4.22.0/lib/source_readers/inspec.rb:10:in `resolve'
	from /usr/local/bundle/gems/inspec-core-4.22.0/lib/inspec/plugin/v1/registry.rb:14:in `block in resolve'
	from /usr/local/bundle/gems/inspec-core-4.22.0/lib/inspec/plugin/v1/registry.rb:13:in `each'
	from /usr/local/bundle/gems/inspec-core-4.22.0/lib/inspec/plugin/v1/registry.rb:13:in `resolve'
	from /usr/local/bundle/gems/inspec-core-4.22.0/lib/inspec/source_reader.rb:10:in `resolve'
	from /usr/local/bundle/gems/inspec-core-4.22.0/lib/inspec/profile.rb:56:in `for_path'
	from /usr/local/bundle/gems/inspec-core-4.22.0/lib/inspec/profile.rb:68:in `for_fetcher'
	from /usr/local/bundle/gems/inspec-core-4.22.0/lib/inspec/profile.rb:74:in `for_target'
	from /usr/local/bundle/gems/inspec-core-4.22.0/lib/inspec/profile_vendor.rb:44:in `profile'
	from /usr/local/bundle/gems/inspec-core-4.22.0/lib/inspec/profile_vendor.rb:58:in `vendor_dependencies!'
	from /usr/local/bundle/gems/inspec-core-4.22.0/lib/inspec/profile_vendor.rb:13:in `vendor!'
	from /usr/local/bundle/gems/inspec-core-4.22.0/lib/inspec/base_cli.rb:294:in `vendor_deps'
	from /usr/local/bundle/gems/inspec-core-4.22.0/lib/inspec/cli.rb:153:in `vendor'
	from /usr/local/bundle/gems/thor-1.0.1/lib/thor/command.rb:27:in `run'
	from /usr/local/bundle/gems/thor-1.0.1/lib/thor/invocation.rb:127:in `invoke_command'
	from /usr/local/bundle/gems/thor-1.0.1/lib/thor.rb:392:in `dispatch'
	from /usr/local/bundle/gems/thor-1.0.1/lib/thor/base.rb:485:in `start'
	from /usr/local/bundle/gems/inspec-core-4.22.0/lib/inspec/base_cli.rb:35:in `start'
	from /usr/local/bundle/gems/cinc-auditor-bin-4.22.0/bin/cinc-auditor:12:in `<top (required)>'
	from /usr/local/bundle/bin/cinc-auditor:23:in `load'
	from /usr/local/bundle/bin/cinc-auditor:23:in `<main>'
/usr/local/lib/ruby/2.7.0/psych.rb:456:in `parse': (<unknown>): did not find expected key while parsing a block mapping at line 50 column 3 (Psych::SyntaxError)

Signed-off-by: Aaron Lippold <[email protected]>

binamov · 2020-10-01T23:10:31Z

/gcbrun

binamov · 2020-10-01T23:14:48Z

CI seems angry that there's no gcp_project_id

/usr/local/bundle/gems/inspec-core-4.22.0/lib/inspec/profile.rb:223:in `rescue in block in collect_tests': Failed to load source for controls/4.05-vms.rb: bad URI(is not URI?): "https://www.googleapis.com/compute/v1/projects/Input 'gcp_project_id' does not have a value. Skipping test./zones" (Inspec::Exceptions::ProfileLoadFailed)

binamov · 2020-10-01T23:23:00Z

inspec.yml

+  - name: gcp_project_id
+    description: "The GCP project identifier."
+    type: String
+    required: true


CI is angry there's no value for this...

CI continues to be angry about not having a value for gcp_project_id @aaronlippold, I can't push to your branch. Can you please add a commit?

added a default dummy value - let me know if that helps. I will see about updating my PRs to ensure you all have push access.

aaronlippold · 2020-10-01T23:48:49Z

Yes I noticed an odd behavior where in spec check seems to be complaining. I think I will have to open an issue upstream. As a workaround we may have to just set a dummy value even though that defeats the purpose of making it a required input. Could you give that a shot on your side and see if that resolves the issue and we can open an upstream issue.

…

On Thu, Oct 1, 2020, 7:23 PM Bakh Inamov ***@***.***> wrote: ***@***.**** commented on this pull request. ------------------------------ In inspec.yml <#59 (comment)> : > -- name: sa_key_older_than_seconds - description: 'How many seconds SA keys should not be older than' - value: 7776000 - type: numeric -- name: kms_rotation_period_seconds - description: 'How many seconds KMS Keys should be last rotated (90 days)' - value: 7776000 - type: numeric -- name: bucket_logging_ignore_regex - description: 'Ignore this bucket by regex from requiring logging to be enabled' + # {{gcp_project_id}} and {{bucket_logging_ignore_regex}} + # must be defined at runtime by the user + - name: gcp_project_id + description: "The GCP project identifier." + type: String + required: true CI is angry there's no value for this... — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#59 (review)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AALK42GQJMXSRMWULKKAZFTSIUFODANCNFSM4RTLXR2A> .

binamov · 2020-10-05T21:02:10Z

Yeah adding a blank or a dummy value fixes the profile evaluation issue. I tried to push a change to your branch but no permissions. I'll let you amend this PR @aaronlippold

binamov · 2020-10-05T21:02:51Z

Also needs a version bump in inspec.yml to fix merge conflict.

aaronlippold · 2020-10-06T02:51:11Z

Oops. I’ll make sure to send it that maintainers can push next time I guess I forgot it

On Mon, Oct 5, 2020 at 5:03 PM Bakh Inamov ***@***.***> wrote: Also needs a version bump in inspec.yml to fix merge conflict. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#59 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AALK42GTISQZKKOCTWH5YNDSJIYATANCNFSM4RTLXR2A> .

-- -------- Aaron Lippold [email protected] 260-255-4779 twitter/aim/yahoo,etc. 'aaronlippold'

KonradSchieban · 2020-10-13T17:59:00Z

/gcbrun

binamov · 2020-10-13T20:06:42Z

inspec.yml

+  - name: gcp_project_id
+    description: "The GCP project identifier."
+    type: String
+    required: true


CI continues to be angry about not having a value for gcp_project_id @aaronlippold, I can't push to your branch. Can you please add a commit?

binamov · 2020-10-13T23:02:44Z

/gcbrun

binamov

🍒

KonradSchieban · 2020-10-14T01:50:40Z

Thank you for your contribution @aaronlippold ! Looks great! 🚀

* added directions to README and Walkthough to create a json result and looad into Heimdall Lite * added default dummy value for the project_id * fixed indent issues in inspec.yml * fixed markdown syntax in README Signed-off-by: Aaron Lippold <[email protected]>

aaronlippold added 2 commits September 19, 2020 22:21

added directions to README and Walkthough to create a json result and…

b710556

… looad into Heimdall Lite Signed-off-by: Aaron Lippold <[email protected]>

fixed markdown syntax in README

355bc5a

Signed-off-by: Aaron Lippold <[email protected]>

binamov requested changes Sep 21, 2020

View reviewed changes

walkthrough.md Outdated Show resolved Hide resolved

walkthrough.md Outdated Show resolved Hide resolved

binamov mentioned this pull request Sep 21, 2020

Added Scan review using Heimdall Lite to the Readme and Walkthrough GoogleCloudPlatform/inspec-gke-cis-benchmark#9

Open

aaronlippold marked this pull request as draft September 23, 2020 14:57

aaronlippold added 2 commits September 24, 2020 11:12

updated shared inputs, readme and walkthrough

4e926c0

fixed grammer and updated to use bullets for items and numbered list …

8e63764

…for action steps Signed-off-by: Aaron Lippold <[email protected]>

aaronlippold marked this pull request as ready for review September 24, 2020 15:21

aaronlippold requested a review from binamov September 24, 2020 15:24

aaronlippold commented Sep 25, 2020

View reviewed changes

fixed indent issues in inspec.yml

246608c

Signed-off-by: Aaron Lippold <[email protected]>

binamov reviewed Oct 1, 2020

View reviewed changes

Merge branch 'master' into heimdall-lite

65f3d02

binamov requested changes Oct 13, 2020

View reviewed changes

added default dummy value for the project_id

4c4f690

aaronlippold requested a review from binamov October 13, 2020 21:20

aaronlippold marked this pull request as draft October 13, 2020 21:20

aaronlippold marked this pull request as ready for review October 13, 2020 21:20

binamov approved these changes Oct 14, 2020

View reviewed changes

KonradSchieban merged commit a9134fc into GoogleCloudPlatform:master Oct 14, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added directions for Heimdall Lite #59

Added directions for Heimdall Lite #59

aaronlippold commented Sep 20, 2020

binamov commented Sep 21, 2020

binamov left a comment

aaronlippold commented Sep 24, 2020

binamov commented Sep 24, 2020

aaronlippold Sep 25, 2020

binamov commented Oct 1, 2020

binamov commented Oct 1, 2020

binamov commented Oct 1, 2020

binamov commented Oct 1, 2020 •

edited

Loading

binamov Oct 1, 2020

binamov Oct 13, 2020 •

edited

Loading

aaronlippold Oct 13, 2020

aaronlippold commented Oct 1, 2020 via email

binamov commented Oct 5, 2020

binamov commented Oct 5, 2020

aaronlippold commented Oct 6, 2020 via email

KonradSchieban commented Oct 13, 2020

binamov Oct 13, 2020 •

edited

Loading

binamov commented Oct 13, 2020

binamov left a comment

KonradSchieban commented Oct 14, 2020

Added directions for Heimdall Lite #59

Added directions for Heimdall Lite #59

Conversation

aaronlippold commented Sep 20, 2020

binamov commented Sep 21, 2020

binamov left a comment

Choose a reason for hiding this comment

aaronlippold commented Sep 24, 2020

binamov commented Sep 24, 2020

aaronlippold Sep 25, 2020

Choose a reason for hiding this comment

binamov commented Oct 1, 2020

binamov commented Oct 1, 2020

binamov commented Oct 1, 2020

binamov commented Oct 1, 2020 • edited Loading

binamov Oct 1, 2020

Choose a reason for hiding this comment

binamov Oct 13, 2020 • edited Loading

Choose a reason for hiding this comment

aaronlippold Oct 13, 2020

Choose a reason for hiding this comment

aaronlippold commented Oct 1, 2020 via email

binamov commented Oct 5, 2020

binamov commented Oct 5, 2020

aaronlippold commented Oct 6, 2020 via email

KonradSchieban commented Oct 13, 2020

binamov Oct 13, 2020 • edited Loading

Choose a reason for hiding this comment

binamov commented Oct 13, 2020

binamov left a comment

Choose a reason for hiding this comment

KonradSchieban commented Oct 14, 2020

binamov commented Oct 1, 2020 •

edited

Loading

binamov Oct 13, 2020 •

edited

Loading

binamov Oct 13, 2020 •

edited

Loading