Add google_chronicle_data_access_scope resource to chronicle

mmv1/products/chronicle/DataAccessScope.yaml

@@ -0,0 +1,230 @@
+# Copyright 2024 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+---
+name: DataAccessScope
+description: A DataAccessScope is a boolean expression of data access labels used to restrict access to data for users.
+min_version: 'beta'
+references:
+  guides:
+    'Introduction to data RBAC': 'https://cloud.google.com/chronicle/docs/onboard/onboard-datarbac'
+  api: 'https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.dataAccessScopes'
+base_url: projects/{{project}}/locations/{{location}}/instances/{{instance}}/dataAccessScopes
+self_link: projects/{{project}}/locations/{{location}}/instances/{{instance}}/dataAccessScopes/{{data_access_scope_id}}
+create_url: projects/{{project}}/locations/{{location}}/instances/{{instance}}/dataAccessScopes?dataAccessScopeId={{data_access_scope_id}}
+id_format: projects/{{project}}/locations/{{location}}/instances/{{instance}}/dataAccessScopes/{{data_access_scope_id}}
+import_format:
+  - projects/{{project}}/locations/{{location}}/instances/{{instance}}/dataAccessScopes/{{data_access_scope_id}}
+update_verb: PATCH
+update_mask: true
+
+examples:
+  - name: 'chronicle_dataaccessscope_with_logtype'
+    primary_resource_id: 'example'
+    min_version: 'beta'
+    vars:
+      name: scope-with-logtype
+      description: scope-description
+    test_env_vars:
+      chronicle_id: 'CHRONICLE_ID'
+  - name: 'chronicle_dataaccessscope_with_dataaccesslabel'
+    primary_resource_id: 'example'
+    min_version: 'beta'
+    vars:
+      name: scope-with-dataaccesslabel
+      description: scope-description
+      data_access_label_id: label-name
+    test_env_vars:
+      chronicle_id: 'CHRONICLE_ID'
+  - name: 'chronicle_dataaccessscope_with_asset_namespace'
+    primary_resource_id: 'example'
+    min_version: 'beta'
+    vars:
+      name: scope-with-asset-namespace
+      description: scope-description
+    test_env_vars:
+      chronicle_id: 'CHRONICLE_ID'
+  - name: 'chronicle_dataaccessscope_with_ingestion_label'
+    primary_resource_id: 'example'
+    min_version: 'beta'
+    vars:
+      name: scope-with-ingestion-label
+      description: scope-description
+    test_env_vars:
+      chronicle_id: 'CHRONICLE_ID'
+  - name: 'chronicle_dataaccessscope_with_denied_labels'
+    primary_resource_id: 'example'
+    min_version: 'beta'
+    vars:
+      name: scope-with-denied-labels
+      description: scope-description
+      data_access_label_id: label-name
+    test_env_vars:
+      chronicle_id: 'CHRONICLE_ID'
+
+
+parameters:
+  - name: location
+    type: String
+    description: Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
+    immutable: true
+    url_param_only: true
+    required: true
+  - name: instance
+    type: String
+    description: Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
+    immutable: true
+    url_param_only: true
+    required: true
+  - name: dataAccessScopeId
+    type: String
+    description: |-
+      Required. The user provided scope id which will become the last part of the name
+      of the scope resource.
+      Needs to be compliant with https://google.aip.dev/122
+    immutable: true
+    url_param_only: true
+    required: true
+properties:
+  - name: deniedDataAccessLabels
+    type: Array
+    description: |-
+      Optional. The denied labels for the scope.
+      The logical operator for evaluation of the denied labels is AND.
+      E.g.: A customer with scope with denied labels A and B won't be able
+      to see data labeled with A and data labeled with B
+      and data with labels A and B.
+    item_type:
+      type: NestedObject
+      properties:
+        - name: displayName
+          type: String
+          description: |-
+            Output only. The display name of the label.
+            Data access label and log types's name
+            will match the display name of the resource.
+            The asset namespace will match the namespace itself.
+            The ingestion key value pair will match the key of the tuple.
+          output: true
+        - name: dataAccessLabel
+          type: String
+          description: The name of the data access label.
+        - name: logType
+          type: String
+          description: The name of the log type.
+        - name: assetNamespace
+          type: String
+          description: |-
+            The asset namespace configured in the forwarder
+            of the customer's events.
+        - name: ingestionLabel
+          type: NestedObject
+          description: Representation of an ingestion label type.
+          properties:
+            - name: ingestionLabelKey
+              type: String
+              description: Required. The key of the ingestion label. Always required.
+              required: true
+            - name: ingestionLabelValue
+              type: String
+              description: |-
+                Optional. The value of the ingestion label. Optional. An object
+                with no provided value and some key provided would match
+                against the given key and ANY value.
+  - name: displayName
+    type: String
+    description: Output only. The name to be used for display to customers of the data access scope.
+    output: true
+  - name: createTime
+    type: String
+    description: Output only. The time at which the data access scope was created.
+    output: true
+  - name: author
+    type: String
+    description: Output only. The user who created the data access scope.
+    output: true
+  - name: lastEditor
+    type: String
+    description: Output only. The user who last updated the data access scope.
+    output: true
+  - name: description
+    type: String
+    description: Optional. A description of the data access scope for a human reader.
+  - name: allowAll
+    type: Boolean
+    description: |-
+      Optional. Whether or not the scope allows all labels, allow_all and
+      allowed_data_access_labels are mutually exclusive and one of them must be
+      present. denied_data_access_labels can still be used along with allow_all.
+      When combined with denied_data_access_labels, access will be granted to all
+      data that doesn't have labels mentioned in denied_data_access_labels. E.g.:
+      A customer with scope with denied labels A and B and allow_all will be able
+      to see all data except data labeled with A and data labeled with B and data
+      with labels A and B.
+  - name: name
+    type: String
+    description: |-
+      Required. The unique full name of the data access scope.
+      The name should comply with https://google.aip.dev/122 standards.
+    required: true
+    default_from_api: true
+  - name: allowedDataAccessLabels
+    type: Array
+    description: |-
+      Required. The allowed labels for the scope. There has to be at
+      least one label allowed for the scope to be valid.
+      The logical operator for evaluation of the allowed labels is OR.
+      Either allow_all or allowed_data_access_labels needs to be provided.
+      E.g.: A customer with scope with allowed labels A and B will be able
+      to see data with labeled with A or B or (A and B).
+    item_type:
+      type: NestedObject
+      properties:
+        - name: dataAccessLabel
+          type: String
+          description: The name of the data access label.
+        - name: logType
+          type: String
+          description: The name of the log type.
+        - name: assetNamespace
+          type: String
+          description: |-
+            The asset namespace configured in the forwarder
+            of the customer's events.
+        - name: ingestionLabel
+          type: NestedObject
+          description: Representation of an ingestion label type.
+          properties:
+            - name: ingestionLabelKey
+              type: String
+              description: Required. The key of the ingestion label. Always required.
+              required: true
+            - name: ingestionLabelValue
+              type: String
+              description: |-
+                Optional. The value of the ingestion label. Optional. An object
+                with no provided value and some key provided would match
+                against the given key and ANY value.
+        - name: displayName
+          type: String
+          description: |-
+            Output only. The display name of the label.
+            Data access label and log types's name
+            will match the display name of the resource.
+            The asset namespace will match the namespace itself.
+            The ingestion key value pair will match the key of the tuple.
+          output: true
+  - name: updateTime
+    type: String
+    description: Output only. The time at which the data access scope was last updated.
+    output: true

mmv1/products/chronicle/product.yaml

@@ -0,0 +1,22 @@
+# Copyright 2024 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+---
+name: Chronicle
+display_name: Chronicle
+scopes:
+ - https://www.googleapis.com/auth/cloud-platform
+versions:
+ - base_url: https://{{location}}-chronicle.googleapis.com/v1beta/
+   name: beta
+caibaseurl: ""

mmv1/templates/terraform/examples/chronicle_dataaccessscope_with_asset_namespace.tf.tmpl

@@ -0,0 +1,15 @@
+provider "google-beta" {
+ user_project_override = true
+}
+
+resource "google_chronicle_data_access_scope" "{{$.PrimaryResourceId}}" {
+ provider = "google-beta"
+ location = "us"
+ instance = "{{index $.TestEnvVars "chronicle_id"}}"
+ data_access_scope_id = "{{index $.Vars "name"}}"
+ description = "{{index $.Vars "description"}}"
+ allowed_data_access_labels {
+     asset_namespace = "my-namespace"
+ }
+}
+

mmv1/templates/terraform/examples/chronicle_dataaccessscope_with_dataaccesslabel.tf.tmpl

@@ -0,0 +1,25 @@
+provider "google-beta" {
+  user_project_override = true
+}
+
+resource "google_chronicle_data_access_label" "custom_data_access_label" {
+  provider = "google-beta"
+  location = "us"
+  instance = "{{index $.TestEnvVars "chronicle_id"}}"
+  data_access_label_id = "{{index $.Vars "data_access_label_id"}}"
+  udm_query = "principal.hostname=\"google.com\""
+}
+
+resource "google_chronicle_data_access_scope" "{{$.PrimaryResourceId}}" {
+  provider = "google-beta"
+  location = "us"
+  instance = "{{index $.TestEnvVars "chronicle_id"}}"
+  data_access_scope_id = "{{index $.Vars "name"}}"
+  description = "{{index $.Vars "description"}}"
+  allowed_data_access_labels {
+      log_type = "GCP_CLOUDAUDIT"
+  }
+  allowed_data_access_labels {
+      data_access_label = resource.google_chronicle_data_access_label.custom_data_access_label.data_access_label_id
+  }
+}

mmv1/templates/terraform/examples/chronicle_dataaccessscope_with_denied_labels.tf.tmpl

@@ -0,0 +1,38 @@
+provider "google-beta" {
+  user_project_override = true
+}
+
+resource "google_chronicle_data_access_label" "custom_data_access_label" {
+  provider = "google-beta"
+  location = "us"
+  instance = "{{index $.TestEnvVars "chronicle_id"}}"
+  data_access_label_id = "{{index $.Vars "data_access_label_id"}}"
+  udm_query = "principal.hostname=\"google.com\""
+}
+
+resource "google_chronicle_data_access_scope" "{{$.PrimaryResourceId}}" {
+  provider = "google-beta"
+  location = "us"
+  instance = "{{index $.TestEnvVars "chronicle_id"}}"
+  data_access_scope_id = "{{index $.Vars "name"}}"
+  description = "{{index $.Vars "description"}}"
+  allow_all = false
+  allowed_data_access_labels {
+      log_type = "GITHUB"
+  }
+  denied_data_access_labels {
+      log_type = "GCP_CLOUDAUDIT"
+  }
+  denied_data_access_labels {
+      data_access_label = resource.google_chronicle_data_access_label.custom_data_access_label.data_access_label_id
+  }
+  denied_data_access_labels {
+     ingestion_label {
+	    ingestion_label_key = "ingestion_key"
+        ingestion_label_value = "ingestion_value"
+     }
+  }
+  denied_data_access_labels {
+     asset_namespace = "my-namespace"
+ }
+}

mmv1/templates/terraform/examples/chronicle_dataaccessscope_with_ingestion_label.tf.tmpl

@@ -0,0 +1,18 @@
+provider "google-beta" {
+ user_project_override = true
+}
+
+resource "google_chronicle_data_access_scope" "{{$.PrimaryResourceId}}" {
+ provider = "google-beta"
+ location = "us"
+ instance = "{{index $.TestEnvVars "chronicle_id"}}"
+ data_access_scope_id = "{{index $.Vars "name"}}"
+ description = "{{index $.Vars "description"}}"
+ allowed_data_access_labels {
+     ingestion_label {
+	    ingestion_label_key = "ingestion_key"
+        ingestion_label_value = "ingestion_value"
+     }
+ }
+}
+

mmv1/templates/terraform/examples/chronicle_dataaccessscope_with_logtype.tf.tmpl

@@ -0,0 +1,17 @@
+provider "google-beta" {
+  user_project_override = true
+}
+
+resource "google_chronicle_data_access_scope" "{{$.PrimaryResourceId}}" {
+  provider = "google-beta"
+  location = "us"
+  instance = "{{index $.TestEnvVars "chronicle_id"}}"
+  data_access_scope_id = "{{index $.Vars "name"}}"
+  description = "{{index $.Vars "description"}}"
+  allowed_data_access_labels {
+      log_type = "GCP_CLOUDAUDIT"
+  }
+  allowed_data_access_labels {
+      log_type = "GITHUB"
+  }
+}

mmv1/third_party/terraform/.teamcity/components/inputs/services_beta.kt

@@ -141,6 +141,11 @@ var ServicesListBeta = mapOf(
         "displayName" to "Certificatemanager",
         "path" to "./google-beta/services/certificatemanager"
     ),
+    "chronicle" to mapOf(
+        "name" to "chronicle",
+        "displayName" to "Chronicle",
+        "path" to "./google-beta/services/chronicle"
+    ),
     "cloudasset" to mapOf(
         "name" to "cloudasset",
         "displayName" to "Cloudasset",

mmv1/third_party/terraform/.teamcity/components/inputs/services_ga.kt

@@ -141,6 +141,11 @@ var ServicesListGa = mapOf(
         "displayName" to "Certificatemanager",
         "path" to "./google/services/certificatemanager"
     ),
+    "chronicle" to mapOf(
+        "name" to "chronicle",
+        "displayName" to "Chronicle",
+        "path" to "./google-beta/services/chronicle"
+    ),
     "cloudasset" to mapOf(
         "name" to "cloudasset",
         "displayName" to "Cloudasset",