For gcp inspec google_dataproc_cluster resource: Expose attributes around scheduled deletion

[sukchomb-zz]

Detailed Description

At the present time we cannot perform any compliance checks in this area.
These attributes are also not exposed using the solid or beta API calls

gcloud dataproc clusters describe --region=us-central1

gcloud beta dataproc clusters describe --region=us-central1

Context

Having these attributes available to test will strengthen the security posture of the Platform.

Possible Implementation

[slevenick]

I can absolutely add this via Magic Modules. I have a large amount of changes in the pipeline, so this will likely need to happen after that.

[lhasadreams]

@slevenick that is excellent news, thanks.

@sukchomb looking at this again, I see that the GCP API support is already there.
gcloud dataproc clusters list --region europe-west2 --formtat json
gets me all the info on my DataProc cluster.
Same goes for the beta version.

Are you using an out of date GCP API?

Until @slevenick has completed his magic module work, in the short term you could always create an InSpec command to call the gcloud command above - https://www.inspec.io/docs/reference/resources/command/

Cheers
Adrian

[sukchomb-zz]

@lhasadreams the 'lifecycleConfig' section is exposed in the gcloud command

And when I use the inspec command resource, I get

Resource command is not supported on platform gcp/google-api-client-v0.23.9.

component versions I have installed are:

Please advise what further steps I need to take to get the command resource working.

Cheers,

Sukhjit

[lhasadreams]

Hi Sukhjit,
What it is telling you is correct.
You are trying to use the gcp train connection to run a gcloud command, using the InSpec command resource. The gcloud command needs to run on an operating system that then calls gcloud to connect to gcp - no different than if you are running gcloud from your command prompt.

Create a new inspec.yml something like this:
name: gcp-command
title: InSpec Profile
maintainer: The Authors
copyright: The Authors
copyright_email: [email protected]
license: Apache-2.0
summary: An InSpec Compliance Profile
version: 0.1.0
supports:
platform: os

and then the control could be something like this (change to the command that you would like to run):
gcp_project_id="afdaniels"
control 'service-api-match' do
impact 1.0
title 'Ensure the services are enabled'
describe command("gcloud services list --enabled --project=#{gcp_project_id} --format=json") do
its(:exit_status) { should eq 0 }
its(:stderr) { should eq '' }
end
end

You would then execute this in a shell on your local or remote machine with the gcloud credentials set.
inspec exec .

You could then use Ruby to parse the json retuned to make the tests that you require.

Cheers,
Adrian

[sukchomb-zz]

@slevenick How are you getting on with the gcp inspec resources for Dataproc?

[slevenick]

It's going to be blocked on this PR: #226

After those changes go through it should only take a day or two to add

[lhasadreams]

@slevenick Any update on #226 please?