⭐️ GCP resources as assets P0

[imilchev]

The following GCP assets are added as potential discovery options when scanning GCP:

• Compute images ./cnquery shell gcp --discover compute-images

cnquery> platform{name title runtime kind}
platform: {
  kind: "gcp-object"
  name: "gcp-compute-image"
  runtime: "gcp"
  title: "GCP Compute Image"
}

• GKE clusters ./cnquery shell gcp --discover gke-clusters

cnquery> platform{name title runtime kind}
platform: {
  kind: "gcp-object"
  name: "gcp-gke-cluster"
  runtime: "gcp"
  title: "GCP GKE Cluster"
}

• VPC firewalls ./cnquery shell gcp --discover compute-firewalls

cnquery> platform{name title runtime kind}
platform: {
  kind: "gcp-object"
  name: "gcp-compute-firewall"
  runtime: "gcp"
  title: "GCP Compute Firewall"
}

• GCS buckets ./cnquery shell gcp --discover storage-buckets

cnquery> platform{name title runtime kind}
platform: {
  kind: "gcp-object"
  name: "gcp-storage-bucket"
  runtime: "gcp"
  title: "GCP Storage Bucket"
}

• VPC networks ./cnquery shell gcp --discover compute-networks

cnquery> platform{name title runtime kind}
platform: {
  kind: "gcp-object"
  name: "gcp-compute-network"
  runtime: "gcp"
  title: "GCP Compute Network"
}

• VPC subnetworks./cnquery shell gcp --discover compute-subnetworks

cnquery> platform{name title runtime kind}
platform: {
  kind: "gcp-object"
  name: "gcp-compute-subnetwork"
  runtime: "gcp"
  title: "GCP Compute Subnetwork"
}

• BigQuery datasets ./cnquery shell gcp --discover bigquery-datasets

cnquery> platform{name title runtime kind}
platform: {
  kind: "gcp-object"
  name: "gcp-bigquery-dataset"
  runtime: "gcp"
  title: "GCP BigQuery Dataset"
}

[preslavgerchev]

I am not yet sure if this will work if you pass credentials to authenticate, I had the same trouble with Azure.

Basically, the secret in the provider is unresolved and you need to resolve this by using the credentials query that the resolver gets passed.

This is the same reason why we use motor.NewMotorConnection in the resolver directly instead of motor.New.

Tldr: Should probably be using motor.NewMotorConnection here

Edit: It actually depends on how you're passing the provider down to these objects. If you're using the one that you get initially from calling motor.NewMotorConnection then it is probably fine 🤷

[vjeffrey]

i'm not sure i understand -- can you give an example of what you mean when you say "pass credentials to authenticate", like the command you're using/thinking of?

[imilchev]

I can describe that. I have this inventory file for GCP:

apiVersion: v1
kind: Inventory
metadata:
  name: inventory
spec:
  assets:
    - name: cool-stuff
      connections:
        - backend: 13
          credentials:
            - secret_id: storage/random-bucket2/foo
              type: 6
              secret_encoding: 3
          options:
          discover:
            targets:
              - compute-images
              - projects
  vault:
    name: gcp-berglas
    type: gcp-berglas
    options:
      project_id: mondoo-dev-262313

That breaks with discovering assets because the secret isn't resolved by default

[vjeffrey]

👍 thanks for the example!

[czunker]

LGTM. Thanks for all the new assets 🎉

[vjeffrey]

lookin good! do you have a policy ready that we can test this with?

[vjeffrey]

i'm gonna give this another local test after planning this morning so we can get to merging!