Merge pull request #24 from cloudgraphdev/alpha

Beta release

Author: tyler-dunkel

CHANGELOG.md

@@ -1,3 +1,19 @@
+# [0.37.0-alpha.1](https://github.com/cloudgraphdev/cloudgraph-provider-gcp/compare/0.36.0...0.37.0-alpha.1) (2022-12-28)
+
+
+### Features
+
+* **CG-1320:** add gcp access approval service support ([65b8852](https://github.com/cloudgraphdev/cloudgraph-provider-gcp/commit/65b8852463220f902dc65ced2c8b0f798593bda6))
+
+# [0.36.0](https://github.com/cloudgraphdev/cloudgraph-provider-gcp/compare/0.35.1...0.36.0) (2022-12-12)
+
+
+### Features
+
+* **CG-1312:** add essential contacts ([305da4f](https://github.com/cloudgraphdev/cloudgraph-provider-gcp/commit/305da4fa52a319b36a07a141dae2eb1a5572079e))
+* **CG-1312:** remove a debug text ([4bc8b5b](https://github.com/cloudgraphdev/cloudgraph-provider-gcp/commit/4bc8b5bfad7702945d5fe6e8891c53d64c7337a4))
+* **CG-1312:** update fetch data and README ([07d58db](https://github.com/cloudgraphdev/cloudgraph-provider-gcp/commit/07d58db8db3a1e55aaf18a4fd55959170b8012fa))
+
 # [0.36.0-beta.1](https://github.com/cloudgraphdev/cloudgraph-provider-gcp/compare/0.35.1...0.36.0-beta.1) (2022-12-12)
 
 

README.md

@@ -64,6 +64,7 @@ CloudGraph GCP Provider will ask you what regions you would like to crawl and wi
 
 | Service                               | Relations                                                                                                                           |
 | ------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
+| accessApproval                        | project                                                                                                                             |
 | aiPlatformNotebooks                   | project, kmsCryptoKeys, network, subnet                                                                                             |
 | alertPolicy                           | project                                                                                                                             |
 | apiGatewayGateways                    | project, apiGatewayApis, apiGatewayApiConfigs                                                                                       |

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudgraph/cg-provider-gcp",
-  "version": "0.36.0-beta.1",
+  "version": "0.37.0-alpha.1",
   "description": "CloudGraph provider plugin for GCP used to fetch GCP cloud data.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
@@ -32,6 +32,7 @@
   },
   "dependencies": {
     "@cloudgraph/sdk": "0.22.1",
+    "@google-cloud/access-approval": "^2.1.2",
     "@google-cloud/api-gateway": "^1.2.1",
     "@google-cloud/asset": "^3.22.0",
     "@google-cloud/bigquery": "^5.10.0",

src/enums/schemasMap.ts

@@ -54,5 +54,6 @@ export default {
   [services.apiGatewayApiConfig]: 'gcpApiGatewayApiConfig',
   [services.firestoreDatabase]: 'gcpFirestoreDatabase',
   [services.essentialContacts]: 'gcpEssentialContact',
+  [services.accessApproval]: 'gcpAccessApproval',
   tag: 'gcpTag',
 }

src/enums/serviceMap.ts

@@ -51,6 +51,7 @@ import GcpLabel from '../services/label'
 import GcpTag from '../services/tag'
 import GcpBilling from '../services/billing'
 import GcpEssentialContacts from '../services/essentialContacts'
+import GcpAccessApproval from '../services/accessApproval'
 
 /**
  * serviceMap is an object that contains all currently supported services
@@ -107,6 +108,7 @@ export default {
   [services.apiGatewayApiConfig]: GcpApiGatewayApiConfig,
   [services.firestoreDatabase]: GcpFirestoreDatabase,
   [services.essentialContacts]: GcpEssentialContacts,
+  [services.accessApproval]: GcpAccessApproval,
   label: GcpLabel,
   tag: GcpTag,
 }

src/enums/services.ts

@@ -55,7 +55,7 @@ export default {
   // spanner: 'spanner',
   // activeDirectory: 'active-directory',
   // identity: 'identity',
-  // accessApproval: 'access-approval',
+  accessApproval: 'accessApproval',
   // accessContextManager: 'access-context-manager',
   // auth: 'auth',
   folder: 'folder',

src/services/accessApproval/data.ts

@@ -0,0 +1,55 @@
+import { AccessApprovalClient } from '@google-cloud/access-approval'
+import { google } from '@google-cloud/access-approval/build/protos/protos'
+import CloudGraph from '@cloudgraph/sdk'
+import groupBy from 'lodash/groupBy'
+import gcpLoggerText from '../../properties/logger'
+import { GcpServiceInput } from '../../types'
+import { initTestEndpoint, generateGcpErrorLog } from '../../utils'
+import { GLOBAL_REGION } from '../../config/constants'
+
+const lt = { ...gcpLoggerText }
+const { logger } = CloudGraph
+const serviceName = 'AccessApproval'
+const apiEndpoint = initTestEndpoint(serviceName)
+
+export interface RawGcpAccessApproval extends google.cloud.accessapproval.v1.IApprovalRequest {
+  id: string
+  projectId: string
+  region: string
+}
+
+export default async ({
+  config,
+}: GcpServiceInput): Promise<{
+  [region: string]: RawGcpAccessApproval[]
+}> =>
+  new Promise(async resolve => {
+    const accessApprovalList: RawGcpAccessApproval[] = []
+    const { projectId } = config
+
+    /**
+     * Get all EssentialContacts
+     */
+    try {
+      const accessApprovalClient = new AccessApprovalClient({ ...config, apiEndpoint });
+      const iterable = accessApprovalClient.listApprovalRequestsAsync({
+        parent: `projects/${projectId}`,
+      })
+
+      for await (const response of iterable) {
+        if (response) {
+          accessApprovalList.push({
+            id: response.name,
+            projectId,
+            region: GLOBAL_REGION,
+            ...response,
+          })
+        }
+      }
+    } catch (error) {
+      generateGcpErrorLog(serviceName, 'accessApproval:listApprovalRequestsAsync', error)
+    }
+    
+    logger.debug(lt.foundResources(serviceName, accessApprovalList.length))
+    resolve(groupBy(accessApprovalList, 'region'))
+  })

src/services/accessApproval/format.ts

@@ -0,0 +1,63 @@
+import { google } from '@google-cloud/access-approval/build/protos/protos'
+import { GcpAccessApproval } from '../../types/generated'
+import { RawGcpAccessApproval } from './data'
+import { toISOString } from '../../utils/dateutils'
+import { enumKeyToString } from '../../utils/format'
+
+export default ({
+  service,
+}: {
+  service: RawGcpAccessApproval
+  region: string
+}): GcpAccessApproval => {
+  const {
+    id,
+    projectId,
+    region,
+    name,
+    requestedResourceName,
+    requestedResourceProperties,
+    requestedReason,
+    requestedLocations,
+    requestTime,
+    requestedExpiration,
+    approve,
+    dismiss,
+  } = service
+
+  return {
+    id,
+    projectId,
+    region,
+    name,
+    requestedResourceName,
+    requestedResourceProperties: {
+      excludesDescendants: requestedResourceProperties?.excludesDescendants,
+    },
+    requestedReason: {
+      type: enumKeyToString(google.cloud.accessapproval.v1.AccessReason.Type, requestedReason?.type),
+      detail: requestedReason?.detail,
+    },
+    requestedLocations: {
+      principalOfficeCountry: requestedLocations?.principalOfficeCountry,
+      principalPhysicalLocationCountry: requestedLocations?.principalPhysicalLocationCountry,
+    },
+    requestTime: toISOString(requestTime?.seconds?.toString()),
+    requestedExpiration: toISOString(requestedExpiration?.seconds?.toString()),
+    approve: {
+      approveTime: toISOString(approve.approveTime?.seconds?.toString()),
+      expireTime: toISOString(approve.expireTime?.seconds?.toString()),
+      invalidateTime: toISOString(approve.invalidateTime?.seconds?.toString()),
+      signatureInfo: {
+        signature: approve?.signatureInfo?.signature ? String.fromCharCode.apply(approve?.signatureInfo?.signature) : '',
+        googlePublicKeyPem: approve?.signatureInfo?.googlePublicKeyPem,
+        customerKmsKeyVersion: approve?.signatureInfo?.customerKmsKeyVersion,
+      },
+      autoApproved: approve?.autoApproved,
+    },
+    dismiss: {
+      dismissTime: toISOString(dismiss.dismissTime?.seconds?.toString()),
+      implicit: dismiss.implicit,
+    },
+  }
+}

src/services/accessApproval/index.ts

@@ -0,0 +1,13 @@
+import { Service } from '@cloudgraph/sdk'
+import BaseService from '../base'
+import format from './format'
+import getData from './data'
+import mutation from './mutation'
+
+export default class GcpAccessApproval extends BaseService implements Service {
+  format = format.bind(this)
+
+  getData = getData.bind(this)
+
+  mutation = mutation
+}

src/services/accessApproval/mutation.ts

@@ -0,0 +1,5 @@
+export default `mutation($input: [AddgcpAccessApprovalInput!]!) {
+  addgcpAccessApproval(input: $input, upsert: true) {
+    numUids
+  }
+}`;