Add Alerts, Logging, Channels Factories

fast/stages/0-bootstrap/automation.tf

@@ -42,7 +42,11 @@ module "automation-project" {
     org_policies = (
       var.bootstrap_user != null ? null : var.factories_config.org_policies_iac
     )
+    logging_metrics = var.factories_config.logging_metrics
+    channels        = var.factories_config.channels
+    alerts          = var.factories_config.alerts
   }
+  default_alerts_email = var.default_alerts_email
   # human (groups) IAM bindings
   iam_by_principals = {
     (local.principals.gcp-devops) = [

fast/stages/0-bootstrap/billing.tf

@@ -41,7 +41,13 @@ module "billing-export-project" {
   source          = "../../../modules/project"
   count           = local.billing_mode == "org" ? 1 : 0
   billing_account = var.billing_account.id
-  name            = "billing-exp-0"
+  factories_config = {
+    alerts          = var.factories_config.alerts
+    channels        = var.factories_config.channels
+    logging_metrics = var.factories_config.logging_metrics
+  }
+  default_alerts_email = var.default_alerts_email
+  name                 = "billing-exp-0"
   parent = coalesce(
     var.project_parent_ids.billing, "organizations/${var.organization.id}"
   )

fast/stages/0-bootstrap/data/alerts/compliance.yaml

@@ -0,0 +1,151 @@
+route-changes:
+  display_name: "Network Route Changes"
+  combiner: OR
+  alert_strategy:
+    auto_close: 604800s
+  conditions:
+    condition_threshold:
+      comparison: COMPARISON_GT
+      duration: "0s"
+      resource_type: global
+      trigger:
+        count: 1
+      aggregations:
+        per_series_aligner: ALIGN_MEAN
+        cross_series_reducer: REDUCE_COUNT
+        alignment_period: "600s"
+  notification_channels:
+    compliance-default
+
+network-firewall-config-changes:
+  display_name: "VPC Network Firewall Changes"
+  combiner: OR
+  alert_strategy:
+      auto_close: 604800s
+  conditions:
+    condition_threshold:
+      comparison: COMPARISON_GT
+      duration: "0s"
+      resource_type: global
+      trigger:
+          count: 1
+      aggregations:
+          per_series_aligner: ALIGN_MEAN
+          cross_series_reducer: REDUCE_COUNT
+          alignment_period: "600s"
+  notification_channels:
+      compliance-default
+
+vpc-network-config-changes:
+  display_name: "VPC Network Changes"
+  combiner: OR
+  alert_strategy:
+      auto_close: 604800s
+  conditions:
+    condition_threshold:
+      comparison: COMPARISON_GT
+      duration: "0s"
+      resource_type: global
+      trigger:
+          count: 1
+      aggregations:
+          per_series_aligner: ALIGN_MEAN
+          cross_series_reducer: REDUCE_COUNT
+          alignment_period: "600s"
+  notification_channels:
+      compliance-default
+
+cloudsql-changes:
+  display_name: "CloudSQL Changes"
+  combiner: OR
+  alert_strategy:
+      auto_close: 604800s
+  conditions:
+    condition_threshold:
+      comparison: COMPARISON_GT
+      duration: "0s"
+      resource_type: global
+      trigger:
+          count: 1
+      aggregations:
+          per_series_aligner: ALIGN_MEAN
+          cross_series_reducer: REDUCE_COUNT
+          alignment_period: "600s"
+  notification_channels:
+      compliance-default
+
+cloudstorage-changes:
+  display_name: "Cloud Storage Changes"
+  combiner: OR
+  alert_strategy:
+      auto_close: 604800s
+  conditions:
+    condition_threshold:
+      comparison: COMPARISON_GT
+      duration: "0s"
+      resource_type: "gcs_bucket"
+      trigger:
+          count: 1
+      aggregations:
+          per_series_aligner: ALIGN_MEAN
+          cross_series_reducer: REDUCE_COUNT
+          alignment_period: "600s"
+  notification_channels:
+      compliance-default
+
+customrole-changes:
+  display_name: "IAM Custom Role Changes"
+  combiner: OR
+  alert_strategy:
+      auto_close: 604800s
+  conditions:
+    condition_threshold:
+        comparison: COMPARISON_GT
+        duration: "0s"
+        resource_type: global
+        trigger:
+            count: 1
+        aggregations:
+            per_series_aligner: ALIGN_MEAN
+            cross_series_reducer: REDUCE_COUNT
+            alignment_period: "600s"
+  notification_channels:
+      compliance-default
+
+audit-changes:
+  display_name: "Audit Configuration Changes"
+  combiner: OR
+  alert_strategy:
+      auto_close: 604800s
+  conditions:
+    condition_threshold:
+      comparison: COMPARISON_GT
+      duration: "0s"
+      resource_type: global
+      trigger:
+          count: 1
+      aggregations:
+          per_series_aligner: ALIGN_MEAN
+          cross_series_reducer: REDUCE_COUNT
+          alignment_period: "600s"
+  notification_channels:
+      compliance-default
+
+iam-owner-changes:
+  display_name: "Owner IAM Configuration Changes"
+  combiner: OR
+  alert_strategy:
+      auto_close: 604800s
+  conditions:
+    condition_threshold:
+      comparison: COMPARISON_GT
+      duration: "0s"
+      resource_type: global
+      trigger:
+          count: 1
+      aggregations:
+          per_series_aligner: ALIGN_DELTA
+          cross_series_reducer: REDUCE_SUM
+          alignment_period: "600s"
+  notification_channels:
+      compliance-default

fast/stages/0-bootstrap/data/channels/compliance.yaml

@@ -0,0 +1,6 @@
+compliance-default:
+  type: email
+  display_name: "Default Email Notifications"
+  email_address: [email protected]
+  labels:
+    email_address: "[email protected]"

fast/stages/0-bootstrap/data/logging-alerts/compliance-alerts.yaml

@@ -0,0 +1,13 @@
+
+
+iam-owner-changes:
+  display_name: "Owner IAM Configuration Changes"
+  condition_threshold:
+    comparison: COMPARISON_GT
+    duration: "0s"
+  trigger_count: 1
+  combiner: OR
+  aggregations:
+      per_series_aligner: ALIGN_DELTA
+      cross_series_reducer: REDUCE_SUM
+      alignment_period: "600s"

fast/stages/0-bootstrap/data/logging-metrics/compliance.yaml

@@ -0,0 +1,55 @@
+route-changes:
+  description: "Monitor VPC network route configuration changes inside GCP projects"
+  filter: "resource.type=\"gce_route\" AND (protoPayload.methodName:\"compute.routes.delete\" OR protoPayload.methodName:\"compute.routes.insert\")"
+  metric_descriptor:
+    metric_kind: DELTA
+    value_type: "INT64"
+
+network-firewall-config-changes:
+  description: "Monitor VPC network firewall configuration changes inside GCP projects"
+  filter: "resource.type=\"gce_firewall_rule\" AND (protoPayload.methodName:\"compute.firewalls.delete\" OR protoPayload.methodName:\"compute.firewalls.insert\")"
+  metric_descriptor:
+    metric_kind: DELTA
+    value_type: "INT64"
+
+vpc-network-config-changes:
+  description: "Monitor VPC network configuration changes inside GCP projects"
+  filter: "resource.type=\"gce_network\" AND (protoPayload.methodName:\"compute.networks.insert\" OR protoPayload.methodName:\"compute.networks.patch\" OR protoPayload.methodName:\"compute.networks.delete\" OR protoPayload.methodName:\"compute.networks.removePeering\" OR protoPayload.methodName:\"compute.networks.addPeering\")"
+  metric_descriptor:
+    metric_kind: DELTA
+    value_type: "INT64"
+
+cloudsql-changes:
+  description: "Monitor CloudSQL configuration changes inside GCP projects"
+  filter: "protoPayload.methodName=\"cloudsql.instances.update\" OR protoPayload.methodName=\"cloudsql.instances.create\" OR protoPayload.methodName=\"cloudsql.instances.delete\""
+  metric_descriptor:
+    metric_kind: DELTA
+    value_type: "INT64"
+
+cloudstorage-changes:
+  description: "Monitor Cloud Storage configuration changes inside GCP projects"
+  filter: "resource.type=gcs_bucket AND protoPayload.methodName=\"storage.setIamPermissions\""
+  metric_descriptor:
+    metric_kind: DELTA
+    value_type: "INT64"
+
+customrole-changes:
+  description: "Monitor IAM Custom Role configuration changes inside GCP projects"
+  filter: "resource.type=\"iam_role\" AND (protoPayload.methodName=\"google.iam.admin.v1.CreateRole\" OR protoPayload.methodName=\"google.iam.admin.v1.DeleteRole\" OR protoPayload.methodName=\"google.iam.admin.v1.UpdateRole\")"
+  metric_descriptor:
+    metric_kind: DELTA
+    value_type: "INT64"
+
+audit-changes:
+  description: "Monitor Audit configuration changes inside GCP projects"
+  filter: "protoPayload.methodName=\"SetIamPolicy\" AND protoPayload.serviceData.policyDelta.auditConfigDeltas:*"
+  metric_descriptor:
+    metric_kind: DELTA
+    value_type: "INT64"
+
+iam-owner-changes:
+  description: "Monitor IAM Owner configuration changes inside GCP projects"
+  filter: "(protoPayload.serviceName=\"cloudresourcemanager.googleapis.com\") AND (ProjectOwnership OR projectOwnerInvitee) OR (protoPayload.serviceData.policyDelta.bindingDeltas.action=\"REMOVE\" AND protoPayload.serviceData.policyDelta.bindingDeltas.role=\"roles/owner\") OR (protoPayload.serviceData.policyDelta.bindingDeltas.action=\"ADD\" AND protoPayload.serviceData.policyDelta.bindingDeltas.role=\"roles/owner\")"
+  metric_descriptor:
+    metric_kind: DELTA
+    value_type: "INT64"

fast/stages/0-bootstrap/log-export.tf

@@ -42,8 +42,14 @@ module "log-export-project" {
   parent = coalesce(
     var.project_parent_ids.logging, "organizations/${var.organization.id}"
   )
-  prefix          = local.prefix
-  billing_account = var.billing_account.id
+  factories_config = {
+    alerts          = var.factories_config.alerts
+    channels        = var.factories_config.channels
+    logging_metrics = var.factories_config.logging_metrics
+  }
+  default_alerts_email = var.default_alerts_email
+  prefix               = local.prefix
+  billing_account      = var.billing_account.id
   contacts = (
     var.bootstrap_user != null || var.essential_contacts == null
     ? {}

fast/stages/0-bootstrap/outputs.tf

@@ -23,7 +23,7 @@ locals {
         # If users give a list of custom audiences we set by default the first element.
         # If no audiences are given, we set https://iam.googleapis.com/{PROVIDER_NAME}
         audiences = try(
-          local.cicd_providers[v["identity_provider"]].audiences, ""
+          local.cicd_providers[v["identity_provider"]].audiences, "e"
         )
         identity_provider = try(
           local.cicd_providers[v["identity_provider"]].name, ""
@@ -109,6 +109,7 @@ locals {
         vpcsc       = module.automation-tf-vpcsc-sa.email
         vpcsc-r     = module.automation-tf-vpcsc-r-sa.email
       }
+      default_alerts_email = var.default_alerts_email
     }
     custom_roles = module.organization.custom_role_id
     logging = {
@@ -216,8 +217,8 @@ output "tfvars" {
 
 output "tfvars_globals" {
   description = "Terraform Globals variable files for the following stages."
-  sensitive   = true
-  value       = local.tfvars_globals
+  sensitive   = false
+  value       = jsonencode(local.tfvars_globals)
 }
 
 output "workforce_identity_pool" {

fast/stages/0-bootstrap/terraform.tfvars.sample

@@ -23,3 +23,5 @@ outputs_location = "~/fast-config"
 
 # use something unique and no longer than 9 characters
 prefix = "abcd"
+
+default_alerts_email = "[email protected]"

fast/stages/0-bootstrap/variables.tf

@@ -91,6 +91,12 @@ variable "custom_roles" {
   default     = {}
 }
 
+variable "default_alerts_email" {
+  description = "Default email address for alerting."
+  type        = string
+  nullable    = false
+}
+
 variable "environments" {
   description = "Environment names."
   type = map(object({
@@ -136,11 +142,13 @@ variable "factories_config" {
     custom_roles     = optional(string, "data/custom-roles")
     org_policies     = optional(string, "data/org-policies")
     org_policies_iac = optional(string, "data/org-policies-iac")
+    logging_metrics  = optional(string, "data/logging-metrics")
+    channels         = optional(string, "data/channels")
+    alerts           = optional(string, "data/alerts")
   })
   nullable = false
   default  = {}
 }
-
 variable "groups" {
   # https://cloud.google.com/docs/enterprise/setup-checklist
   description = "Group names or IAM-format principals to grant organization-level permissions. If just the name is provided, the 'group:' principal and organization domain are interpolated."