def move_generated_fields_out_of_projects(input_yaml_path): """Move generated_fields out of projects.""" overall = utils.load_config(input_yaml_path) if GENERATED_FIELDS_NAME in overall: if is_old_generated_fields_format_exist(overall): raise utils.InvalidConfigError( 'Generated fields conflict between new and old format.') return False convert_old_generated_fields_to_new(overall) if GENERATED_FIELDS_NAME in overall: if utils.wait_for_yes_no( 'Move generated_fields out of projects [y/N]?'): utils.write_yaml_file(overall, input_yaml_path) return True return False
def create_stackdriver_account(config): """Prompts the user to create a new Stackdriver Account.""" # Creating a Stackdriver account cannot be done automatically, so ask the # user to create one. if 'stackdriver_alert_email' not in config.project: logging.warning( 'No Stackdriver alert email specified, skipping creation ' 'of Stackdriver account.') return logging.info('Creating Stackdriver account.') project_id = config.project['project_id'] message = """ ------------------------------------------------------------------------------ To create email alerts, this project needs a Stackdriver account. Create a new Stackdriver account for this project by visiting: https://console.cloud.google.com/monitoring?project={} Only add this project, and skip steps for adding additional GCP or AWS projects. You don't need to install Stackdriver Agents. IMPORTANT: Wait about 5 minutes for the account to be created. For more information, see: https://cloud.google.com/monitoring/accounts/ After the account is created, enter [Y] to continue, or enter [N] to skip the creation of Stackdriver alerts. ------------------------------------------------------------------------------ """.format(project_id) print(message) # Keep trying until Stackdriver account is ready, or user skips. while True: if not utils.wait_for_yes_no('Account created [y/N]?'): logging.warning('Skipping creation of Stackdriver Account.') return # Verify account was created. try: runner.run_gcloud_command( ['alpha', 'monitoring', 'policies', 'list'], project_id=project_id) return except subprocess.CalledProcessError as e: logging.error('Error reading Stackdriver account %s', e) print('Could not find Stackdriver account.')
def create_stackdriver_account(config): """Prompts the user to create a new Stackdriver Account.""" # Creating a Stackdriver account cannot be done automatically, so ask the # user to create one. if 'stackdriver_alert_email' not in config.project: logging.warning( 'No Stackdriver alert email specified, skipping creation ' 'of Stackdriver account.') return project_id = config.project['project_id'] if _stackdriver_account_exists(project_id): logging.info('Stackdriver account already exists') return message = """ ------------------------------------------------------------------------------ To create email alerts, this project needs a Stackdriver account. Create a new Stackdriver account for this project by visiting: https://console.cloud.google.com/monitoring?project={} Only add this project, and skip steps for adding additional GCP or AWS projects. You don't need to install Stackdriver Agents. IMPORTANT: Wait about 5 minutes for the account to be created. For more information, see: https://cloud.google.com/monitoring/accounts/ After the account is created, enter [Y] to continue, or enter [N] to skip the creation of Stackdriver alerts. ------------------------------------------------------------------------------ """.format(project_id) print(message) # Keep trying until Stackdriver account is ready, or user skips. while True: if not utils.wait_for_yes_no('Account created [y/N]?'): logging.warning('Skipping creation of Stackdriver Account.') break if _stackdriver_account_exists(project_id): break
def main(argv): del argv # Unused. if FLAGS.enable_new_style_resources: logging.info('--enable_new_style_resources is true.') FLAGS.output_yaml_path = utils.normalize_path(FLAGS.output_yaml_path) FLAGS.output_cleanup_path = utils.normalize_path(FLAGS.output_cleanup_path) if FLAGS.output_rules_path: FLAGS.output_rules_path = utils.normalize_path(FLAGS.output_rules_path) FLAGS.project_yaml = utils.normalize_path(FLAGS.project_yaml) if field_generation.move_generated_fields_out_of_projects(FLAGS.project_yaml): if FLAGS.dry_run: logging.error( 'Must convert generated fields in nodry_run before running!') return elif not utils.wait_for_yes_no( 'Use converted generated fields to continue? [y/N]?'): return # Read and parse the project configuration YAML file. root_config = utils.load_config(FLAGS.project_yaml) if not root_config: logging.error('Error loading project YAML.') return logging.info('Validating project YAML against schema.') try: utils.validate_config_yaml(root_config) except jsonschema.exceptions.ValidationError as e: logging.error('Error in YAML config: %s', e) return with open(FLAGS.output_cleanup_path, 'w') as f: f.write(_CLEANUP_HEADER) want_projects = set(FLAGS.projects) def want_project(project_config_dict): if not project_config_dict: return False return want_projects == { '*' } or project_config_dict['project_id'] in want_projects projects = [] audit_logs_project = root_config.get('audit_logs_project') # Always deploy the remote audit logs project first (if present). if want_project(audit_logs_project): projects.append( ProjectConfig( root=root_config, project=audit_logs_project, audit_logs_project=None, extra_steps=[])) forseti_config = root_config.get('forseti') if forseti_config and want_project(forseti_config['project']): extra_steps = [ Step( func=install_forseti, description='Install Forseti', updatable=False, ), get_forseti_access_granter_step( forseti_config['project']['project_id']), ] if audit_logs_project: extra_steps.append( get_forseti_access_granter_step(audit_logs_project['project_id'])) forseti_project_config = ProjectConfig( root=root_config, project=forseti_config['project'], audit_logs_project=audit_logs_project, extra_steps=extra_steps) projects.append(forseti_project_config) for project_config in root_config.get('projects', []): if not want_project(project_config): continue extra_steps = [] if forseti_config: extra_steps.append( get_forseti_access_granter_step(project_config['project_id'])) projects.append( ProjectConfig( root=root_config, project=project_config, audit_logs_project=audit_logs_project, extra_steps=extra_steps)) validate_project_configs(root_config['overall'], projects) logging.info('Found %d projects to deploy', len(projects)) for config in projects: logging.info('Setting up project %s', config.project['project_id']) if not setup_project(config, FLAGS.project_yaml, FLAGS.output_yaml_path, FLAGS.output_cleanup_path): # Don't attempt to deploy additional projects if one project failed. return if forseti_config: if FLAGS.enable_new_style_resources: call = [ FLAGS.rule_generator_binary, '--project_yaml_path', FLAGS.project_yaml, '--output_path', FLAGS.output_rules_path or '', ] logging.info('Running rule generator: %s', call) subprocess.check_call(call) else: rule_generator.run(root_config, output_path=FLAGS.output_rules_path) logging.info( 'All projects successfully deployed. Please remember to sync ' 'any changes written to the config at --output_yaml_path with ' '--project_yaml before running the script again (Note: only applicable ' 'if --output_yaml_path != --project_yaml)')