google.cloud.forseti.scanner.audit.iap_rules_engine module

Rules engine for IAP policies on backend services.

class IapRuleBook(global_configs, rule_defs=None, snapshot_timestamp=None)[source]

Bases: google.cloud.forseti.scanner.audit.base_rules_engine.BaseRuleBook

The RuleBook for enforcing IAP policy on backend service resources.

_abc_cache = <_weakrefset.WeakSet object>
_abc_negative_cache = <_weakrefset.WeakSet object>
_abc_negative_cache_version = 203
_abc_registry = <_weakrefset.WeakSet object>
add_rule(rule_def, rule_index)[source]

Add a rule to the rule book.

Parameters:
  • rule_def (dict) – rule definition properties
  • rule_index (int) – index of the rule from the rule definitions, assigned automatically when the rule book is built
add_rules(rule_defs)[source]

Add rules to the rule book.

Parameters:rule_defs (list) – rule definition property dicts
find_violations(iap_resource)[source]

Find violations in the rule book.

Parameters:iap_resource (IapResource) – IAP data
Returns:RuleViolation
Return type:list
get_resource_rules(resource)[source]

Get all the resource rules for (resource, RuleAppliesTo.*).

Parameters:resource (Resource) – The gcp_type Resource find in the map.
Returns:ResourceRules
Return type:list
class IapRulesEngine(rules_file_path, snapshot_timestamp=None)[source]

Bases: google.cloud.forseti.scanner.audit.base_rules_engine.BaseRulesEngine

Rules engine for applying IAP policies to backend services

add_rules(rules)[source]

Add rules to the rule book.

Parameters:rules (list) – dicts defining the rules to add
build_rule_book(global_configs)[source]

Build IapRuleBook from the rules definition file.

Parameters:global_configs (dict) – Global configurations.
find_violations(iap_resource)[source]

Determine whether IAP-related settings violate rules.

Parameters:iap_resource (IapResource) – IAP resource data
Returns:RuleViolation
Return type:list
class ResourceRules(resource=None, rules=None, applies_to='self', inherit_from_parents=False)[source]

Bases: object

An association of a resource to rules.

__eq__(other)[source]

Compare == with another object.

Parameters:other (ResourceRules) – object to compare with
Returns:comparison result
Return type:int
__ne__(other)[source]

Compare != with another object.

Parameters:other (object) – object to compare with
Returns:comparison result
Return type:int
__repr__()[source]

String representation of this node.

Returns:debug string
Return type:str
find_mismatches(resource, iap_resource)[source]

Determine if the policy binding matches this rule’s criteria.

Parameters:
Returns:

RuleViolation

Return type:

list

class Rule(rule_name, rule_index, allowed_alternate_services, allowed_direct_access_sources, allowed_iap_enabled)[source]

Bases: object

Rule properties from the rule definition file.

Also finds violations.

__eq__(other)[source]

Test whether Rule equals other Rule.

Parameters:other (Rule) – object to compare to
Returns:comparison result
Return type:int
__hash__()[source]

Make a hash of the rule index.

For now, this will suffice since the rule index is assigned automatically when the rules map is built, and the scanner only handles one rule file at a time. Later on, we’ll need to revisit this hash method when we process multiple rule files.

Returns:The hash of the rule index.
Return type:int
__ne__(other)[source]

Test whether Rule is not equal to another Rule.

Parameters:other (object) – object to compare to
Returns:comparison result
Return type:int
__repr__()[source]

String representation of this node.

Returns:debug string
Return type:str
find_mismatches(resource, iap_resource)[source]

Find IAP policy violations in the rule book.

Parameters:
Returns:

IAP violations

Return type:

RuleViolation

class RuleViolation(resource_type, resource_id, full_name, resource_name, rule_name, rule_index, violation_type, alternate_services_violations, iap_enabled_violation, direct_access_sources_violations, resource_data)

Bases: tuple

__getnewargs__()

Return self as a plain tuple. Used by copy and pickle.

__getstate__()

Exclude the OrderedDict from pickling

__repr__()

Return a nicely formatted representation string

_asdict()

Return a new OrderedDict which maps field names to their values

_fields = ('resource_type', 'resource_id', 'full_name', 'resource_name', 'rule_name', 'rule_index', 'violation_type', 'alternate_services_violations', 'iap_enabled_violation', 'direct_access_sources_violations', 'resource_data')
classmethod _make(iterable, new=<built-in method __new__ of type object>, len=<built-in function len>)

Make a new RuleViolation object from a sequence or iterable

_replace(**kwds)

Return a new RuleViolation object replacing specified fields with new values

alternate_services_violations
direct_access_sources_violations
full_name
iap_enabled_violation
resource_data
resource_id
resource_name
resource_type
rule_index
rule_name
violation_type