GoogleCloudPlatform / security-response-automation

Take automated actions against threats and vulnerabilities.
Apache License 2.0
208 stars 52 forks source link

SCC SHA Findings removed sourceProperties.projectId field #205

Open daniel-cit opened 3 years ago

daniel-cit commented 3 years ago

Looking at real findings in the Security Command Center, as of 2021-04-14, we can see that the field ProjectId in the SHA findings:

SourceProperties.ProjectId = "PROJECT_ID"

has been removed.

The parsing of the SHA findings needs to be updated to extract the project id from the ResourcePath property

SourceProperties.ResourcePath = [ "projects/PROJECT_ID/", "folders/0000000000000/", "organizations/0000000000000/" ]

Without this fix, all the SHA remediations will miss the project id and will fail at the check to see if the project is allowed for remediation.