config.yml

# Copyright 2023 Google LLC

# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at

#     https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

terraformState:
  projectId: ""
  region: us-central1

inputs:
  prod:
    projectId: ""
    region: us-central1
    modules:
      # please see /modules/scc-integration/README.md#Inputs for all documented module inputs
      scc-integration:
        log_sync_type: "PROJECT" # Must be either PROJECT or ORGANIZATION (default: ORGANIZATION)
        organization_id: ""
        log_streaming_filter: |
          protoPayload.serviceName="connectgateway.googleapis.com" AND labels."k8s-request-path"=~".*\/exec\?command=.*" and operation.first = true
        findings_config:
          - method: "google.cloud.gkeconnect.gateway.v1.GatewayService.Stream"
            category: "KUBECTL_EXEC"
            severity: "HIGH"
          - method: "DEFAULT"
            category: "NO_CATEGORY_SPECIFIED"
        integration_config:
          available_memory: "128Mi"
          available_cpu: "1"
          timeout_seconds: 10
          max_instance_count: 5
          max_instance_request_concurrency: 100