Promote from BLAIS5-4644 to main

lib/filters/service_account_key_filter.py

@@ -0,0 +1,30 @@
+import logging
+import re
+
+from lib.log_processor import ProcessedLogEntry
+
+
+def service_account_key_filter(log_entry: ProcessedLogEntry) -> bool:
+    if not isinstance(log_entry.platform, str):
+        return False
+
+    if log_entry.platform != "service_account":
+        return False
+
+    if not isinstance(log_entry.message, str):
+        return False
+
+    if log_entry.severity != "ERROR":
+        return False
+
+    if ("Service account key" and "does not exist.") not in log_entry.message:
+        return False
+
+    account_key_pattern = r"[a-fA-F0-9]{40}"
+    pattern = rf"Service account key {account_key_pattern} does not exist\."
+
+    if not re.search(pattern, log_entry.message):
+        return False
+
+    logging.info(f"Skipping service account key alert")
+    return True

lib/send_alerts.py

@@ -34,6 +34,7 @@
 from lib.filters.bootstrapper_filter import bootstrapper_filter
 from lib.filters.generic_not_found_filter import generic_not_found_filter
 from lib.filters.socket_exception_filter import socket_exception_filter
+from lib.filters.service_account_key_filter import service_account_key_filter
 
 
 def log_entry_skipped(log_entry: ProcessedLogEntry):
@@ -54,6 +55,7 @@ def log_entry_skipped(log_entry: ProcessedLogEntry):
         bootstrapper_filter,
         generic_not_found_filter,
         socket_exception_filter,
+        service_account_key_filter,
     ]
 
     for filter in filters:

pyproject.toml

@@ -1,5 +1,5 @@
 [tool.poetry]
-name = "blaise-slack-alerter"
+name = "blaise_slack_alerter"
 version = "0.1.0"
 description = ""
 authors = ["Tom Oram <tom.oram@armakuni.com>"]

tests/lib/filters/test_service_account_key_filter.py

@@ -0,0 +1,105 @@
+import pytest
+import datetime
+import dataclasses
+
+from lib.log_processor import ProcessedLogEntry
+from lib.filters.service_account_key_filter import service_account_key_filter
+
+
+@pytest.fixture()
+def processed_service_account_key_error() -> ProcessedLogEntry:
+    return ProcessedLogEntry(
+        message="Service account key 8fb56338d14c4624c7687dfd50ad4b66357d224a does not exist.",
+        data=dict(description="dummy"),
+        severity="ERROR",
+        platform="service_account",
+        application="unknown",
+        log_name="projects/ons-blaise-v2-prod/logs/run.googleapis.com%2Fstderr",
+        timestamp=datetime.datetime(2023, 2, 25, 3, 46, 57, 99633),
+        log_query={
+            "resource.type": "service_account",
+            "resource.labels.instance_id": "458491777778639951",
+        },
+    )
+
+
+def test_log_is_skipped_when_its_from_service_account_when_service_account_key_error(
+    processed_service_account_key_error: ProcessedLogEntry,
+):
+    log_is_skipped = service_account_key_filter(processed_service_account_key_error)
+    assert log_is_skipped is True
+
+
+def test_log_message_is_not_a_string_when_service_account_key_error(
+    processed_service_account_key_error: ProcessedLogEntry,
+):
+    processed_service_account_key_error = dataclasses.replace(
+        processed_service_account_key_error, message=1234
+    )
+    log_is_skipped = service_account_key_filter(processed_service_account_key_error)
+
+    assert log_is_skipped is False
+
+
+def test_log_message_is_not_skipped_when_it_contains_severity_info_for_service_account_key_error(
+    processed_service_account_key_error: ProcessedLogEntry,
+):
+    processed_service_account_key_error = dataclasses.replace(
+        processed_service_account_key_error, severity="INFO"
+    )
+    log_is_skipped = service_account_key_filter(processed_service_account_key_error)
+
+    assert log_is_skipped is False
+
+
+def test_log_message_does_not_contain_service_account_key(
+    processed_service_account_key_error: ProcessedLogEntry,
+):
+    processed_service_account_key_error = dataclasses.replace(
+        processed_service_account_key_error,
+        message="some other message",
+    )
+    log_is_skipped = service_account_key_filter(processed_service_account_key_error)
+    assert log_is_skipped is False
+
+
+@pytest.mark.parametrize(
+    "account_key",
+    [
+        "8fa56330d10b6624c7687ddd50ad4b86347d224a",
+        "f7ade4740059a1f5137bea2ff20b0952f012cf17",
+        "170277cc2e4b598b9d60542b5a17ee3c779e4112",
+        "e8bc6052cdfdb71b7fca130dd9ff815c4b8a6421",
+    ],
+)
+def test_log_message_is_correct_format_for_different_service_account_keys(
+    processed_service_account_key_error: ProcessedLogEntry, account_key: str
+):
+    processed_service_account_key_error = dataclasses.replace(
+        processed_service_account_key_error,
+        message=f"Service account key {account_key} does not exist.",
+    )
+    log_is_skipped = service_account_key_filter(processed_service_account_key_error)
+    assert log_is_skipped is True
+
+
+@pytest.mark.parametrize(
+    "invalid_account_key",
+    [
+        "GFA56330D10B6624C7687DDD50AD4B86347D224A",
+        "1234567890abcdef",
+        "z7ade4740059a1f5137bea2ff20b0952f012cf17",
+        "170277cc2e4b598b9d60542b5a17ee3c779e41122",
+        "service-key-1234567890123456789012345678901234567890",
+    ],
+)
+def test_log_message_is_incorrect_format_for_service_account_key(
+    processed_service_account_key_error: ProcessedLogEntry,
+    invalid_account_key: str,
+):
+    processed_service_account_key_error = dataclasses.replace(
+        processed_service_account_key_error,
+        message=f"Service account key {invalid_account_key} does not exist.",
+    )
+    log_is_skipped = service_account_key_filter(processed_service_account_key_error)
+    assert log_is_skipped is False

tests/test_main.py

@@ -1770,3 +1770,81 @@ def test_skip_socket_exception_alerts(run_slack_alerter, number_of_http_calls, c
         logging.INFO,
         "Skipping socket exception alert",
     ) in caplog.record_tuples
+
+
+def test_skip_service_account_key(run_slack_alerter, number_of_http_calls, caplog):
+    # arrange
+    example_log_entry = {
+        "protoPayload": {
+            "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
+            "status": {
+                "code": "5",
+                "message": "Service account key f7ade4740059a1f5137bea2ff20b0952f012cf17 does not exist.",
+            },
+            "authenticationInfo": {
+                "principalEmail": "scc-dormant-accounts-alert@ons-gcp-monitoring-prod.iam.gserviceaccount.com",
+                "serviceAccountDelegationInfo": [
+                    {
+                        "firstPartyPrincipal": {
+                            "principalEmail": "service-719628633551@serverless-robot-prod.iam.gserviceaccount.com"
+                        }
+                    }
+                ],
+                "principalSubject": "serviceAccount:scc-dormant-accounts-alert@ons-gcp-monitoring-prod.iam.gserviceaccount.com",
+            },
+            "requestMetadata": {
+                "callerIp": "34.34.246.100",
+                "callerSuppliedUserAgent": "grpc-python/1.70.0 grpc-c/45.0.0 (linux; chttp2),gzip(gfe)",
+                "requestAttributes": {
+                    "time": "2025-02-17T01:28:44.251600949Z",
+                    "auth": {},
+                },
+                "destinationAttributes": {},
+            },
+            "serviceName": "iam.googleapis.com",
+            "methodName": "google.iam.admin.v1.GetServiceAccountKey",
+            "authorizationInfo": [
+                {
+                    "resource": "projects/-/serviceAccounts/110247389061820088971",
+                    "permission": "iam.serviceAccountKeys.get",
+                    "granted": "true",
+                    "resourceAttributes": {
+                        "name": "projects/-/serviceAccounts/110247389061820088971"
+                    },
+                    "permissionType": "ADMIN_READ",
+                }
+            ],
+            "resourceName": "projects/-/serviceAccounts/110247389061820088971/keys/f7ade4740059a1f5137bea2ff20b0952f012cf17",
+            "request": {
+                "name": "projects/ons-blaise-v2-prod/serviceAccounts/628324858917-compute@developer.gserviceaccount.com/keys/f7ade4740059a1f5137bea2ff20b0952f012cf17",
+                "@type": "type.googleapis.com/google.iam.admin.v1.GetServiceAccountKeyRequest",
+            },
+        },
+        "insertId": "10cyfzcf1hve2j",
+        "resource": {
+            "type": "service_account",
+            "labels": {
+                "email_id": "628324858917-compute@developer.gserviceaccount.com",
+                "project_id": "ons-blaise-v2-prod",
+                "unique_id": "110247389061820088971",
+            },
+        },
+        "timestamp": "2025-02-17T01:28:44.233811231Z",
+        "severity": "ERROR",
+        "logName": "projects/ons-blaise-v2-prod/logs/cloudaudit.googleapis.com%2Fdata_access",
+        "receiveTimestamp": "2025-02-17T01:28:45.898607418Z",
+    }
+    event = create_event(example_log_entry)
+
+    # act
+    with caplog.at_level(logging.INFO):
+        response = run_slack_alerter(event)
+
+    # assert
+    assert response == "Alert skipped"
+    assert number_of_http_calls() == 0
+    assert (
+        "root",
+        logging.INFO,
+        "Skipping service account key alert",
+    ) in caplog.record_tuples