scc_export — version 1.1

Source: presets/scc/scc-export.satz

Purpose

Security Command Center findings, exported to BigQuery as they are raised — where findings are KEPT, as opposed to where they are sent.

A notification tells somebody now; an export answers "what did this organisation look like in March". Both read the same findings, and an estate usually wants both: presets/scc/scc-notifications.satz is the other half.

FOUR RESOURCES, AND THE ORDER MATTERS. The dataset's project needs the BigQuery API, so the pack enables it and takes the dataset's project THROUGH that resource — otherwise the two race on a first apply and the dataset loses. Even then the first apply can fail with "The project … has not enabled BigQuery": the API is on, and BigQuery's own control plane is a minute behind. Run the apply again; it is the same estate either way.

The exporting identity is service-org-<organisation>@gcp-sa-scc-notification.iam.gserviceaccount.com — the same agent that publishes notifications, and the principal the export reports. Security Command Center grants it WRITER on the dataset itself when the export is created; the estate declares the grant anyway, because an access the estate depends on belongs in the estate, and a non-authoritative _iam_member converges with what Google wrote.

The dataset's location is a data-residency decision and cannot be changed afterwards. Where the CIS pack enforces gcp.resourceLocations, a location outside the allowed list is refused at apply — the default follows the estate's own default region, which that list already permits.

CHANGING ONE AFTERWARDS. The export's own fields do not update in place: the provider sends name with the update and the API refuses it. A new description, dataset or filter is applied by replacing the export — satz apply -replace=google_scc_v2_organization_scc_big_query_export.<label> — which keeps the dataset and everything already in it.

NO CLAIM. No catalog control covers Security Command Center, so this pack witnesses nothing.

Use it

params {
  // the pack's own defaults — copy only the lines you change
  scc_export_project = infra_project_name
  scc_export_dataset_id = "{customer_shortname}_scc_findings"
  scc_export_location = default_region
  scc_export_id = "satz-findings"
  scc_export_description = "Security Command Center findings, exported continuously"
  scc_export_filter = "state="ACTIVE""
}

use "presets/scc/scc-export.satz"

Needs from outside the pack:

• customer_organization_id — declared by estate_core; use one of them alongside, or declare it in the estate.
• customer_shortname — declared by estate_core; use one of them alongside, or declare it in the estate.
• default_region — declared by estate_core; use one of them alongside, or declare it in the estate.
• infra_project_name — declared by estate_core; use one of them alongside, or declare it in the estate.

Params

Questions

What to ask before this pack is configured, and what changing the answer costs.

scc_export_project — Whoever can read the dataset can read every finding the organisation has ever raised, including the ones still unfixed. It is also where the BigQuery bill lands.

scc_export_location — A dataset's location cannot change: moving it means a new dataset and copying the history. Findings describe the estate's weaknesses, so where they are stored is a data-residency decision. Where the CIS pack enforces allowed resource locations, a location outside that list is refused.

Contributes

Claims

None — this pack proves no control by itself.

History

The whole library's history: the changelog in presets/CHANGELOG.md.

Notes

No notes yet.