gcp.log-project-sink

https://cloud.google.com/logging/docs/reference/v2/rest/v2/projects.sinks

Filters

metrics

Supports metrics filters on resources.

All resources that have cloud watch metrics are supported.

Docs on cloud watch metrics

- name: firewall-hit-count
  resource: gcp.firewall
  filters:
    - type: metrics
      name: firewallinsights.googleapis.com/subnet/firewall_hit_count
      aligner: ALIGN_COUNT
      days: 14
      value: 1
      op: greater-than

The period-start key allows you to align the metric window in two ways. By default, using auto, the window is computed relative to the current time. Alternatively, setting it to start-of-day aligns the window to full UTC calendar days, beginning at 00:00:00 UTC and ending at current day 00:00:00 UTC.

- name: instance-low-cpu-last-full-day
  resource: gcp.instance
  filters:
    - type: metrics
      name: compute.googleapis.com/instance/cpu/utilization
      aligner: ALIGN_MEAN
      days: 1
      value: 0.05
      op: less-than
      period-start: start-of-day

properties:
  aligner:
    enum:
    - ALIGN_NONE
    - ALIGN_DELTA
    - ALIGN_RATE
    - ALIGN_INTERPOLATE
    - ALIGN_MIN
    - ALIGN_MAX
    - ALIGN_MEAN
    - ALIGN_COUNT
    - ALIGN_SUM
    - REDUCE_COUNT_FALSE
    - ALIGN_STDDEV
    - ALIGN_COUNT_TRUE
    - ALIGN_COUNT_FALSE
    - ALIGN_FRACTION_TRUE
    - ALIGN_PERCENTILE_99
    - ALIGN_PERCENTILE_95
    - ALIGN_PERCENTILE_50
    - ALIGN_PERCENTILE_05
    - ALIGN_PERCENT_CHANG
    type: string
  days:
    type: number
  filter:
    type: string
  group-by-fields:
    items:
      type: string
    type: array
  metric-key:
    type: string
  missing-value:
    type: number
  name:
    type: string
  op:
    enum:
    - eq
    - equal
    - ne
    - not-equal
    - gt
    - greater-than
    - ge
    - gte
    - le
    - lte
    - lt
    - less-than
    - glob
    - regex
    - regex-case
    - in
    - ni
    - not-in
    - contains
    - difference
    - intersect
    - mod
    type: string
  period-start:
    enum:
    - auto
    - start-of-day
    type: string
  reducer:
    enum:
    - REDUCE_NONE
    - REDUCE_MEAN
    - REDUCE_MIN
    - REDUCE_MAX
    - REDUCE_MEAN
    - REDUCE_SUM
    - REDUCE_STDDEV
    - REDUCE_COUNT
    - REDUCE_COUNT_TRUE
    - REDUCE_COUNT_FALSE
    - REDUCE_FRACTION_TRUE
    - REDUCE_PERCENTILE_99
    - REDUCE_PERCENTILE_95
    - REDUCE_PERCENTILE_50
    - REDUCE_PERCENTILE_05
    type: string
  type:
    enum:
    - metrics
  value:
    type: number
required:
- value
- name
- op

Permissions - monitoring.timeSeries.list

sink-overlap

Match enabled sinks whose effective routing filter is identical to, or overlaps with, at least one other enabled sink targeting the same destination.

A sink’s effective routing is its filter minus its enabled exclusions. match controls how effective routing is compared:

  • overlap (default): two sinks overlap when some log entry could match both. The analyser understands AND/OR/NOT, equality, inequality, and numeric/severity ranges. When a filter also uses comparisons it cannot evaluate, such as : and regular expression matches, global search terms or LOG_ID, sinks that are not provably disjoint are reported as possible matches.

  • exact: effective routing is canonicalized before comparison so that logically equivalent expressions (e.g. different field orderings) are treated as duplicates.

Disabled sinks are ignored. A sink whose effective routing cannot be parsed is logged and left out of overlap comparisons; with exact it only matches sinks with the same filter text. Each matched sink is annotated with the names of the sinks it directly matches under c7n:matched-sinks, and with the names of the sinks it possibly matches under c7n:possible-matched-sinks.

Sinks are only compared with the other sinks that reach this filter, so filters placed before it narrow the comparison. To compare against every sink in the project and then narrow the results, put sink-overlap first.

example:

Find all project sinks whose log routing overlaps, or possibly overlaps, with a sibling sink:

policies:
  - name: gcp-log-project-sink-overlapping
    resource: gcp.log-project-sink
    filters:
      - type: sink-overlap
example:

Find only project sinks whose overlap with a sibling sink is proven:

policies:
  - name: gcp-log-project-sink-proven-overlap
    resource: gcp.log-project-sink
    filters:
      - type: sink-overlap
      - type: value
        key: '"c7n:matched-sinks"'
        value: not-null
example:

Find all project sinks that are exact duplicates of another sink:

policies:
  - name: gcp-log-project-sink-exact-duplicates
    resource: gcp.log-project-sink
    filters:
      - type: sink-overlap
        match: exact

properties:
  match:
    enum:
    - exact
    - overlap
  type:
    enum:
    - sink-overlap
required:
- type

Permissions - logging.sinks.list

Actions

delete

Invoke an api call on each resource.

Quite a number of procedural actions are simply invoking an api call on a filtered set of resources. The exact handling is mostly boilerplate at that point following an 80/20 rule. This class is an encapsulation of the 80%.

properties:
  type:
    enum:
    - delete
required:
- type

Permissions - logging.sinks.delete