Added google_logging_project_sinks resource and helper method to stor…

…age buckets for versioning.

Signed-off-by: Stuart Paterson <spaterson@chef.io>

docs/resources/google_logging_project_sinks.md

@@ -0,0 +1,77 @@
+---
+title: About the google_logging_project_sinks Resource
+platform: gcp
+---
+
+# google\_logging\_project\_sinks
+
+Use the `google_logging_project_sinks` InSpec audit resource to test properties of all, or a filtered group of, GCP compute project logging sinks for a project.
+
+<br>
+
+## Syntax
+
+A `google_logging_project_sinks` resource block collects GCP project logging sinks by project then tests that group.
+
+    describe google_logging_project_sinks(project: 'chef-inspec-gcp') do
+      it { should exist }
+    end    
+
+Use this InSpec resource to enumerate IDs then test in-depth using `google_logging_project_sink`.
+
+    google_logging_project_sinks(project: 'chef-inspec-gcp').sink_names.each do |sink_name|
+      describe google_logging_project_sink(project: 'chef-inspec-gcp',  sink: sink_name) do
+        it { should exist }
+      end
+    end
+
+<br>
+
+## Examples
+
+The following examples show how to use this InSpec audit resource.
+
+### Test that there are no more than a specified number of sinks available for the project
+
+    describe google_logging_project_sinks(project: 'chef-inspec-gcp') do
+      its('count') { should be <= 100}
+    end
+
+### Test that an expected sink name is available for the project
+
+    describe google_logging_project_sinks(project: 'chef-inspec-gcp') do
+      its('sink_names') { should include "my-sink" }
+    end
+
+### Test that an expected sink destination is available for the project
+
+    describe google_logging_project_sinks(project: 'chef-inspec-gcp') do
+      its('sink_destinations') { should include "storage.googleapis.com/a-logging-bucket" }
+    end
+
+### Test that a subset of all sinks matching "project*" have a particular writer identity 
+
+    google_logging_project_sinks(project: 'chef-inspec-gcp').sink_names.each do |sink_name|
+      describe google_logging_project_sink(project: 'chef-inspec-gcp',  sink: sink_name) do
+        its('writer_identity') { should eq "serviceAccount:my-logging-service-account.iam.gserviceaccount.com" }
+      end
+    end
+
+<br>
+
+## Filter Criteria
+
+This resource supports the following filter criteria: `sink_name`; `sink_filter` and `sink_destination`. Any of these may be used with `where`, as a block or as a method.
+
+## Properties
+
+*  `sink_names` - an array of google_logging_project_sink name strings
+*  `sink_destinations`- an array of google_logging_project_sink destinations
+*  `sink_filters`- an array of google_logging_project_sink filters
+
+<br>
+
+
+## GCP Permissions
+
+Ensure the [Stackdriver Logging API](https://console.cloud.google.com/apis/api/logging.googleapis.com/) is enabled for the project.

libraries/google_logging_project_sinks.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require 'gcp_backend'
+
+module Inspec::Resources
+  class GoogleLoggingProjectSinks < GcpResourceBase
+    name 'google_logging_project_sinks'
+    desc 'Verifies settings for GCP project logging sinks in bulk'
+
+    example "
+      describe google_logging_project_sinks(project: 'chef-inspec-gcp') do
+        it { should exist }
+      end
+    "
+
+    def initialize(opts = {})
+      # Call the parent class constructor
+      super(opts)
+      @project = opts[:project]
+    end
+
+    # FilterTable setup
+    filter_table_config = FilterTable.create
+    filter_table_config.add(:sink_names, field: :sink_name)
+    filter_table_config.add(:sink_destinations, field: :sink_destination)
+    filter_table_config.connect(self, :fetch_data)
+
+    def fetch_data
+      sink_rows = []
+      next_page = nil
+      loop do
+        catch_gcp_errors do
+          @sinks = @gcp.gcp_client(Google::Apis::LoggingV2::LoggingService).list_project_sinks("projects/#{@project}", page_token: next_page)
+        end
+        return [] if !@sinks || !@sinks.sinks
+        @sinks.sinks.map do |sink|
+          logging_sink = @gcp.gcp_client(Google::Apis::LoggingV2::LoggingService).get_project_sink("projects/#{@project}/sinks/#{sink.name}")
+          sink_rows+=[{ sink_name: sink.name,
+                        sink_destination: sink.destination,
+                        sink_filter: logging_sink.filter }]
+        end
+        next_page = @sinks.next_page_token
+        break unless next_page
+      end
+      @table = sink_rows
+    end
+  end
+end

libraries/google_storage_bucket.rb

@@ -29,6 +29,11 @@ def exists?
       !@bucket.nil?
     end
 
+    def has_versioning_enabled?
+      return false if !defined?(@bucket.versioning)
+      @bucket.versioning.enabled
+    end
+
     def to_s
       "Bucket #{@display_name}"
     end

test/integration/verify/controls/google_logging_project_sinks.rb

@@ -0,0 +1,19 @@
+title 'Test GCP project logging sinks'
+
+gcp_project_id = attribute(:gcp_project_id, default: '', description: 'The GCP project identifier.')
+gcp_logging_project_sink_name = attribute(:gcp_logging_project_sink_name, default: '', description: 'The GCP project logging sink name.')
+gcp_logging_bucket_name = attribute(:gcp_logging_bucket_name, default: '', description: 'The GCP project logging bucket name.')
+gcp_enable_privileged_resources = attribute(:gcp_enable_privileged_resources,default:0,description:'Flag to enable privileged resources requiring elevated privileges in GCP.')
+
+control 'gcp-project-logging-sinks-1.0' do
+
+  only_if { gcp_enable_privileged_resources.to_i == 1 }
+  impact 1.0
+  title 'Ensure GCP project logging sinks have the correct properties in bulk.'
+
+  describe google_logging_project_sinks(project: gcp_project_id) do
+    it { should exist }
+    its('sink_names') { should include gcp_logging_project_sink_name }
+    its('sink_destinations') { should eq "storage.googleapis.com/#{gcp_logging_bucket_name}" }
+  end
+end