cloud-bots-gcp

KO | EN

gitlite — search

#hacktoberfest #android #rust #deep-learning #linux #docker #nodejs #cli #kubernetes #awesome-list #security #pytorch #ios #mcp

(★ 22)

No description available.

cloud-bots-gcp 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

<div align="center">
    <h1><a target="_blank" href="https://cloudbots.dome9.com">CloudBots</a> is an automatic remediation solution for public cloud platforms (GCP, <a href="https://github.com/Dome9/cloud-bots" target="_blank">AWS</a>, and <a href="https://github.com/Dome9/cloud-bots-azure" target="_blank">Azure</a>)</h1>
</div>

- [What are CloudGuard CloudBots?](#what-are-dome9-cloudbots)
  - [Flow Diagram](#flow-diagram)
      - [The Bots](#the-bots)
  - [Deploy the CloudBots](#deploy-the-cloudbots)
      - [Configure your GCP Projects for
        CloudBots](#configure-your-gcp-projects-for-cloudbots)
          - [Download the CloudBots zip
            file](#download-the-cloudbots-zip-file)
          - [Create GCP Service Account for
            cloudbots](#create-gcp-service-account-for-cloudbots)
          - [Configure SendGrid](#configure-sendgrid)
          - [Create a GCP Function with the
            CloudBots](#create-a-gcp-function-with-the-cloudbots)
          - [Webhook for Function](#webhook-for-function)
      - [Multiple GCP Accounts](#multiple-gcp-accounts)
      - [Configure your CloudGuard account](#configure-your-dome9-account)
          - [Configure a CloudGuard Compliance
            Ruleset](#configure-a-dome9-compliance-ruleset)
          - [Configure a CloudGuard Continuous Compliance
            policy](#configure-a-dome9-continuous-compliance-policy)
  - [Log Collection for
    Troubleshooting](#log-collection-for-troubleshooting)
  - [What are CloudGuard CloudBots?](#what-are-dome9-cloudbots)
      - [Flow Diagram](#flow-diagram)
          - [The Bots](#the-bots)
      - [Onboarding](#onboarding)
          - [Clone repo](#clone-repo)
          - [Create GCP Service Account for
            cloudbots](#create-gcp-service-account-for-cloudbots)
          - [Configure SendGrid](#configure-sendgrid)
          - [Create a GCP Function with the
            CloudBots](#create-a-gcp-function-with-the-cloudbots)
          - [Webhook for Function](#webhook-for-function)
          - [Multiple Accounts](#multiple-accounts)
      - [Configure Dome9](#configure-dome9)
          - [Configure a Ruleset](#configure-a-ruleset)
          - [Configure the Continuous Compliance
            policy](#configure-the-continuous-compliance-policy)
      - [Log Collection for
        Troubleshooting](#log-collection-for-troubleshooting)

## What are CloudGuard CloudBots?

CloudGuard CloudBots are an autoremediation solution for GCP, built on top of
the CloudGuard CloudGuard Continuous Compliance capabilities.

They can also be used standalone, without Dome9, to remedy issues in AWS
and Azure accounts. Details are included how to configure and trigger
them.

# Flow Diagram

![Flow Diagram](https://raw.githubusercontent.com/dome9/cloud-bots-gcp/master/docs/pictures/GCP-CloudBots-Flow-Diagram.png)

## The Bots

Refer to [this](bots.md) file for a list of the
bots, what each one does, and an example of a rule that could be used to
trigger it.

# Deploy the CloudBots

To use the CloudBots, you have to set up your GCP project, and your
CloudGuard account.

## Configure your GCP Projects for CloudBots

Follow these steps to configure your GCP Projects:
    
  - Create a custom role for the CloudBots *Cloud Function*
  - Create a *Service Account* for the CloudBots  
  - download the CloudBots zip file
  - Optionally, configure SendGrid to forward notifications by email
  - Create a GCP Function for the CloudBots

### Create a custom role for the CloudBots *Cloud Function*

1. In GCP portal, go to *IAM & Admin* -> *Roles*
2. Choose *Create Role*
3. Enter a title for the role (like 'CloudGuard-CloudBots-Role')
4. Choose *Role launch stage* to be **General Availability**

![](https://raw.githubusercontent.com/dome9/cloud-bots-gcp/master/docs/pictures/create-role.jpg)

5. Click on *Add permissions**
6. Add the permissions from the file [CloudGuard-CloudBots-Role.json](CloudGuard-CloudBots-Role.json)
   
    ![](https://raw.githubusercontent.com/dome9/cloud-bots-gcp/master/docs/pictures/add-permissions.jpg)

7. Press *CREATE*

### Create a *Service Account* for the CloudBots

1. In GCP portal, go to *IAM & Admin* -> *Service Accounts*
2. Choose *Create Service Account*
3. Enter a name for the service account (like 'CloudGuard-CloudBots-ServiceAccount')

![](https://raw.githubusercontent.com/dome9/cloud-bots-gcp/master/docs/pictures/create-service-account.jpg)

4. Press on *Create and Continue*
5. Choose the role you created in the previous step

![](https://raw.githubusercontent.com/dome9/cloud-bots-gcp/master/docs/pictures/add-role-to-service-account.jpg)

6. Press *Continue* and the then *Done*

### Download the CloudBots zip file

1.  Download the CloudBots zip file from this repository (The GCP
    Function will require the content zipped).
2.  If you cloned the repository, zip the contents.

### Configure SendGrid

SendGrid ([sendgrid.com](sendgrid.com)) is a third-party email service.
It has different tiers and pricing. It is used by GCP to distribute
emails. See
[here](https://cloud.google.com/compute/docs/tutorials/sending-mail/using-sendgrid)
for more info.

This step is optional.

1.  Navigate to sendgrid.com
2.  Create a new account, following the instructions on the site.
3.  Navigate to *Settings*, and then select *API Keys*.
4.  Click *Create API Key*.
5.  Enter a name for the key (e.g., *Dome9-cloudbots*, an select Full
    Access.
6.  Click *Create Key*, then copy the value of the key.
7.  Click *Done*.

### Create a GCP Function with the CloudBots

1. Navigate to *Cloud Functions*.
2. Click *CREATE FUNCTION*.
   
   ![](https://raw.githubusercontent.com/dome9/cloud-bots-gcp/master/docs/pictures/create_function_2.jpg)
   
3. Choose a name for the function.
4. Select a region for the function.
   
    ![](https://raw.githubusercontent.com/dome9/cloud-bots-gcp/master/docs/pictures/function_name_and_region.jpg)

5. Set *Trigger Type* as **HTTP**.
6. Check *Allow unauthenticated invocations* option.
7. Press *SAVE*.
   
    ![](https://raw.githubusercontent.com/dome9/cloud-bots-gcp/master/docs/pictures/save_trigger_options.jpg)

8. Expand *RUNTIME, BUILD, CONNECTIONS AND SECURITY SETTINGS*.
9. Make sure the *Runtime Service Account* is set to the service account you created earlier.
   
    ![](https://raw.githubusercontent.com/dome9/cloud-bots-gcp/master/docs/pictures/choose-service-account.jpg)

10. In the *Runtime Environment Variables* section, click on *ADD VARIABLE* and add the following variables:
    1. (optional) SEND_GRID_API_CLIENT - enter the SendGrid API Ket that was created above.
    2. (optional) OUTPUT_EMAIL - the email recipient (for notification emails, generated with SendGrid).
    3. SEND_LOGS - set to *True* to send log information to CloudGuard for troubleshooting; set to *False* to disable this (default is *True*).
    
    ![](https://raw.githubusercontent.com/dome9/cloud-bots-gcp/master/docs/pictures/environment_variables.jpg)

11. Press *NEXT*.
12. Set Runtime as *Python 3.7*.
13. In the *ENTRY POINT* section enter 'main'.
    
    ![](https://raw.githubusercontent.com/dome9/cloud-bots-gcp/master/docs/pictures/runtime_and_entry_point.jpg)

14. In *SOURCE CODE*, choose **ZIP Upload**.
15. Choose the zip file that was created above.
    
    ![](https://raw.githubusercontent.com/dome9/cloud-bots-gcp/master/docs/pictures/zip_upload.jpg)

16. Choose a *Stage Bucket* (or create a new one if necessary).
    
    ![](https://raw.githubusercontent.com/dome9/cloud-bots-gcp/master/docs/pictures/select_bucket.jpg)

17. Click on *DEPLOY*.

### Webhook for Function

The cloudbot function in GCP is triggered from CloudGuard using a webhook.
For this, the URL of the function is required.

1.  Click on the Cloud Function you created.
2.  Go to *TRIGGER* section.
3. Copy the *Trigger URL*.

![](https://raw.githubusercontent.com/dome9/cloud-bots-gcp/master/docs/pictures/trigger.jpg)

## Multiple GCP Accounts

You can use CloudBots for several GCP projects, but install it in only
one project. The other projects will be accessed from the first by
granting IAM permissions.

1.  Create a GCP Function in one of the GCP projects, following the
    steps above.
2.  For each of the other projects, navigate to IAM & admin, and select
    IAM.
    1.  Click ADD.  
        ![](https://raw.githubusercontent.com/dome9/cloud-bots-gcp/master/docs/pictures/IAM-Add-members.png)
    2.  In the New members field, enter the service account created
        above.
    3.  Select the Project Editor role.
    4.  Click SAVE.

## Configure your CloudGuard account

On CloudGuard add remediation tags to rules in a Compliance ruleset.

cloud-bots-gcp

cloud-bots-gcp 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

cloud-bots-gcp

cloud-bots-gcp 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README