Split the GSA alert policies into two (#152)

I get this trying to deploy it: ``` Alert policies with a log matching condition can only have a single condition ``` So much for just testing these in the log viewer :( Signed-off-by: Matt Moore <[email protected]>
chainguard-dev · Feb 19, 2024 · eece660 · eece660
1 parent 45db0c7
commit eece660
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 4 deletions.
diff --git a/modules/audit-serviceaccount/README.md b/modules/audit-serviceaccount/README.md
@@ -55,7 +55,8 @@ No modules.
 
 | Name | Type |
 |------|------|
-| [google_monitoring_alert_policy.this](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/monitoring_alert_policy) | resource |
+| [google_monitoring_alert_policy.generate-access-token](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/monitoring_alert_policy) | resource |
+| [google_monitoring_alert_policy.private-key-generated](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/monitoring_alert_policy) | resource |
 
 ## Inputs
 

diff --git a/modules/audit-serviceaccount/main.tf b/modules/audit-serviceaccount/main.tf
@@ -1,4 +1,4 @@
-resource "google_monitoring_alert_policy" "this" {
+resource "google_monitoring_alert_policy" "generate-access-token" {
   # In the absence of data, incident will auto-close after an hour
   alert_strategy {
     auto_close = "3600s"
@@ -8,11 +8,11 @@ resource "google_monitoring_alert_policy" "this" {
     }
   }
 
-  display_name = "Abnormal GSA Access: ${var.service-account}"
+  display_name = "Abnormal Access Token Generation: ${var.service-account}"
   combiner     = "OR"
 
   conditions {
-    display_name = "Abnormal GSA Access"
+    display_name = "Access Token Generation"
 
     condition_matched_log {
       filter = <<EOT
@@ -27,6 +27,25 @@ resource "google_monitoring_alert_policy" "this" {
     }
   }
 
+  notification_channels = var.notification_channels
+
+  enabled = "true"
+  project = var.project_id
+}
+
+resource "google_monitoring_alert_policy" "private-key-generated" {
+  # In the absence of data, incident will auto-close after an hour
+  alert_strategy {
+    auto_close = "3600s"
+
+    notification_rate_limit {
+      period = "3600s" // re-alert hourly if condition still valid.
+    }
+  }
+
+  display_name = "Private Key Created: ${var.service-account}"
+  combiner     = "OR"
+
   conditions {
     display_name = "Private Key Created"