Please add support for SCC findings exports to BQ via gcloud scc bqexports

[graham-m-dunn]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Description

Currently, the recommended method to export findings from SCC to BQ is gcloud scc bqexports - however this isn't supported in the GCP provider yet. The other method (SCC -> PubSub -> BQ) is much more toilsome (you need a cloud function to parse and insert the finding, or do post-processing from the data field in the BQ table).

New or Affected Resource(s)

• google_scc_big_query_exports

Potential Terraform Configuration

resource "google_scc_bqexport" "scc_project_123456789_all_active_findings" {
  name = "test-bq-export-2"
  dataset = "projects/123456789/datasets/testing_scc_findings_2"
  description = "This is a test BigQuery export"
  filter = "state=\"ACTIVE\" AND NOT mute=\"MUTED\""
}

References

e.g. create

❯ gcloud scc bqexports create test-bq-export-2 --project=123456789 --dataset=projects/123456789/datasets/testing_scc_findings_2 --description="This is a test BigQuery export" --filter="state=\"ACTIVE\" AND NOT mute=\"MUTED\""
Created.
dataset: projects/123456789/datasets/testing_scc_findings_2
description: This is a test BigQuery export
filter: state="ACTIVE" AND NOT mute="MUTED"
mostRecentEditor: [email protected]
name: projects/123456789/bigQueryExports/test-bq-export-2
principal: service-org-123456789@gcp-sa-scc-notification.iam.gserviceaccount.com
updateTime: '2024-07-25T15:53:46.493183Z'

b/356159589

[SarahFrench]

From triage: This resource would map to this entity in the API, which is possible to manage via CRUD despite representing a single, imperative action. This new resource represents the "One-time exports for existing findings, assets, and security marks" as described in the docs