CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(target): Classify resources for audit events

Browse Source
This commit is contained in:
Timothy Messier authored and Johan Brandhorst-Satzkorn committed 2022-04-20 13:32:32 -04:00
1 parent c8be4a9890
commit 3be5c44907
7 files changed
+1017 -657
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/proto/controller/api/resources/targets/v1/target.proto
+44 -45
View File
@@ -13,62 +13,62 @@ import "controller/custom_options/v1/options.proto";
message HostSource {
// Output only. The ID of the Host Set.
string id = 10;
string id = 10; // @gotags: `class:"public"`
// Output only. The Host Catalog to which this Host Source belongs.
string host_catalog_id = 20 [json_name = "host_catalog_id"];
string host_catalog_id = 20 [json_name = "host_catalog_id"]; // @gotags: `class:"public"`
}
message HostSet {
// Output only. The ID of the Host Set.
string id = 10;
string id = 10; // @gotags: `class:"public"`
// Output only. The Host Catalog to which this Host Set belongs.
string host_catalog_id = 20 [json_name = "host_catalog_id"];
string host_catalog_id = 20 [json_name = "host_catalog_id"]; // @gotags: `class:"public"`
}
message CredentialSource {
// The ID of the Credential. May be empty if the credential is dynamically generated from a library.
string id = 10;
string id = 10; // @gotags: `class:"public"`
// Output only. The name of the Credential source.
string name = 20;
string name = 20; // @gotags: `class:"public"`
// Output only. The description of the Credential source.
string description = 30;
string description = 30; // @gotags: `class:"public"`
// Output only. The Credential Store to which this Credential source belongs.
string credential_store_id = 40 [json_name = "credential_store_id"];
string credential_store_id = 40 [json_name = "credential_store_id"]; // @gotags: `class:"public"`
// Output only. The type of the credential source (e.g. "vault"; not the type of the credential itself).
string type = 60;
string type = 60; // @gotags: `class:"public"`
// Output only. The type of the credential, empty if unspecified.
string credential_type = 70;
string credential_type = 70; // @gotags: `class:"public"`
}
message CredentialLibrary {
// The ID of the Credential Library.
string id = 10;
string id = 10; // @gotags: `class:"public"`
// Output only. The name of the Credential Library.
string name = 20;
string name = 20; // @gotags: `class:"public"`
// Output only. The description of the Credential Library.
string description = 30;
string description = 30; // @gotags: `class:"public"`
// Output only. The Credential Store to which this Credential Library belongs.
string credential_store_id = 40 [json_name = "credential_store_id"];
string credential_store_id = 40 [json_name = "credential_store_id"]; // @gotags: `class:"public"`
// Output only. The type of the credential library.
string type = 60;
string type = 60; // @gotags: `class:"public"`
}
// The actual secret for a session credential.
message SessionSecret {
// Output only. The base64-encoded value representing the raw bytes from the
// credential provider.
string raw = 10;
string raw = 10; // @gotags: `class:"secret"`
// Output only. The decoded raw string, if a JSON object.
google.protobuf.Struct decoded = 20;
@@ -93,95 +93,94 @@ message SessionCredential {
// Target contains all fields related to a Target resource
message Target {
// Output only. The ID of the resource.
string id = 10;
string id = 10; // @gotags: `class:"public"`
// The Scope of of this resource. This must be defined for creation of this resource, but is otherwise output only.
string scope_id = 20 [json_name = "scope_id"];
string scope_id = 20 [json_name = "scope_id"]; // @gotags: `class:"public"`
// Output only. Scope information for this resource.
resources.scopes.v1.ScopeInfo scope = 30;
// Required name for identification purposes.
google.protobuf.StringValue name = 40 [(custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "name" that: "name" }];
google.protobuf.StringValue name = 40 [(custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "name" that: "name" }]; // @gotags: `class:"public"`
// Optional user-set description for identification purposes.
google.protobuf.StringValue description = 50 [(custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "description" that: "description" }];
google.protobuf.StringValue description = 50 [(custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "description" that: "description" }]; // @gotags: `class:"public"`
// Output only. The time this resource was created.
google.protobuf.Timestamp created_time = 60 [json_name = "created_time"];
google.protobuf.Timestamp created_time = 60 [json_name = "created_time"]; // @gotags: `class:"public"`
// Output only. The time this resource was last updated.
google.protobuf.Timestamp updated_time = 70 [json_name = "updated_time"];
google.protobuf.Timestamp updated_time = 70 [json_name = "updated_time"]; // @gotags: `class:"public"`
// Version is used in mutation requests, after the initial creation, to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 80;
uint32 version = 80; // @gotags: `class:"public"`
// The type of the Target.
string type = 90;
string type = 90; // @gotags: `class:"public"`
// Output only. The IDs of the Host Sets associated with this Target.
repeated string host_set_ids = 100 [json_name = "host_set_ids"];
repeated string host_set_ids = 100 [json_name = "host_set_ids"]; // @gotags: `class:"public"`
// Output only. The Host Sets associated with this Target.
repeated HostSet host_sets = 110 [json_name = "host_sets"];
// Output only. The IDs of the Host Sources associated with this Target.
repeated string host_source_ids = 420 [json_name = "host_source_ids"];
repeated string host_source_ids = 420 [json_name = "host_source_ids"]; // @gotags: `class:"public"`
// Output only. The Host Sources associated with this Target.
repeated HostSource host_sources = 430 [json_name = "host_sources"];
// Maximum total lifetime of a created Session, in seconds.
google.protobuf.UInt32Value session_max_seconds = 120
[json_name = "session_max_seconds", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "session_max_seconds" that: "SessionMaxSeconds" }];
[json_name = "session_max_seconds", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "session_max_seconds" that: "SessionMaxSeconds" }]; // @gotags: `class:"public"`
// Maximum number of connections allowed in a Session. Unlimited is indicated by the value -1.
google.protobuf.Int32Value session_connection_limit = 130
[json_name = "session_connection_limit", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "session_connection_limit" that: "SessionConnectionLimit" }];
[json_name = "session_connection_limit", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "session_connection_limit" that: "SessionConnectionLimit" }]; // @gotags: `class:"public"`
// Optional boolean expression to filter the workers that are allowed to satisfy this request.
google.protobuf.StringValue worker_filter = 140
[json_name = "worker_filter", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "worker_filter" that: "WorkerFilter" }];
[json_name = "worker_filter", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "worker_filter" that: "WorkerFilter" }]; // @gotags: `class:"public"`
// Output only. The IDs of the application credential library ids associated with this Target. Deprecated: use application_credential_source_ids instead.
repeated string application_credential_library_ids = 150 [json_name = "application_credential_library_ids", deprecated = true];
repeated string application_credential_library_ids = 150 [json_name = "application_credential_library_ids", deprecated = true]; // @gotags: `class:"public"`
// Output only. The application credential libraries associated with this Target. Deprecated: use application_credential_sources instead.
repeated CredentialLibrary application_credential_libraries = 180 [json_name = "application_credential_libraries", deprecated = true];
// Output only. The IDs of the application credential source ids associated with this Target.
repeated string application_credential_source_ids = 400 [json_name = "application_credential_source_ids"];
repeated string application_credential_source_ids = 400 [json_name = "application_credential_source_ids"]; // @gotags: `class:"public"`
// Output only. The application credential sources associated with this Target.
repeated CredentialSource application_credential_sources = 410 [json_name = "application_credential_sources"];
// Output only. The IDs of the egress credential source ids associated with this Target.
repeated string egress_credential_source_ids = 500 [json_name = "egress_credential_source_ids"];
repeated string egress_credential_source_ids = 500 [json_name = "egress_credential_source_ids"]; // @gotags: `class:"public"`
// Output only. The egress credential sources associated with this Target.
repeated CredentialSource egress_credential_sources = 510 [json_name = "egress_credential_sources"];
oneof attrs {
// The attributes that are applicable for the specific Target.
google.protobuf.Struct attributes = 200 [
(google.api.field_visibility).restriction = "INTERNAL",
(custom_options.v1.generate_sdk_option) = true,
(custom_options.v1.subtype) = "default"
(custom_options.v1.subtype) = "default"
];
TcpTargetAttributes tcp_target_attributes = 201 [
(google.api.field_visibility).restriction = "INTERNAL",
(custom_options.v1.generate_sdk_option) = true,
(custom_options.v1.subtype) = "tcp"
];
TcpTargetAttributes tcp_target_attributes = 201 [
(google.api.field_visibility).restriction = "INTERNAL",
(custom_options.v1.generate_sdk_option) = true,
(custom_options.v1.subtype) = "tcp"
];
}
// Output only. The available actions on this resource for this user.
repeated string authorized_actions = 300 [json_name = "authorized_actions"];
repeated string authorized_actions = 300 [json_name = "authorized_actions"]; // @gotags: `class:"public"`
}
// TcpTargetAttributes contains attributes relevant to Targets of type "tcp"
message TcpTargetAttributes {
// The default TCP port that will be used when connecting to the endpoint unless overridden by a Host Set or Host.
google.protobuf.UInt32Value default_port = 10
[json_name = "default_port", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.default_port" that: "DefaultPort" }];
[json_name = "default_port", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.default_port" that: "DefaultPort" }]; // @gotags: `class:"public"`
}
// WorkerInfo contains information about workers, returned in to the client in SessionAuthorization
@@ -211,7 +210,7 @@ message SessionAuthorizationData {
int32 connection_limit = 90 [json_name = "connection_limit"];
// Output only. The certificate to use when connecting. Raw DER bytes.
bytes certificate = 120; // @gotags: `class:"secret"`
bytes certificate = 120; // @gotags: `class:"sensitive"`
// Output only. The private key to use when connecting. We are using Ed25519, so this is purely raw bytes, no marshaling.
bytes private_key = 130 [json_name = "private_key"]; // @gotags: `class:"secret"`
@@ -262,11 +261,11 @@ message SessionAuthorization {
repeated SessionCredential credentials = 110 [json_name = "credentials"];
}
// The layout of the struct for "credential" field in SessionCredential for a user_password credential type.
// The layout of the struct for "credential" field in SessionCredential for a user_password credential type.
message UserPasswordCredential {
// Username of the credential
string username = 1;
string username = 1; // @gotags: `class:"sensitive"`
// Password of the credential
string password = 2;
string password = 2; // @gotags: `class:"secret"`
}
internal/proto/controller/api/services/v1/target_service.proto
+56 -53
View File
@@ -8,6 +8,9 @@ import "protoc-gen-openapiv2/options/annotations.proto";
import "google/api/annotations.proto";
import "google/protobuf/field_mask.proto";
import "controller/api/resources/targets/v1/target.proto";
import "controller/custom_options/v1/options.proto";
option (custom_options.v1.domain) = "target";
service TargetService {
@@ -83,7 +86,7 @@ service TargetService {
summary: "Deletes a Target."
};
}
// AuthorizeSession creates authorization information from a given Target.
rpc AuthorizeSession(AuthorizeSessionRequest) returns (AuthorizeSessionResponse) {
option (google.api.http) = {
@@ -316,7 +319,7 @@ service TargetService {
}
message GetTargetRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
}
message GetTargetResponse {
@@ -324,9 +327,9 @@ message GetTargetResponse {
}
message ListTargetsRequest {
string scope_id = 1;
bool recursive = 20 [json_name="recursive"];
string filter = 30 [json_name="filter"];
string scope_id = 1; // @gotags: `class:"public"`
bool recursive = 20 [json_name="recursive"]; // @gotags: `class:"public"`
string filter = 30 [json_name="filter"]; // @gotags: `class:"public"`
}
message ListTargetsResponse {
@@ -338,12 +341,12 @@ message CreateTargetRequest {
}
message CreateTargetResponse {
string uri = 1;
string uri = 1; // @gotags: `class:"public"`
resources.targets.v1.Target item = 2;
}
message UpdateTargetRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
resources.targets.v1.Target item = 2;
google.protobuf.FieldMask update_mask = 3 [json_name="update_mask"];
}
@@ -353,17 +356,17 @@ message UpdateTargetResponse {
}
message DeleteTargetRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
}
message DeleteTargetResponse {}
message AddTargetHostSetsRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string host_set_ids = 3 [json_name="host_set_ids"];
uint32 version = 2; // @gotags: `class:"public"`
repeated string host_set_ids = 3 [json_name="host_set_ids"]; // @gotags: `class:"public"`
}
message AddTargetHostSetsResponse {
@@ -371,11 +374,11 @@ message AddTargetHostSetsResponse {
}
message SetTargetHostSetsRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string host_set_ids = 3 [json_name="host_set_ids"];
uint32 version = 2; // @gotags: `class:"public"`
repeated string host_set_ids = 3 [json_name="host_set_ids"]; // @gotags: `class:"public"`
}
message SetTargetHostSetsResponse {
@@ -383,11 +386,11 @@ message SetTargetHostSetsResponse {
}
message RemoveTargetHostSetsRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string host_set_ids = 3 [json_name="host_set_ids"];
uint32 version = 2; // @gotags: `class:"public"`
repeated string host_set_ids = 3 [json_name="host_set_ids"]; // @gotags: `class:"public"`
}
message RemoveTargetHostSetsResponse {
@@ -395,11 +398,11 @@ message RemoveTargetHostSetsResponse {
}
message AddTargetHostSourcesRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string host_source_ids = 3 [json_name="host_source_ids"];
uint32 version = 2; // @gotags: `class:"public"`
repeated string host_source_ids = 3 [json_name="host_source_ids"]; // @gotags: `class:"public"`
}
message AddTargetHostSourcesResponse {
@@ -407,11 +410,11 @@ message AddTargetHostSourcesResponse {
}
message SetTargetHostSourcesRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string host_source_ids = 3 [json_name="host_source_ids"];
uint32 version = 2; // @gotags: `class:"public"`
repeated string host_source_ids = 3 [json_name="host_source_ids"]; // @gotags: `class:"public"`
}
message SetTargetHostSourcesResponse {
@@ -419,11 +422,11 @@ message SetTargetHostSourcesResponse {
}
message RemoveTargetHostSourcesRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string host_source_ids = 3 [json_name="host_source_ids"];
uint32 version = 2; // @gotags: `class:"public"`
repeated string host_source_ids = 3 [json_name="host_source_ids"]; // @gotags: `class:"public"`
}
message RemoveTargetHostSourcesResponse {
@@ -431,11 +434,11 @@ message RemoveTargetHostSourcesResponse {
}
message AddTargetCredentialLibrariesRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string application_credential_library_ids = 3 [json_name="application_credential_library_ids"];
uint32 version = 2; // @gotags: `class:"public"`
repeated string application_credential_library_ids = 3 [json_name="application_credential_library_ids"]; // @gotags: `class:"public"`
}
message AddTargetCredentialLibrariesResponse {
@@ -446,11 +449,11 @@ message AddTargetCredentialLibrariesResponse {
// credential_library_id field that is not set in the request will result in
// those fields being cleared.
message SetTargetCredentialLibrariesRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string application_credential_library_ids = 3 [json_name="application_credential_library_ids"];
uint32 version = 2; // @gotags: `class:"public"`
repeated string application_credential_library_ids = 3 [json_name="application_credential_library_ids"]; // @gotags: `class:"public"`
}
message SetTargetCredentialLibrariesResponse {
@@ -458,11 +461,11 @@ message SetTargetCredentialLibrariesResponse {
}
message RemoveTargetCredentialLibrariesRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string application_credential_library_ids = 3 [json_name="application_credential_library_ids"];
uint32 version = 2; // @gotags: `class:"public"`
repeated string application_credential_library_ids = 3 [json_name="application_credential_library_ids"]; // @gotags: `class:"public"`
}
message RemoveTargetCredentialLibrariesResponse {
@@ -470,12 +473,12 @@ message RemoveTargetCredentialLibrariesResponse {
}
message AddTargetCredentialSourcesRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string application_credential_source_ids = 3 [json_name="application_credential_source_ids"];
repeated string egress_credential_source_ids = 4 [json_name="egress_credential_source_ids"];
uint32 version = 2; // @gotags: `class:"public"`
repeated string application_credential_source_ids = 3 [json_name="application_credential_source_ids"]; // @gotags: `class:"public"`
repeated string egress_credential_source_ids = 4 [json_name="egress_credential_source_ids"]; // @gotags: `class:"public"`
}
message AddTargetCredentialSourcesResponse {
@@ -485,12 +488,12 @@ message AddTargetCredentialSourcesResponse {
// Sets the values for credential sources. Any credential_source_id field that
// is not set in the request will result in those fields being cleared.
message SetTargetCredentialSourcesRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string application_credential_source_ids = 3 [json_name="application_credential_source_ids"];
repeated string egress_credential_source_ids = 4 [json_name="egress_credential_source_ids"];
uint32 version = 2; // @gotags: `class:"public"`
repeated string application_credential_source_ids = 3 [json_name="application_credential_source_ids"]; // @gotags: `class:"public"`
repeated string egress_credential_source_ids = 4 [json_name="egress_credential_source_ids"]; // @gotags: `class:"public"`
}
message SetTargetCredentialSourcesResponse {
@@ -498,12 +501,12 @@ message SetTargetCredentialSourcesResponse {
}
message RemoveTargetCredentialSourcesRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string application_credential_source_ids = 3 [json_name="application_credential_source_id"];
repeated string egress_credential_source_ids = 4 [json_name="egress_credential_source_ids"];
uint32 version = 2; // @gotags: `class:"public"`
repeated string application_credential_source_ids = 3 [json_name="application_credential_source_id"]; // @gotags: `class:"public"`
repeated string egress_credential_source_ids = 4 [json_name="egress_credential_source_ids"]; // @gotags: `class:"public"`
}
message RemoveTargetCredentialSourcesResponse {
@@ -512,19 +515,19 @@ message RemoveTargetCredentialSourcesResponse {
message AuthorizeSessionRequest {
// The ID of the target. Required unless some combination of scope_id/scope_name and name are set.
string id = 1;
string id = 1; // @gotags: `class:"public"`
// The name of the target. When using this, scope_id or scope_name must be set.
string name = 3;
string name = 3; // @gotags: `class:"public"`
// The scope ID containing the target, if specifying the target by name.
string scope_id = 4;
string scope_id = 4; // @gotags: `class:"public"`
// The scope name containing the target, if specifying the target by name.
string scope_name = 5;
string scope_name = 5; // @gotags: `class:"public"`
// An optional parameter allowing specification of the particular Host within the Target's configured Host Sets to connect to during this Session.
string host_id = 2 [json_name="host_id"];
string host_id = 2 [json_name="host_id"]; // @gotags: `class:"public"`
}
message AuthorizeSessionResponse {