discovery

README

Discovery Status

✅: Discovered
❌: Not Discovered
🚫: Not available

Compute

Expand

Function

Evidence	Azure	AWS
Compute	✅	✅
RuntimeLanguage	✅	❌
RuntimeVersion	✅	❌

VirtualMachine

Evidence	Azure	AWS
Compute	✅	✅
BlockStorage	✅	✅
MalwareProtection	✅	❌
BootLogging	✅	✅
OSLogging	✅	✅
AutomaticUpdates	✅	❌

Compute

Evidence	Azure	AWS
Resource	✅	✅
NetworkInterfaces	✅	✅
ResourceLogging	✅
Backups	❌

Resource

Evidence	Azure	AWS
ID	✅	✅
Name	✅	✅
Type	✅	✅
GeoLocation	✅	✅
Labels	✅	✅

OSLogging

Evidence	Azure	AWS
Auditing	✅	🚫
SecurityFeature	✅	🚫
Enabled	✅	❌
LoggingService	✅	🚫
RetentionPeriod	✅	🚫

BootLogging

Evidence	Azure	AWS
Auditing	✅	🚫
SecurityFeature	✅	🚫
Enabled	✅	❌
LoggingService	✅	🚫
RetentionPeriod	✅	🚫

ResourceLogging

Evidence	Azure	AWS
MonitoringLogDataEnabled	✅
SecurityAlertsEnabled	✅

BlockStorage

Evidence	Azure	AWS
Resource	✅	✅
AtRestEncryption	✅	✅
Immutability	✅	❌
Backups	✅	❌

ManagedKeyEncryption

Evidence	Azure	AWS
Enabled	✅	❌
Algorithm	✅	❌

CustomerKeyEncryption

Evidence	Azure	AWS
Enabled	✅	❌
Algorithm	❌	❌
KeyUrl	✅	❌

Network

Expand

LoadBalancer

Evidence	Azure	AWS
Networkservice	✅	❌
AccessRestriction	✅	❌
HttpEndpoints	✅	❌
Networkservices	✅	❌
Urls	✅	❌

Networkservice

Evidence	Azure	AWS
Networking	✅	❌
Authenticity	✅	❌
Compute	✅	❌
TransportEncryption	✅	❌
Ips	✅	❌
Ports	✅	❌

Networkinterfaces

Evidence	Azure	AWS
Networking	✅	✅
Networkservice	❌	❌
AccessRestriction	partly	❌

Storage

Expand

ObjectStorage

Evidence	Azure	AWS
Storage	✅	✅
PublicAccess	✅	❌
Backups	✅

Storage

Evidence	Azure	AWS
Resource	✅	✅
AtRestEncryption	✅	✅
Immutability	✅	❌
ResourceLogging	✅
Backups	✅

ObjectStorageService

Evidence	Azure	AWS
NetworkService	✅	✅
HttpEndpoint	✅	✅

Networkservice

Evidence	Azure	AWS
Networking	✅	✅
Authenticity	❌	❌
Compute	❌	❌
TransportEncryption	✅	✅
Ips	❌	❌
Ports	❌	❌

HttpEndpoint

Evidence	Azure	AWS
Url	✅	✅
TransportEncryption	✅	✅

FileStorage

Evidence	Azure	AWS
Storage	✅	❌
Backups		❌

ManagedKeyEncryption

Evidence	Azure	AWS
Enabled	✅	✅
Algorithm	✅	✅

CustomerKeyEncryption

Evidence	Azure	AWS
Enabled	✅	✅
Algorithm	❌	❌
KeyUrl	✅	✅

Database Storage

Evidence	Azure	AWS
Storage	✅	❌
Parent	✅	❌

Database Service

Evidence	Azure	AWS
NetworkService	✅	❌
AnomalyDetection	✅	❌

Networkservice

Evidence	Azure	AWS
Networking	✅	✅
Authenticity	❌	❌
Compute	❌	❌
TransportEncryption	❌	✅
Ips	❌	❌
Ports	❌	❌

Azure Backup

Expand

There are 2 different backup solutions for different resources

• Backup Vaults and
• Recovery Services Vault.

Resource	Backup Vaults	Recovery Services Vault
Azure Virtual Machine		x
Azure Storage (Files)		x
Azure Backup Agent		x
Azure Backup Server		x
DPM		x
SQL in Azure VM		x
SAP HANA in Azure VM		x
Azure Storage (Blobs)	x
Azure disks	x
Azure Database for PostgreSQL servers	x
Kubernetes Services	x

Documentation

Index

• Constants
• type Configuration
• type DiscoveryEvent
• type DiscoveryEventType
• type Service
  • func NewService(opts ...ServiceOption) *Service
  • func (svc *Service) GetCloudServiceId() string
  • func (svc *Service) ListGraphEdges(ctx context.Context, req *discovery.ListGraphEdgesRequest) (res *discovery.ListGraphEdgesResponse, err error)
  • func (svc *Service) ListResources(ctx context.Context, req *discovery.ListResourcesRequest) (res *discovery.ListResourcesResponse, err error)
  • func (svc *Service) Shutdown()
  • func (svc *Service) Start(ctx context.Context, req *discovery.StartDiscoveryRequest) (resp *discovery.StartDiscoveryResponse, err error)
  • func (svc *Service) StartDiscovery(discoverer discovery.Discoverer)
  • func (svc *Service) UpdateResource(ctx context.Context, req *discovery.UpdateResourceRequest) (res *discovery.Resource, err error)
• type ServiceOption
  • func WithAssessmentAddress(target string, opts ...grpc.DialOption) ServiceOption
  • func WithAuthorizationStrategy(authz service.AuthorizationStrategy) ServiceOption
  • func WithCloudServiceID(ID string) ServiceOption
  • func WithOAuth2Authorizer(config *clientcredentials.Config) ServiceOption
  • func WithProviders(providersList []string) ServiceOption
  • func WithStorage(storage persistence.Storage) ServiceOption

Constants

const (
	ProviderAWS   = "aws"
	ProviderK8S   = "k8s"
	ProviderAzure = "azure"
)

const (
	// DefaultAssessmentAddress specifies the default gRPC address of the assessment service.
	DefaultAssessmentAddress = "localhost:9090"
)

Types

type Configuration

type Configuration struct {
	Interval time.Duration
}

type DiscoveryEvent

type DiscoveryEvent struct {
	Type            DiscoveryEventType
	DiscovererName  string
	DiscoveredItems int
	Time            time.Time
}

DiscoveryEvent represents an event that is emitted if certain situations happen in the discoverer (defined by DiscoveryEventType). Examples would be the start or the end of the discovery. We will potentially expand this in the future.

type DiscoveryEventType

type DiscoveryEventType int

DiscoveryEventType defines the event types for DiscoveryEvent.

const (
	// DiscovererStart is emmited at the start of a discovery run.
	DiscovererStart DiscoveryEventType = iota
	// DiscovererFinished is emmited at the end of a discovery run.
	DiscovererFinished
)

type Service

type Service struct {
	discovery.UnimplementedDiscoveryServer
	discovery.UnimplementedExperimentalDiscoveryServer

	Events chan *DiscoveryEvent
	// contains filtered or unexported fields
}

Service is an implementation of the Clouditor Discovery service (plus its experimental extensions). It should not be used directly, but rather the NewService constructor should be used.

func NewService

func NewService(opts ...ServiceOption) *Service

func (*Service) GetCloudServiceId

func (svc *Service) GetCloudServiceId() string

GetCloudServiceId implements CloudServiceRequest for this service. This is a little trick, so that we can call CheckAccess directly on the service. This is necessary because the discovery service itself is tied to a specific cloud service ID, instead of the individual requests that are made against the service.

func (*Service) ListGraphEdges

func (svc *Service) ListGraphEdges(ctx context.Context, req *discovery.ListGraphEdgesRequest) (res *discovery.ListGraphEdgesResponse, err error)

func (*Service) ListResources

func (svc *Service) ListResources(ctx context.Context, req *discovery.ListResourcesRequest) (res *discovery.ListResourcesResponse, err error)

func (*Service) Shutdown

func (svc *Service) Shutdown()

func (*Service) Start

func (svc *Service) Start(ctx context.Context, req *discovery.StartDiscoveryRequest) (resp *discovery.StartDiscoveryResponse, err error)

Start starts discovery

func (*Service) StartDiscovery

func (svc *Service) StartDiscovery(discoverer discovery.Discoverer)

func (*Service) UpdateResource

func (svc *Service) UpdateResource(ctx context.Context, req *discovery.UpdateResourceRequest) (res *discovery.Resource, err error)

type ServiceOption

type ServiceOption func(*Service)

ServiceOption is a functional option type to configure the discovery service.

func WithAssessmentAddress

func WithAssessmentAddress(target string, opts ...grpc.DialOption) ServiceOption

WithAssessmentAddress is an option to configure the assessment service gRPC address.

func WithAuthorizationStrategy

func WithAuthorizationStrategy(authz service.AuthorizationStrategy) ServiceOption

WithAuthorizationStrategy is an option that configures an authorization strategy to be used with this service.

func WithCloudServiceID

func WithCloudServiceID(ID string) ServiceOption

WithCloudServiceID is an option to configure the cloud service ID for which resources will be discovered.

func WithOAuth2Authorizer

func WithOAuth2Authorizer(config *clientcredentials.Config) ServiceOption

WithOAuth2Authorizer is an option to use an OAuth 2.0 authorizer

func WithProviders

func WithProviders(providersList []string) ServiceOption

WithProviders is an option to set providers for discovering

func WithStorage

func WithStorage(storage persistence.Storage) ServiceOption

WithStorage is an option to set the storage. If not set, NewService will use inmemory storage.