How do I create a cloud function trigger to respond to a integrity failure?

0 votes
Oct 23 in GCP by anonymous
• 5,700 points
18 views

1 answer to this question.

0 votes

Create a Cloud Functions trigger that reads the data in the Cloud Pub/Sub topic and that stops any Shielded VM instance that fails integrity validation.

  1. The following code defines the Cloud Functions trigger. Copy it into a file named main.py.

    import base64
    import json
    import googleapiclient.discovery
    
    def shutdown_vm(data, context):
        """A Cloud Function that shuts down a VM on failed integrity check."""
        log_entry = json.loads(base64.b64decode(data['data']).decode('utf-8'))
        payload = log_entry.get('jsonPayload', {})
        entry_type = payload.get('@type')
        if entry_type != 'type.googleapis.com/cloud_integrity.IntegrityEvent':
          raise TypeError("Unexpected log entry type: %s" % entry_type)
    
        report_event = (payload.get('earlyBootReportEvent')
            or payload.get('lateBootReportEvent'))
    
        if report_event is None:
          # We received a different event type, ignore.
          return
    
        policy_passed = report_event['policyEvaluationPassed']
        if not policy_passed:
          print('Integrity evaluation failed: %s' % report_event)
          print('Shutting down the VM')
    
          instance_id = log_entry['resource']['labels']['instance_id']
          project_id = log_entry['resource']['labels']['project_id']
          zone = log_entry['resource']['labels']['zone']
    
          # Shut down the instance.
          compute = googleapiclient.discovery.build(
              'compute', 'v1', cache_discovery=False)
    
          # Get the instance name from instance id.
          list_result = compute.instances().list(
              project=project_id,
              zone=zone,
                  filter='id eq %s' % instance_id).execute()
          if len(list_result['items']) != 1:
            raise KeyError('unexpected number of items: %d'
                % len(list_result['items']))
          instance_name = list_result['items'][0]['name']
    
          result = compute.instances().stop(project=project_id,
              zone=zone,
              instance=instance_name).execute()
          print('Instance %s in project %s has been scheduled for shut down.'
              % (instance_name, project_id))
  2. In the same location as main.py, create a file named requirements.txt and copy in the following dependencies:

    google-api-python-client==1.6.6
    google-auth==1.4.1
    google-auth-httplib2==0.0.3
  3. Open a terminal window and navigate to the directory containing main.py and requirements.txt.

  4. Run the gcloud beta functions deploy command to deploy the trigger:

    gcloud beta functions deploy shutdown_vm --project YOUR_PROJECT_ID \
        --runtime python37 --trigger-resource integrity-monitoring \
        --trigger-event google.pubsub.topic.publish

    replacing YOUR_PROJECT_ID with the ID of your project.

answered Oct 23 by Sirajul
• 37,930 points

Related Questions In GCP

0 votes
1 answer

How do I deploy a cloud function from my local machine?

You can do this using the gcloud command-line tool, ...READ MORE

answered Oct 22 in GCP by Sirajul
• 37,930 points
11 views
0 votes
1 answer
0 votes
1 answer

How do I create a Virtual Machine on GCP?

To create a VM instance: It is important you ...READ MORE

answered Sep 20 in GCP by Sirajul
• 37,930 points
43 views
0 votes
1 answer

Creating a SQL Server instance using Google Compute engine.

Google Compute Engine provides public images preconfigured with ...READ MORE

answered Sep 23 in GCP by Sirajul
• 37,930 points
37 views
0 votes
1 answer

How do i install gcloud compute?

The gcloud compute command-line tool enables you to easily ...READ MORE

answered Sep 23 in GCP by Sirajul
• 37,930 points
44 views
0 votes
1 answer

How do I create a Google Cloud Platform (GCP) account?

In order to access the services provided ...READ MORE

answered Sep 20 in GCP by Sirajul
• 37,930 points
51 views
0 votes
1 answer

How do I create a VPCN (Virtual private cloud network) on Google Cloud?

You can connect various GCP resources to each ...READ MORE

answered Sep 23 in GCP by Sirajul
• 37,930 points
30 views