Notifications for metadata changes (SSH keys)

[gdsotirov]

Hello,

Is there a way to get notified (email, SMS, etc.) for metadata changes on project level (e.g. SSH keys)?

Regards,

--

Georgi

[DamianS]

Hi,

log-based metrics with proper query and based on that, log-based alert ? This is the first thing which comes to my mind. 

best,
DamianS

[DamianS]

Hi,

Sample query:
You can edit query and add something like regex where alert will be triggered only if  metadata for VM instance will be changed or deleted.

resource.type="gce_instance"
proto_payload.@type="type.googleapis.com/google.cloud.audit.AuditLog" AND
proto_payload.method_name="v1.compute.instances.setMetadata" 

Example of alert send via email:

best,

DamianS

[gdsotirov]

Yes, I though about the same, but I'm interested in alerts for metadata changes on project level, not instance level and SSH keys in particular. So it should rather be something like:

resource.type="gce_project"
protoPayload.@type="type.googleapis.com/google.cloud.audit.AuditLog"

 But I'd like to catch changes related only to SSH keys.

[gdsotirov · Accepted solution]

I was able to achieve it with a logs based alert having the following filter:

resource.type="gce_project"
protoPayload.@type="type.googleapis.com/google.cloud.audit.AuditLog"
(	protoPayload.metadata.projectMetadataDelta.addedMetadataKeys!=""
	OR protoPayload.metadata.projectMetadataDelta.deletedMetadataKeys!=""
	OR protoPayload.metadata.projectMetadataDelta.modifiedMetadataKeys!=""
)

Note: The fields addedMetadataKeys, deletedMetadataKeys and modifiedMetadataKeys seem to have been added earlier this year.

But I'll have to fine tune the alert now, because it does not provide information about what was done and what was changed. It should be possible with labels.