Skip to content

Commit 8a3855a

Browse files
hellertanghellertang
committed
support query audit events
1 parent 407637e commit 8a3855a

8 files changed

+516
-0
lines changed

‎tencentcloud/provider.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -724,6 +724,7 @@ func Provider() *schema.Provider {
724724
"tencentcloud_audit_cos_regions": audit.DataSourceTencentCloudAuditCosRegions(),
725725
"tencentcloud_audit_key_alias": audit.DataSourceTencentCloudAuditKeyAlias(),
726726
"tencentcloud_audits": audit.DataSourceTencentCloudAudits(),
727+
"tencentcloud_audit_events": audit.DataSourceTencentCloudAuditEvents(),
727728
"tencentcloud_cynosdb_clusters": cynosdb.DataSourceTencentCloudCynosdbClusters(),
728729
"tencentcloud_cynosdb_instances": cynosdb.DataSourceTencentCloudCynosdbInstances(),
729730
"tencentcloud_cynosdb_zone_config": cynosdb.DataSourceTencentCloudCynosdbZoneConfig(),

‎tencentcloud/provider.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,7 @@ Cloud Audit(Audit)
155155
tencentcloud_audit_cos_regions
156156
tencentcloud_audit_key_alias
157157
tencentcloud_audits
158+
tencentcloud_audit_events
158159

159160
Resource
160161
tencentcloud_audit

‎tencentcloud/services/audit/data_source_tc_audit_events.go

Lines changed: 338 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,338 @@
1+
package audit
2+
3+
import (
4+
"context"
5+
6+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
7+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
8+
cloudaudit "github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cloudaudit/v20190319"
9+
tccommon "github.com/tencentcloudstack/terraform-provider-tencentcloud/tencentcloud/common"
10+
"github.com/tencentcloudstack/terraform-provider-tencentcloud/tencentcloud/internal/helper"
11+
)
12+
13+
func DataSourceTencentCloudAuditEvents() *schema.Resource {
14+
return &schema.Resource{
15+
Read: dataSourceTencentCloudAuditEventsRead,
16+
Schema: map[string]*schema.Schema{
17+
"start_time": {
18+
Type: schema.TypeInt,
19+
Required: true,
20+
Description: "Start timestamp in seconds (cannot be 90 days after the current time).",
21+
},
22+
23+
"end_time": {
24+
Type: schema.TypeInt,
25+
Required: true,
26+
Description: "End timestamp in seconds (the time range for query is less than 30 days).",
27+
},
28+
29+
"max_results": {
30+
Type: schema.TypeInt,
31+
Optional: true,
32+
Description: "Max number of returned logs (up to 50).",
33+
},
34+
35+
"lookup_attributes": {
36+
Type: schema.TypeList,
37+
Optional: true,
38+
Description: "Search condition. Valid values: `RequestId`, `EventName`, `ActionType` (write/read), `PrincipalId` (sub-account), `ResourceType`, `ResourceName`, `AccessKeyId`, `SensitiveAction`, `ApiErrorCode`, `CamErrorCode`, and `Tags` (Format of AttributeValue: [{\"key\":\"*\",\"value\":\"*\"}]).",
39+
Elem: &schema.Resource{
40+
Schema: map[string]*schema.Schema{
41+
"attribute_key": {
42+
Type: schema.TypeString,
43+
Required: true,
44+
Description: "Valid values: RequestId, EventName, ReadOnly, Username, ResourceType, ResourceName, AccessKeyId, and EventId\nNote: `null` may be returned for this field, indicating that no valid values can be obtained.",
45+
},
46+
"attribute_value": {
47+
Type: schema.TypeString,
48+
Optional: true,
49+
Description: "Value of `AttributeValue`\nNote: `null` may be returned for this field, indicating that no valid values can be obtained.",
50+
},
51+
},
52+
},
53+
},
54+
55+
"is_return_location": {
56+
Type: schema.TypeInt,
57+
Optional: true,
58+
Description: "Whether to return the IP location. `1`: yes, `0`: no.",
59+
},
60+
61+
"events": {
62+
Type: schema.TypeList,
63+
Computed: true,
64+
Description: "Logset. Note: `null` may be returned for this field, indicating that no valid values can be obtained.",
65+
Elem: &schema.Resource{
66+
Schema: map[string]*schema.Schema{
67+
"event_id": {
68+
Type: schema.TypeString,
69+
Optional: true,
70+
Description: "Log ID.",
71+
},
72+
"username": {
73+
Type: schema.TypeString,
74+
Optional: true,
75+
Description: "Username.",
76+
},
77+
"event_time": {
78+
Type: schema.TypeString,
79+
Optional: true,
80+
Description: "Event Time.",
81+
},
82+
"cloud_audit_event": {
83+
Type: schema.TypeString,
84+
Optional: true,
85+
Description: "Log details.",
86+
},
87+
"resource_type_cn": {
88+
Type: schema.TypeString,
89+
Optional: true,
90+
Description: "Description of resource type in Chinese (please use this field as required; if you are using other languages, ignore this field).",
91+
},
92+
"error_code": {
93+
Type: schema.TypeInt,
94+
Optional: true,
95+
Description: "Authentication error code.",
96+
},
97+
"event_name": {
98+
Type: schema.TypeString,
99+
Optional: true,
100+
Description: "Event name.",
101+
},
102+
"secret_id": {
103+
Type: schema.TypeString,
104+
Optional: true,
105+
Description: "Certificate ID\nNote: `null` may be returned for this field, indicating that no valid values can be obtained.",
106+
},
107+
"event_source": {
108+
Type: schema.TypeString,
109+
Optional: true,
110+
Description: "Request source.",
111+
},
112+
"request_id": {
113+
Type: schema.TypeString,
114+
Optional: true,
115+
Description: "Request ID.",
116+
},
117+
"resource_region": {
118+
Type: schema.TypeString,
119+
Optional: true,
120+
Description: "Resource region.",
121+
},
122+
"account_id": {
123+
Type: schema.TypeInt,
124+
Optional: true,
125+
Description: "Root account ID.",
126+
},
127+
"source_ip_address": {
128+
Type: schema.TypeString,
129+
Optional: true,
130+
Description: "Source IP\nNote: `null` may be returned for this field, indicating that no valid values can be obtained.",
131+
},
132+
"event_name_cn": {
133+
Type: schema.TypeString,
134+
Optional: true,
135+
Description: "Description of event name in Chinese (please use this field as required; if you are using other languages, ignore this field).",
136+
},
137+
"resources": {
138+
Type: schema.TypeList,
139+
Optional: true,
140+
MaxItems: 1,
141+
Description: "Resource pair.",
142+
Elem: &schema.Resource{
143+
Schema: map[string]*schema.Schema{
144+
"resource_type": {
145+
Type: schema.TypeString,
146+
Optional: true,
147+
Description: "Resource type.",
148+
},
149+
"resource_name": {
150+
Type: schema.TypeString,
151+
Optional: true,
152+
Description: "Resource name\nNote: `null` may be returned for this field, indicating that no valid values can be obtained.",
153+
},
154+
},
155+
},
156+
},
157+
"event_region": {
158+
Type: schema.TypeString,
159+
Optional: true,
160+
Description: "Event region.",
161+
},
162+
"location": {
163+
Type: schema.TypeString,
164+
Optional: true,
165+
Description: "IP location.",
166+
},
167+
},
168+
},
169+
},
170+
171+
"result_output_file": {
172+
Type: schema.TypeString,
173+
Optional: true,
174+
Description: "Used to save results.",
175+
},
176+
},
177+
}
178+
}
179+
180+
func dataSourceTencentCloudAuditEventsRead(d *schema.ResourceData, meta interface{}) error {
181+
defer tccommon.LogElapsed("data_source.tencentcloud_audit_event.read")()
182+
defer tccommon.InconsistentCheck(d, meta)()
183+
184+
logId := tccommon.GetLogId(nil)
185+
ctx := tccommon.NewResourceLifeCycleHandleFuncContext(context.Background(), logId, d, meta)
186+
187+
service := AuditService{client: meta.(tccommon.ProviderMeta).GetAPIV3Conn()}
188+
189+
paramMap := make(map[string]interface{})
190+
191+
if v, ok := d.GetOkExists("max_results"); ok {
192+
paramMap["MaxResults"] = helper.IntUint64(v.(int))
193+
}
194+
195+
if v, ok := d.GetOkExists("start_time"); ok {
196+
paramMap["StartTime"] = helper.IntUint64(v.(int))
197+
}
198+
199+
if v, ok := d.GetOkExists("end_time"); ok {
200+
paramMap["EndTime"] = helper.IntUint64(v.(int))
201+
}
202+
203+
if v, ok := d.GetOk("lookup_attributes"); ok {
204+
lookupAttributesSet := v.([]interface{})
205+
tmpSet := make([]*cloudaudit.LookupAttribute, 0, len(lookupAttributesSet))
206+
for _, item := range lookupAttributesSet {
207+
lookupAttributesMap := item.(map[string]interface{})
208+
lookupAttribute := cloudaudit.LookupAttribute{}
209+
if v, ok := lookupAttributesMap["attribute_key"]; ok {
210+
lookupAttribute.AttributeKey = helper.String(v.(string))
211+
}
212+
if v, ok := lookupAttributesMap["attribute_value"]; ok {
213+
lookupAttribute.AttributeValue = helper.String(v.(string))
214+
}
215+
tmpSet = append(tmpSet, &lookupAttribute)
216+
}
217+
paramMap["LookupAttributes"] = tmpSet
218+
}
219+
220+
if v, ok := d.GetOkExists("is_return_location"); ok {
221+
paramMap["IsReturnLocation"] = helper.IntUint64(v.(int))
222+
}
223+
224+
var respData []*cloudaudit.Event
225+
err := resource.Retry(tccommon.ReadRetryTimeout, func() *resource.RetryError {
226+
result, e := service.DescribeAuditEventByFilter(ctx, paramMap)
227+
if e != nil {
228+
return tccommon.RetryError(e)
229+
}
230+
respData = result
231+
return nil
232+
})
233+
if err != nil {
234+
return err
235+
}
236+
237+
ids := make([]string, 0, len(respData))
238+
eventsList := make([]map[string]interface{}, 0, len(respData))
239+
if respData != nil {
240+
for _, events := range respData {
241+
eventsMap := map[string]interface{}{}
242+
println(*events.EventId)
243+
if events.EventId != nil {
244+
eventsMap["event_id"] = events.EventId
245+
}
246+
247+
if events.Username != nil {
248+
eventsMap["username"] = events.Username
249+
}
250+
251+
if events.EventTime != nil {
252+
eventsMap["event_time"] = events.EventTime
253+
}
254+
255+
if events.CloudAuditEvent != nil {
256+
eventsMap["cloud_audit_event"] = events.CloudAuditEvent
257+
}
258+
259+
if events.ResourceTypeCn != nil {
260+
eventsMap["resource_type_cn"] = events.ResourceTypeCn
261+
}
262+
263+
if events.ErrorCode != nil {
264+
eventsMap["error_code"] = events.ErrorCode
265+
}
266+
267+
if events.EventName != nil {
268+
eventsMap["event_name"] = events.EventName
269+
}
270+
271+
if events.SecretId != nil {
272+
eventsMap["secret_id"] = events.SecretId
273+
}
274+
275+
if events.EventSource != nil {
276+
eventsMap["event_source"] = events.EventSource
277+
}
278+
279+
if events.RequestID != nil {
280+
eventsMap["request_id"] = events.RequestID
281+
}
282+
283+
if events.ResourceRegion != nil {
284+
eventsMap["resource_region"] = events.ResourceRegion
285+
}
286+
287+
if events.AccountID != nil {
288+
eventsMap["account_id"] = events.AccountID
289+
}
290+
291+
if events.SourceIPAddress != nil {
292+
eventsMap["source_ip_address"] = events.SourceIPAddress
293+
}
294+
295+
if events.EventNameCn != nil {
296+
eventsMap["event_name_cn"] = events.EventNameCn
297+
}
298+
299+
resourcesMap := map[string]interface{}{}
300+
301+
if events.Resources != nil {
302+
if events.Resources.ResourceType != nil {
303+
resourcesMap["resource_type"] = events.Resources.ResourceType
304+
}
305+
306+
if events.Resources.ResourceName != nil {
307+
resourcesMap["resource_name"] = events.Resources.ResourceName
308+
}
309+
310+
eventsMap["resources"] = []interface{}{resourcesMap}
311+
}
312+
313+
if events.EventRegion != nil {
314+
eventsMap["event_region"] = events.EventRegion
315+
}
316+
317+
if events.Location != nil {
318+
eventsMap["location"] = events.Location
319+
}
320+
321+
eventsList = append(eventsList, eventsMap)
322+
ids = append(ids, *events.EventId)
323+
}
324+
325+
_ = d.Set("events", eventsList)
326+
}
327+
328+
d.SetId(helper.DataResourceIdsHash(ids))
329+
330+
output, ok := d.GetOk("result_output_file")
331+
if ok && output.(string) != "" {
332+
if e := tccommon.WriteToFile(output.(string), eventsList); e != nil {
333+
return e
334+
}
335+
}
336+
337+
return nil
338+
}

‎tencentcloud/services/audit/data_source_tc_audit_events.md

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
Use this data source to query the events list supported by the audit.
2+
3+
Example Usage
4+
```hcl
5+
data "tencentcloud_audit_events" "events" {
6+
start_time = "1727433841"
7+
end_time = "1727437441"
8+
max_results = 50
9+
10+
lookup_attributes {
11+
attribute_key = "ResourceType"
12+
attribute_value = "cvm"
13+
}
14+
15+
lookup_attributes {
16+
attribute_key = "OnlyRecordNotSeen"
17+
attribute_value = "0"
18+
}
19+
20+
lookup_attributes {
21+
attribute_key = "EventPlatform"
22+
attribute_value = "0"
23+
}
24+
25+
is_return_location = 1
26+
}
27+
```

0 commit comments

Comments
 (0)