Skip to content

Commit da920be

Browse files
hudlowhudlow
committed
Fix flow logs feature
1 parent 39ef5d8 commit da920be

File tree

6 files changed

+24
-39
lines changed

6 files changed

+24
-39
lines changed

‎features/c7n_interface.feature‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -950,7 +950,7 @@ Examples: subnet False
950950

951951
Scenario Outline: Some resource types (vpc, eni, and subnet) have flow-log settings.
952952
C7N can check a variety of attributes: destination, destination-type, enabled,
953-
log-group, status, and traffic-type. Pragmatically, we see only enabled and desination-type
953+
log-group, status, and traffic-type. Pragmatically, we see only enabled and destination-type
954954

955955
Given policy text
956956
"""
@@ -969,12 +969,12 @@ Scenario Outline: Some resource types (vpc, eni, and subnet) have flow-log setti
969969
And C7N.filter manager has get_model result of InstanceId
970970
And C7N.filter has flow_logs result with <flow-logs>
971971
When CEL filter is built and evaluated
972+
Then CEL text is size(resource.flow_logs()) == 0 || ! (size(resource.flow_logs()) != 0 && (resource.flow_logs().exists(x, x.LogDestinationType == "s3")))
972973
Then result is <expected>
973-
And CEL text is size(resource.flow_logs()) == 0 || ! (size(resource.flow_logs()) != 0 && (resource.flow_logs().LogDestinationType == "s3"))
974974

975-
Examples: low-logs True
975+
Examples: flow-logs True
976976
| expected | document | flow-logs |
977-
| True | {"InstanceId": "i-123456789", "ResourceType": "vpc"} | [{"ResourceId": "i-123456789", "More": "Details"}] |
977+
| True | {"InstanceId": "i-123456789", "ResourceType": "vpc"} | [{"ResourceId": "i-123456789", "LogDestinationType": "cloud-watch-logs"}] |
978978

979979

980980
######################

‎features/error_propagation.feature‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,7 @@ Scenario: and_ignore
8585

8686
When CEL expression '{}.a && false' is evaluated
8787
Then eval_error is None
88+
And value is celpy.celtypes.BoolType(source=False)
8889

8990
Scenario: or_error
9091

@@ -95,6 +96,7 @@ Scenario: or_ignore
9596

9697
When CEL expression '{}.a || true' is evaluated
9798
Then eval_error is None
99+
And value is celpy.celtypes.BoolType(source=True)
98100

99101
Scenario: all_error
100102

@@ -105,6 +107,7 @@ Scenario: all_ignore
105107

106108
When CEL expression '[{"a": 1}, {}].all(v, v.a == 2)' is evaluated
107109
Then eval_error is None
110+
And value is celpy.celtypes.BoolType(source=False)
108111

109112
Scenario: exists_error
110113

@@ -115,6 +118,7 @@ Scenario: exists_ignore
115118

116119
When CEL expression '[{"a": 1}, {}].exists(v, v.a == 1)' is evaluated
117120
Then eval_error is None
121+
And value is celpy.celtypes.BoolType(source=True)
118122

119123
Scenario: exists_one_error
120124

‎src/celpy/c7nlib.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -997,12 +997,12 @@ def flow_logs(
997997
# TODO: Refactor into a function in ``CELFilter``. Should not be here.
998998
client = C7N.filter.manager.session_factory().client("ec2")
999999
logs = client.describe_flow_logs().get("FlowLogs", ())
1000-
m = C7N.filter.manager.get_model()
1000+
dimension = C7N.filter.manager.get_model().dimension
10011001
resource_map: Dict[str, List[Dict[str, Any]]] = {}
10021002
for fl in logs:
10031003
resource_map.setdefault(fl["ResourceId"], []).append(fl)
1004-
if resource.get(m.id) in resource_map:
1005-
flogs = resource_map[cast(str, resource.get(m.id))]
1004+
if resource.get(dimension) in resource_map:
1005+
flogs = resource_map[cast(str, resource.get(dimension))]
10061006
return json_to_cel(flogs)
10071007
return json_to_cel([])
10081008

‎src/xlate/c7n_to_cel.py‎

Lines changed: 7 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -877,7 +877,6 @@ def type_flow_log_rewrite(resource: str, c7n_filter: Dict[str, Any]) -> str:
877877
878878
Relies on :py:func:`celpy.c7nlib.flow_logs` to get flow_log details via the C7N Filter.
879879
"""
880-
op = c7n_filter.get("op", "equal")
881880
set_op = c7n_filter.get("set-up", "or")
882881
enabled = []
883882
if "enabled" in c7n_filter:
@@ -890,55 +889,37 @@ def type_flow_log_rewrite(resource: str, c7n_filter: Dict[str, Any]) -> str:
890889
if c7n_filter.get("log-group"):
891890
log_group = c7n_filter.get("log-group")
892891
clauses.append(
893-
C7N_Rewriter.atomic_op_map[op].format(
894-
"resource.flow_logs().LogGroupName", f"{C7N_Rewriter.q(log_group)}"
895-
)
892+
f"resource.flow_logs().exists(x, x.LogGroupName == {C7N_Rewriter.q(log_group)})"
896893
)
897894
if c7n_filter.get("log-format"):
898895
log_format = c7n_filter.get("log-format")
899896
clauses.append(
900-
C7N_Rewriter.atomic_op_map[op].format(
901-
"resource.flow_logs().LogFormat", f"{C7N_Rewriter.q(log_format)}"
902-
)
897+
f"resource.flow_logs().exists(x, x.LogFormat == {C7N_Rewriter.q(log_format)})"
903898
)
904899
if c7n_filter.get("traffic-type"):
905900
traffic_type = cast(str, c7n_filter.get("traffic-type"))
906901
clauses.append(
907-
C7N_Rewriter.atomic_op_map[op].format(
908-
"resource.flow_logs().TrafficType",
909-
f"{C7N_Rewriter.q(traffic_type.upper())}",
910-
)
902+
f"resource.flow_logs().exists(x, x.TrafficType == {C7N_Rewriter.q(traffic_type.upper())})"
911903
)
912904
if c7n_filter.get("destination-type"):
913905
destination_type = c7n_filter.get("destination-type")
914906
clauses.append(
915-
C7N_Rewriter.atomic_op_map[op].format(
916-
"resource.flow_logs().LogDestinationType",
917-
f"{C7N_Rewriter.q(destination_type)}",
918-
)
907+
f"resource.flow_logs().exists(x, x.LogDestinationType == {C7N_Rewriter.q(destination_type)})"
919908
)
920909
if c7n_filter.get("destination"):
921910
destination = c7n_filter.get("destination")
922911
clauses.append(
923-
C7N_Rewriter.atomic_op_map[op].format(
924-
"resource.flow_logs().LogDestination",
925-
f"{C7N_Rewriter.q(destination)}",
926-
)
912+
f"resource.flow_logs().exists(x, x.LogDestination == {C7N_Rewriter.q(destination)})"
927913
)
928914
if c7n_filter.get("status"):
929915
status = c7n_filter.get("status")
930916
clauses.append(
931-
C7N_Rewriter.atomic_op_map[op].format(
932-
"resource.flow_logs().FlowLogStatus", f"{C7N_Rewriter.q(status)}"
933-
)
917+
f"resource.flow_logs().exists(x, x.FlowLogStatus == {C7N_Rewriter.q(status)})"
934918
)
935919
if c7n_filter.get("deliver-status"):
936920
deliver_status = c7n_filter.get("deliver-status")
937921
clauses.append(
938-
C7N_Rewriter.atomic_op_map[op].format(
939-
"resource.flow_logs().DeliverLogsStatus",
940-
f"{C7N_Rewriter.q(deliver_status)}",
941-
)
922+
f"resource.flow_logs().exists(x, x.DeliverLogsStatus == {C7N_Rewriter.q(deliver_status)})"
942923
)
943924

944925
if len(clauses) > 0:

‎tests/test_c7n_to_cel.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -459,18 +459,18 @@ def test_flow_logs_rewrite():
459459
clause_1 = {
460460
"enabled": "true", "type": "flow-logs", "destination-type": "s3",
461461
}
462-
expected = 'size(resource.flow_logs()) != 0 && (resource.flow_logs().LogDestinationType == "s3")'
462+
expected = 'size(resource.flow_logs()) != 0 && (resource.flow_logs().exists(x, x.LogDestinationType == "s3"))'
463463
assert C7N_Rewriter.type_flow_log_rewrite("vpc", clause_1) == expected
464464

465465
clause_2 = {'type': 'flow-logs', 'enabled': True,
466466
'set-op': 'or', 'op': 'equal', 'traffic-type': 'all', 'status': 'active',
467467
'log-group': 'vpc-logs'}
468-
expected = 'size(resource.flow_logs()) != 0 && (resource.flow_logs().LogGroupName == "vpc-logs" || resource.flow_logs().TrafficType == "ALL" || resource.flow_logs().FlowLogStatus == "active")'
468+
expected = 'size(resource.flow_logs()) != 0 && (resource.flow_logs().exists(x, x.LogGroupName == "vpc-logs") || resource.flow_logs().exists(x, x.TrafficType == "ALL") || resource.flow_logs().exists(x, x.FlowLogStatus == "active"))'
469469
assert C7N_Rewriter.type_flow_log_rewrite("vpc", clause_2) == expected
470470

471471
clause_3 = {'type': 'flow-logs', 'enabled': True,
472472
"log-format": "this", "destination": "that", "deliver-status": "the-other-thing"}
473-
expected = 'size(resource.flow_logs()) != 0 && (resource.flow_logs().LogFormat == "this" || resource.flow_logs().LogDestination == "that" || resource.flow_logs().DeliverLogsStatus == "the-other-thing")'
473+
expected = 'size(resource.flow_logs()) != 0 && (resource.flow_logs().exists(x, x.LogFormat == "this") || resource.flow_logs().exists(x, x.LogDestination == "that") || resource.flow_logs().exists(x, x.DeliverLogsStatus == "the-other-thing"))'
474474
assert C7N_Rewriter.type_flow_log_rewrite("vpc", clause_3) == expected
475475

476476

‎type_check/lineprecision.txt‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@ celpy.__main__ 551 243 12 63 233 0
55
celpy.adapter 163 34 3 9 111 6
66
celpy.c7nlib 1663 344 16 152 1151 0
77
celpy.celparser 411 136 68 23 184 0
8-
celpy.celtypes 1483 386 15 235 810 37
9-
celpy.evaluation 3859 1127 252 242 2222 16
8+
celpy.celtypes 1497 394 15 238 812 38
9+
celpy.evaluation 3874 1135 252 243 2226 18
1010
gherkinize 1142 531 14 96 481 20
1111
test_gherkinize 5581 5014 135 4 428 0
1212
xlate 0 0 0 0 0 0
13-
xlate.c7n_to_cel 1755 387 103 144 1115 6
13+
xlate.c7n_to_cel 1736 383 103 136 1108 6

0 commit comments

Comments
 (0)