In line 25 I’m checking for the exact filter which should be set in line 130 of the mock file. For some weird reason, it gives me true regardless of whatever the mock file contains.
I tried this in my last post’s mock file and I got false if that text wasn’t present. I’m just confused about what I’m doing wrong since I’ve used this “is” rule for all my policies.
It’s not responding to changes in the mock file because your initial filter statement doesn’t seem to be capturing anything. This policy is based on google_logging_metric but in the provided playground example it’s empty. In the link below I print the contents:
https://play.sentinelproject.io/p/zD235eb4mjt
Generally speaking, it can be helpful to print out the contents of what you’re operating against to ensure that they are what you expect them to be.
Logic to check for unexpected values may also be helpful.
Yeah thanks for that. Seems I was checking for “update” and “create” but not “no-op”. Spent way too long on a simple mistake
I can definitely relate!