Repository navigation
Conversation
|
Here is the summary of changes. You are about to add 1 region tag.
This comment is generated by snippet-bot.
|
product-auto-label
Bot
added
api: securitycenter
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates various generative AI examples to use newer model versions, transitions several default locations to 'global' or 'us-east5', refactors RAG examples to use the new Google GenAI SDK, and adds a new Security Command Center snippet for updating finding states. The review feedback highlights critical issues with non-existent model names (such as 'gemini-3.8-flash' and 'claude-sonnet-4-6') and points out that initializing the GenAI client with a 'global' location will cause RAG retrieval to fail since RAG is a regional service that must match the corpus region ('us-east5').
ca9f06d to
dddc245
Compare
…le and fix source IAM binding append
Problem:
1. The Security Command Center 'Managing findings using the API' guide
(how-to-api-create-manage-findings.md) has its Python sample for
'Updating a finding's state' commented out with TODO(b/374152194)
referencing the legacy v1 region tag securitycenter_update_finding_state
because securitycenter/snippets_v2/snippets_findings_v2.py was missing
a v2 sample for SecurityCenterClient.set_finding_state.
2. In securitycenter/snippets_v2/snippets_findings_v2.py,
set_source_iam_policy (securitycenter_set_source_iam_v2) passed
"policy": {"bindings": [binding]} to set_iam_policy, overwriting existing
IAM bindings on the source instead of appending to old_policy.bindings
(tracked in b/364943255).
Solution:
1. Add update_finding_state(organization_id: str, source_id: str,
finding_id: str) -> None (# [START securitycenter_update_finding_state_v2])
to securitycenter/snippets_v2/snippets_findings_v2.py and
test_update_finding_state to snippets_findings_v2_test.py following the
Google Cloud Python sample authoring standards (PEP 484 type annotations,
-> None return contract, explicit SetFindingStateRequest, NotFound and
GoogleAPICallError error handling to sys.stderr, and standardized stdout
fields).
2. Update set_source_iam_policy in snippets_findings_v2.py to append the
new Binding to old_policy.bindings and pass "policy": old_policy to
client.set_iam_policy.
dddc245 to
5e02e31
Compare
Summary
update_finding_state(region tagsecuritycenter_update_finding_state_v2) and its integration testtest_update_finding_stateinsecuritycenter/snippets_v2/snippets_findings_v2.pyso the Security Command Center Updating a finding's state documentation can migrate from the decommissionedv1API tov2.set_source_iam_policy(securitycenter_set_source_iam_v2) to append the new role binding toold_policy.bindingsinstead of replacing the bindings list with a single-element list, preventing accidental removal of existing IAM bindings on the source.