Add data collection access logging app - #456
Conversation
Flask app for auditing data collection access grants via BigQuery monitoring tables. Includes forensic views for DC access history and group membership audit with filtering, sorting, and org override. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Hey @kvo3 that is a custom app, customers are allowed to bring whatever app into workbench, as long as the app is not a built-in default 1st party app, no review is required. However, for the purpose of the app, building a app just for DC audit is a bit overkill? It cost time and money to run that app, why not just query from BQ directly? For AoU, I just provide a snippet of python code and let them to run that code in Jupyter |
|
@yonghaoy you are correct. Basically at the end this app (or that script you provided to folks) is a bunch of sql queries that folks can run. |
pantherman594
left a comment
pantherman594
left a comment
There was a problem hiding this comment.
LGTM, left some small comments but none are blockers
| capture_output=True, text=True, timeout=10, | ||
| ) | ||
| for line in out.stdout.splitlines(): | ||
| for key in ("Organization:", "Google project:"): |
There was a problem hiding this comment.
In the future it might be easier to use --format json and read the output as json
There was a problem hiding this comment.
do we need to include this file?
| result = {} | ||
| try: | ||
| out = subprocess.run( | ||
| ["wb", "workspace", "describe"], |
There was a problem hiding this comment.
does this work? I don't see wb installed
| return jsonify({"error": str(e)}), 500 | ||
|
|
||
|
|
||
| @app.route("/health") |
6 participants
Adds a new Workbench devcontainer app for auditing data collection access grants. The app is a Flask web application that queries BigQuery monitoring tables (
workbench-bq-log-sink) to provide visibility into who has access to a data collection, how they got it (directly or via group membership), and when.Views
timestamp, and actor. Group rows are expandable to show who was in the group at the time of the grant. Supports hiding revoked access and toggling between
user-facing and internal group names.
Features
Infrastructure
BENCH-8927