fix: check required private log viewer permission

plugins/providers/bigquery/activity.go

@@ -19,6 +19,10 @@ var (
 	ErrEmptyActivityPayload       = errors.New("couldn't get payload from log entry")
 )
 
+const (
+	privateLogViewerPermission = "logging.privateLogEntries.list"
+)
+
 type auditLog struct {
 	*audit.AuditLog
 }

plugins/providers/bigquery/client.go

@@ -9,6 +9,7 @@ import (
 	bq "cloud.google.com/go/bigquery"
 	"github.com/goto/guardian/domain"
 	bqApi "google.golang.org/api/bigquery/v2"
+	"google.golang.org/api/cloudresourcemanager/v1"
 	"google.golang.org/api/iam/v1"
 	"google.golang.org/api/iterator"
 	"google.golang.org/api/option"
@@ -19,6 +20,7 @@ type bigQueryClient struct {
 	client     *bq.Client
 	iamService *iam.Service
 	apiClient  *bqApi.Service
+	crmService *cloudresourcemanager.Service
 }
 
 func NewBigQueryClient(projectID string, opts ...option.ClientOption) (*bigQueryClient, error) {
@@ -38,11 +40,17 @@ func NewBigQueryClient(projectID string, opts ...option.ClientOption) (*bigQuery
 		return nil, err
 	}
 
+	crmService, err := cloudresourcemanager.NewService(ctx, opts...)
+	if err != nil {
+		return nil, err
+	}
+
 	return &bigQueryClient{
 		projectID:  projectID,
 		client:     client,
 		iamService: iamService,
 		apiClient:  apiClient,
+		crmService: crmService,
 	}, nil
 }
 
@@ -346,6 +354,17 @@ func (c *bigQueryClient) ListRolePermissions(ctx context.Context, roleIDs []stri
 	return permissions, nil
 }
 
+func (c *bigQueryClient) CheckGrantedPermission(ctx context.Context, permissions []string) ([]string, error) {
+	res, err := c.crmService.Projects.TestIamPermissions(c.projectID, &cloudresourcemanager.TestIamPermissionsRequest{
+		Permissions: permissions,
+	}).Context(ctx).Do()
+	if err != nil {
+		return nil, err
+	}
+
+	return res.Permissions, nil
+}
+
 func (c *bigQueryClient) getGrantableRolesForTables() ([]string, error) {
 	var resourceName string
 	ctx := context.Background()

plugins/providers/bigquery/errors.go

@@ -29,4 +29,5 @@ var (
 	ErrCannotVerifyTablePermission = errors.New("cannot verify the table permissions since this bigquery project does not have any tables")
 
 	ErrActivityLogRetentionPeriodExceeded = errors.New("activity log retention period exceeded")
+	ErrPrivateLogViewerAccessNotGranted   = errors.New("private log viewer access not granted")
 )

plugins/providers/bigquery/provider.go

@@ -13,6 +13,7 @@ import (
 	"github.com/goto/guardian/core/provider"
 	"github.com/goto/guardian/domain"
 	"github.com/goto/guardian/pkg/slices"
+	"github.com/goto/guardian/utils"
 	"github.com/goto/salt/log"
 	"github.com/mitchellh/mapstructure"
 	"github.com/patrickmn/go-cache"
@@ -52,6 +53,7 @@ type BigQueryClient interface {
 	ListAccess(ctx context.Context, resources []*domain.Resource) (domain.MapResourceAccess, error)
 	GetRolePermissions(context.Context, string) ([]string, error)
 	ListRolePermissions(context.Context, []string) (map[string][]string, error)
+	CheckGrantedPermission(context.Context, []string) ([]string, error)
 }
 
 //go:generate mockery --name=cloudLoggingClientI --exported --with-expecter
@@ -379,6 +381,14 @@ func (p *Provider) ListActivities(ctx context.Context, pd domain.Provider, filte
 	if pd.Type != p.typeName {
 		return nil, ErrProviderTypeMismatch
 	}
+	creds, err := ParseCredentials(pd.Config.Credentials, p.encryptor)
+	if err != nil {
+		return nil, fmt.Errorf("parsing credentials: %w", err)
+	}
+	bqClient, err := p.getBigQueryClient(*creds)
+	if err != nil {
+		return nil, fmt.Errorf("initializing bigquery client: %w", err)
+	}
 	logClient, err := p.getCloudLoggingClient(ctx, *pd.Config)
 	if err != nil {
 		return nil, fmt.Errorf("initializing cloud logging client: %w", err)
@@ -413,7 +423,12 @@ func (p *Provider) ListActivities(ctx context.Context, pd domain.Provider, filte
 		filter.TimestampGte = &t
 	}
 
-	// TODO: check private log viewer access is granted
+	// check private log viewer access is granted
+	if grantedPermissions, err := bqClient.CheckGrantedPermission(ctx, []string{privateLogViewerPermission}); err != nil {
+		return nil, fmt.Errorf("checking granted permission: %w", err)
+	} else if !utils.ContainsString(grantedPermissions, privateLogViewerPermission) {
+		return nil, fmt.Errorf("%w: %q permissions is required", ErrPrivateLogViewerAccessNotGranted, privateLogViewerPermission)
+	}
 
 	filters := []string{
 		`protoPayload.serviceName="bigquery.googleapis.com"`,