• Have a Google Cloud Platform project with billing & Cloud Build API enabled
• Have access to a user with Owner role on the project
• Have gcloud SDK and CLI installed on your machine (quickstart)
• Have firebase-tools CLI installed on your machine

• Go to https://<YOUR_SLACK_TEAM>.slack.com/apps/new/A0F7YS25R-bots
• Enter a name for the bot to post with. (i.e. gcp-alert-service)
• Click Add bot integration.
• Wait until the UI displays the API Token and copy the string (i.e. xxxx-yyyyyyyyyyyy-zzzzzzzzzzzzzzzzzzzzzzzz)

• Make sure you are logged in with your firebase CLI tool.
• Edit <YOUR_PROJECT_ID> in .firebaserc with your real project ID.
• Run $ firebase functions:config:set gslack.api_token="xxxx-yyyyyyyyyyyy-zzzzzzzzzzzzzzzzzzzzzzzz" (Replace with your slack API token)

• Make sure your gcloud SDK and CLI environment is authenticated against the requested GCP project with a user that has Owner permissions.
• Run $ make create-export PROJECT=<YOUR_PROJECT_ID> - Replace <YOUR_PROJECT_ID> with your project ID (Run once on the first deployment).
• Deploy the function, run: $ yarn deploy or $ npm run deploy from the functions dir.

• Navigate to your project's Firestore console.
• Create a new collection named "gSlack" in Firestore.
• Add documents to the new collection with the following schema:

• Each document is a rule that will be evaluted by the function and will be posted to the corresponding slack channel if the evaluated test expression passes as true.
• If you want to temporary disable a rule, simply update the disabled field to true.

The information received by the function for the log entry is something like this:

{
 protoPayload: {
  @type:  "type.googleapis.com/google.cloud.audit.AuditLog"
  status: {
  }
  authenticationInfo: {
   principalEmail:  "[email protected]"
  }
  requestMetadata: {
   callerIp:  "..."
   callerSuppliedUserAgent:  "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36,gzip(gfe)"
  }
  serviceName:  "storage.googleapis.com"
  methodName:  "storage.buckets.create"
  authorizationInfo: [
   0: {
    permission:  "storage.buckets.create"
    granted:  true
   }
  ]
  resourceName:  "projects/_/buckets/bababab-vadim"
  serviceData: {
   @type:  "type.googleapis.com/google.iam.v1.logging.AuditData"
   policyDelta: {
    bindingDeltas: [
     0: {
      action:  "ADD"
      role:  "roles/storage.legacyBucketOwner"
      member:  "projectOwner:..."
     }
     1: {
      action:  "ADD"
      role:  "roles/storage.legacyBucketOwner"
      member:  "projectEditor:..."
     }
     2: {
      action:  "ADD"
      role:  "roles/storage.legacyBucketReader"
      member:  "projectViewer:..."
     }
    ]
   }
  }
  request: {
   defaultObjectAcl: {
    bindings: [
     0: {
      members: [
       0:  "projectOwner:..."
       1:  "projectEditor:..."
      ]
      role:  "roles/storage.legacyObjectOwner"
     }
     1: {
      members: [
       0:  "projectViewer:..."
      ]
      role:  "roles/storage.legacyObjectReader"
     }
    ]
    @type:  "type.googleapis.com/google.iam.v1.Policy"
   }
  }
 }
 insertId:  "552D5EE8A9ED9.A65A379.EF01047D"
 resource: {
  type:  "gcs_bucket"
  labels: {
   storage_class:  ""
   location:  "US-CENTRAL1"
   bucket_name:  "bababab-vadim"
   project_id:  "..."
  }
 }
 timestamp:  "2017-06-26T05:07:46.673Z"
 severity:  "NOTICE"
 logName:  "projects/.../logs/cloudaudit.googleapis.com%2Factivity"
 receiveTimestamp:  "2017-06-26T05:07:54.586745618Z"
}

• Display bucket name, created/deleted, location, project and by who.

• Document ID: bucket-create-delete:

• Document Fields:

      channel: "general",
      disabled: false,
      test: "$.protoPayload.serviceName==='storage.googleapis.com' && ( $.protoPayload.methodName==='storage.buckets.create' || $.protoPayload.methodName==='storage.buckets.delete')",
      message: "Bucket '${$.resource.labels.bucket_name}' was ${$.protoPayload.methodName==='storage.buckets.create'?'created':'deleted'} at location '${$.resource.labels.location}' by '${$.protoPayload.authenticationInfo.principalEmail}' in project '${$.resource.labels.project_id}'",
      attachments: null
  
  

• Slack Message Formatting

  Use the attachments field (type of array of maps) to add Slack message attachments instead of the default text message.

  One of 'message' or 'attachments' fields must not be null.

      channel: "general",
      disabled: false,
      test: "$.protoPayload.serviceName==='storage.googleapis.com' && ( $.protoPayload.methodName==='storage.buckets.create' || $.protoPayload.methodName==='storage.buckets.delete')",
      message: null,
      attachments: [
          {
              title: "Cloud Storage Notification",
              color: "${$.protoPayload.methodName==='storage.buckets.create'?'#36a64f':'#de1738'}",
              fields: [
                  {
                      short: true,
                      title: "Operation",
                      value: "${$.protoPayload.methodName==='storage.buckets.create'?'Create':'Delete'}"
                  },
                  {
                      short: true,
                      title: "Resource Name",
                      value: "${$.resource.labels.bucket_name}"
                  },
                  {
                      short: true,
                      title: "Project ID",
                      value: "${$.resource.labels.project_id}"
                  },
                  {
                      short: true,
                      title: "User",
                      value: "${$.protoPayload.authenticationInfo.principalEmail}"
                  },
              ]
          }
      ]
  

  

• Display instance name, started/stopped, zone, project and by who.

• Document ID: gce-start-stop:

• Document Fields:

      channel: "devops",
      disabled: false,
      test: "$.protoPayload.serviceName==='compute.googleapis.com' && ( $.protoPayload.methodName==='v1.compute.instances.start' || $.protoPayload.methodName==='v1.compute.instances.stop') && $.operation.last",
      message: "Instance '${$.protoPayload.resourceName.split('/').slice(-1)[0]}' was ${$.protoPayload.methodName==='v1.compute.instances.start'?'started':'stopped'} at zone '${$.resource.labels.zone}' by '${$.protoPayload.authenticationInfo.principalEmail}' in project '${$.resource.labels.project_id}'",
      attachments: null
  

• Display project, module, version and by who.

• Document ID: gae-new-version:

• Document Fields:

      channel: "@user",
      disabled: false,
      test: "$.protoPayload.serviceName==='appengine.googleapis.com' && $.protoPayload.methodName==='google.appengine.v1.Versions.CreateVersion' && $.operation.last",
      message: "Google AppEngine version created with version ID '${$.resource.labels.version_id}' for module '${$.resource.labels.module_id}' by '${$.protoPayload.authenticationInfo.principalEmail}' in project '${$.resource.labels.project_id}'",
      attachments: null