Manually update to TrendAI Vision One File Security Storage for Google Cloud Platform - brief downtime

Views:

Before you begin

Complete all six checks in Before you begin first. In particular, do not start if C1FSS runs across more than one project, and make sure you have recorded which bucket each Bucket Listener protects, along with the C1FSS notification id and topic for every bucket. You need those details to roll back.

You can follow this brief-downtime process to update from TrendAI Cloud One File Storage Security (C1FSS) to TrendAI Vision One™ File Security Storage (V1FSS) in Google Cloud Platform. Because C1FSS scanning stops before V1FSS scanning starts, this method avoids the race conditions that can occur when both products scan and act on the same object. No object is scanned twice, the fss- metadata does not change repeatedly, and no object is moved by both products.

Scanning pauses between step 2 and step 3. Objects uploaded during that gap are scanned by neither product. Both actions are single actions, so the gap is typically a few minutes and its duration depends on you, not on any deployment step.

Procedure

Install V1FSS, and do not turn on scanning for any bucket that C1FSS protects.

In the TrendAI Vision One console, go to Cloud Security → File Security, and then on the Inventory page, under Storage, select GCP.
Click Add a single Google Cloud Project, select Single Google Cloud Project, and complete the required fields on the General information page.

On the Features and Permissions page, enable File Security Storage and select the regions where you want to deploy the File Security scanner.

Important

Select every region where C1FSS runs, which you recorded in Before you begin. For the full deployment procedure, see Deploy File Security Storage to Google Cloud Platform .

Important

If this project is already connected to TrendAI Vision One for another feature, do not create a new connection. Add File Security Storage to the existing connection instead, so that the regenerated package still carries every feature the project already had.

In the Google Cloud console, open Cloud Shell, and then follow the steps shown on the Add Google Cloud Project page in the TrendAI Vision One console to upload and extract the deployment package.
If you use the promote-or-quarantine plugin, configure the promote and quarantine settings now, before you install.

See Update promote and quarantine settings. Configuring the settings now avoids a window in which V1FSS scans your objects but does not move them. On this path there is no overlap, so there is no risk of both products moving the same object.
See what would be created, and then deploy V1FSS.
```
./deploy.sh precheck
./deploy.sh install
```
The precheck command changes nothing. It is a Terraform plan, not a permissions check.

The install command creates a Terraform state bucket in your project, applies the Cloud Account Management module and the File Security Storage module, and registers the project with TrendAI Vision One automatically. There is no separate registration step. Output is written to deploy_gcp.log. If Cloud Shell times out partway through, reconnect, change back to the deployment directory, and run the same command again. Progress is recorded in the Terraform remote state rather than in your shell, so the command continues from where it stopped.
Confirm that the project appears under GCP on the Inventory page after the deployment completes, and that the buckets in your project are listed, all showing as not protected.

Note

It might take some time to sync your buckets to TrendAI Vision One.
Do not turn on scanning yet for any bucket that C1FSS protects.

Leaving them off until step 3 is what keeps the downtime short.

Optionally, turn on scanning now for a bucket that C1FSS does not protect, and use it to confirm that V1FSS works before you cut anything over. That bucket has no C1FSS notification configuration, so there is nothing to overlap with.

Check point

The project appears under GCP on the Inventory page.
Every bucket that C1FSS protects is listed under the project and still shows as not protected.
C1FSS is still scanning. Each bucket's notification configuration still points at a Cloud Functions topic, and its …-bucket-listener function is untouched.

Remove the C1FSS bucket notification.

Important

The downtime starts here. Objects uploaded between this step and step 3 are scanned by neither product.

Deleting the notification configuration stops event delivery immediately while leaving the C1FSS infrastructure intact, so you can put it back without redeploying if step 3 goes wrong. That matters more on this path than on the zero-downtime path, because your buckets are unprotected while you work.

List the bucket's notification configurations and identify the C1FSS one. At this point it is the only one, because V1FSS scanning is not turned on yet.
```
gcloud storage buckets notifications list gs://<bucket>
```
The C1FSS configuration has an id of cloud-functions-<project>-<tenant>-tp and a topic in a Google-managed tenant project.

Important

Record the full id and topic before you delete the configuration. They are what you use to confirm a rollback.

Delete the C1FSS notification configuration.

gcloud storage buckets notifications delete \
  projects/_/buckets/<bucket>/notificationConfigs/<c1-notification-id>

Confirm that the list is now empty, and then repeat for every bucket in this region.
```
gcloud storage buckets notifications list gs://<bucket>
```

If you use the promote-or-quarantine plugin, also delete the plugin function now, so that C1FSS stops moving objects as well as scanning them.

This is a function deletion rather than a notification deletion, because the plugin is triggered from the C1FSS scan-result Pub/Sub topic rather than from your bucket.

gcloud functions delete <plugin-function-name>

Important

Record the plugin's settings before you delete it. You need them to roll back, and because the plugin does not exist in V1FSS, this is the last configuration of it you have. Record PROMOTE_STORAGE_BUCKET, PROMOTE_MODE, QUARANTINE_STORAGE_BUCKET, and QUARANTINE_MODE, which you can read with the following command.

gcloud functions describe <plugin-function-name> --format="value(environmentVariables)"

Turn on scanning for the buckets you recorded in Before you begin.

The downtime ends when this step is complete.

Optionally, you can also turn on scanning for a bucket that C1FSS never protected, to confirm that V1FSS scans objects independently.

Validate that V1FSS is working.

Attribution is unambiguous on this path, because C1FSS is no longer scanning anything.

Upload a new file to the bucket.

In the Google Cloud console, go to Cloud Storage → Buckets, open the bucket, and then click Upload files.
Check that the scan result is on the object.
Cloud Storage has object metadata rather than tags. Click the object in the Cloud Storage browser and check its custom metadata, or read it in Cloud Shell.
```
gcloud storage objects describe gs://<bucket>/<object> --format="value(custom_fields)"
```
Expect fss-scan-result to be no issues found.
Check the scan activity on the TrendAI Vision One File Security page.
Upload the EICAR test file to the bucket.
Run the following in Cloud Shell, changing only the bucket name on the last line.
```
curl -sSL https://secure.eicar.org/eicar.com.txt -o eicar.com.txt && \
gcloud storage cp eicar.com.txt gs://<bucket>/v1fss-verify-eicar.com.txt
```
Note

EICAR is a standard anti-malware test string, not real malware.
Check the object metadata.

Expect fss-scan-result to be malicious.
Wait for the scan results to sync and the malware detection to appear in TrendAI Vision One.

If you carried your promote and quarantine settings over, confirm that objects actually move.

A successful scan says nothing about whether files reach the right place. The destination bucket, the folder layout setting, and the destination's IAM grant are three separate things that can be wrong. Confirm all of the following:

The EICAR object disappears from the source bucket and appears in your quarantine bucket.
The object is at the path you expect: gs://<quarantine>/<object> with use_source_bucket_as_folder = false, or gs://<quarantine>/<source-bucket>/<object> with true.
The clean object does the same against your promote destination.

Note

If you chose to leave the V1FSS destinations empty, expect objects to stop moving. They are tagged in place from now on and stay in the source bucket. If anything downstream reads your quarantine or promote bucket, it stops receiving objects.

Remove the old C1FSS stacks.

Follow step 4 of Manually update to TrendAI Vision One File Security Storage for Google Cloud Platform - zero downtime. The procedure is the same for both update paths, except that you have already deleted the plugin function in step 2. Remove the plugin's remaining resources, including its service account and custom roles, before you delete the stacks.

Next steps

The update is complete. V1FSS is scanning your buckets and C1FSS is decommissioned.

Rollback for the brief-downtime update

If you encounter an issue while updating from C1FSS to V1FSS, you can follow these steps to roll back to C1FSS. On this path the order is the reverse of the zero-downtime path: restore C1FSS first, and then turn V1FSS off, so that there is no window in which neither product scans.

Procedure

Redeploy the C1FSS Bucket Listener function.

Only the notification configuration was deleted, so the function and its source are still in place and this is a redeployment with no changes. In the Google Cloud console, go to Cloud Functions, open the …-bucket-listener function, click Edit, change nothing, and then click Deploy.

Important

Do not try to recreate the notification configuration directly with gcloud storage buckets notifications create. Its target topic is in a Google-managed project with no IAM surface your account can reach, so the command fails with PERMISSION_DENIED regardless of the id and topic you recorded.

If you have the Terraform generation of C1FSS, running terraform apply in the storages/ directory also works, and it does not require your state to be intact. Only the function needs to still exist.

Confirm that the notification configuration is back and matches what you recorded in step 2.

gcloud storage buckets notifications list gs://<bucket>

If you deleted the plugin function, recreate it with terraform apply in the plugin directory, using the settings you recorded in step 2.

Note

A new deployment_name value generates a fresh resource-name suffix, so the recreated instance is not named the same as the one you deleted.
Only then, in the TrendAI Vision One console, go to the File Security Inventory page and turn off scanning for the buckets.

This deletes only the V1FSS notification configuration. The TrendAI Vision One delete path is filtered by topic name, so the C1FSS configuration is never touched.

C1FSS scans the buckets as it did before the update.

Next steps

Important

Rollback is only possible before you delete the C1FSS stacks. After those are gone, rolling back means deploying C1FSS again from scratch.