Manually update to TrendAI Vision One File Security Storage for Google Cloud Platform - zero downtime

Views:

Before you begin

Complete all six checks in Before you begin first. In particular, do not start if C1FSS runs across more than one project, and make sure you have recorded which bucket each Bucket Listener protects, along with the C1FSS notification id and topic for every bucket. You need those details to roll back.

You can follow this zero-downtime process to update from TrendAI Cloud One File Storage Security (C1FSS) to TrendAI Vision One™ File Security Storage (V1FSS) in Google Cloud Platform. This method keeps your existing C1FSS stack active and scanning objects while you set up and validate V1FSS.

During the overlap, both products receive every object event and scan independently. If you do not use the promote-or-quarantine plugin, the overlap means duplicate scanning and some cosmetic metadata churn, and nothing that can lose or misplace an object. If you use the plugin and are carrying its settings over, the overlap also means that both products move the same objects, which introduces the risk of a race condition. If that risk is not acceptable, use the brief-downtime path instead.

Procedure

Install V1FSS and turn on bucket scanning.

In the TrendAI Vision One console, go to Cloud Security → File Security, and then on the Inventory page, under Storage, select GCP.
Click Add a single Google Cloud Project, select Single Google Cloud Project, and complete the required fields on the General information page.

On the Features and Permissions page, enable File Security Storage and select the regions where you want to deploy the File Security scanner.

Important

Select every region where C1FSS runs, which you recorded in Before you begin. For the full deployment procedure, see Deploy File Security Storage to Google Cloud Platform .

Important

If this project is already connected to TrendAI Vision One for another feature, do not create a new connection. Add File Security Storage to the existing connection instead, so that the regenerated package still carries every feature the project already had.

In the Google Cloud console, open Cloud Shell, and then follow the steps shown on the Add Google Cloud Project page in the TrendAI Vision One console to upload and extract the deployment package.

If you use the promote-or-quarantine plugin, configure the promote and quarantine settings now, before you install.

See Update promote and quarantine settings.

Note

On this path, setting the destinations now means that both products move objects during the overlap. If that is not acceptable, either use the brief-downtime path, or leave the V1FSS destinations empty so that V1FSS only tags objects, and set the destinations after C1FSS is torn down.

See what would be created. This command changes nothing.
```
./deploy.sh precheck
```
This command is a Terraform plan, not a permissions check.
Deploy V1FSS.
```
./deploy.sh install
```
The script creates a Terraform state bucket in your project, applies the Cloud Account Management module and the File Security Storage module, and registers the project with TrendAI Vision One automatically. There is no separate registration step. Output is written to deploy_gcp.log.

If Cloud Shell times out partway through, reconnect, change back to the deployment directory, and run the same command again. Progress is recorded in the Terraform remote state rather than in your shell, so the command continues from where it stopped.
Confirm that the project appears under GCP on the Inventory page after the deployment completes.
Confirm that the buckets in your project are listed, all showing as not protected.

Note

It might take some time to sync your buckets to TrendAI Vision One.
Turn on scanning for the buckets you recorded in Before you begin.
Also turn on scanning for one bucket that C1FSS does not protect, in the same region.

This bucket is your test target in step 2, and an empty bucket is enough. Step 2 explains why you validate here rather than on a bucket that C1FSS protects.

Check point

The project appears under GCP on the Inventory page.
Your buckets are listed under the project.
Each bucket that C1FSS protects now has two notification configurations, and the test bucket has one.

The Google Cloud console does not show notification configurations, so check them in Cloud Shell.

gcloud storage buckets notifications list gs://<bucket>

Both products now receive every object event and scan independently. This is the zero-downtime overlap.

Validate that V1FSS is working.

Important

Run every check in this step against the bucket that C1FSS does not protect, which is the one you turned on in step 1. Do not run them against a bucket that C1FSS protects, because during the overlap you cannot tell which product produced the result.

Upload a new file to the bucket.

In the Google Cloud console, go to Cloud Storage → Buckets, open the bucket, and then click Upload files.
Check the scan activity on the TrendAI Vision One File Security page.

This is what proves that V1FSS scanned the file.
Check that the scan result is on the object.
Cloud Storage has object metadata rather than tags. Click the object in the Cloud Storage browser and check its custom metadata, or read it in Cloud Shell.
```
gcloud storage objects describe gs://<bucket>/<object> --format="value(custom_fields)"
```
Expect fss-scan-result to be no issues found.
Upload the EICAR test file to the bucket.
Run the following in Cloud Shell, changing only the bucket name on the last line.
```
curl -sSL https://secure.eicar.org/eicar.com.txt -o eicar.com.txt && \
gcloud storage cp eicar.com.txt gs://<bucket>/v1fss-verify-eicar.com.txt
```
Note

EICAR is a standard anti-malware test string, not real malware.
Wait for the scan results to sync and the malware detection to appear in TrendAI Vision One.

This is what proves that V1FSS detected the file.
Check the object metadata.

Expect fss-scan-result to be malicious.

Note

A race condition may occur when a V1FSS promote or quarantine destination is configured, or when the C1FSS promote-or-quarantine plugin is in use. During concurrent processing, V1FSS may move or quarantine an object while the C1FSS scanner is still processing it. As a result, the object may no longer be available when C1FSS attempts to access it, causing expected errors in the C1FSS scanner logs. The same applies in reverse: whichever product moves the object first, the other one finds nothing.

If you left the V1FSS destinations empty, the plugin is the only product moving objects and there is no race, but V1FSS may still reach an object that the plugin has already moved and record a failed scan for it. This is harmless, and it stops when the plugin is removed.

If you use the plugin and want to end the double move sooner without removing C1FSS scanning, delete only the plugin function as described in step 4. C1FSS continues to scan and tag objects. Record the plugin settings first if you might still roll back.

Remove the C1FSS bucket notification.

This is the cutover. After this step, only V1FSS scans that bucket. Deleting the notification stops event delivery to C1FSS immediately, one bucket at a time, while leaving the C1FSS function, topic, service accounts, and IAM configuration intact, so the cutover is reversible without redeploying anything.

List the bucket's notification configurations and identify the C1FSS one. There is no console page for this.

gcloud storage buckets notifications list gs://<bucket>

You see two configurations. Tell them apart as follows.

Identifying the notification configurations

Product	`id`	`topic`
C1FSS	`cloud-functions-<project>-<tenant>-tp`	A topic in a Google-managed tenant project, in the form `projects/<name>-tp/topics/cloud-functions-…`
V1FSS	A short number, such as `143`	`projects/<your-project>/topics/v1fss-…-scanner`, with `custom_attributes.creator` set to `V1 FSS_V1_FILESECURITY`

Important

Record the full C1FSS id and topic before you delete the configuration. You use them after a rollback redeployment to confirm that the same configuration came back.

Delete the C1FSS notification configuration.

gcloud storage buckets notifications delete \
  projects/_/buckets/<bucket>/notificationConfigs/<c1-notification-id>

Confirm that only the V1FSS configuration remains.
```
gcloud storage buckets notifications list gs://<bucket>
```
Expect exactly one entry, pointing at the …-scanner topic.
Repeat for every bucket in this region.

The overlap ends here. From this point on, each of these buckets is scanned by V1FSS only. The C1FSS infrastructure is still standing, but it receives no events.

Check point

Each bucket lists only the …-scanner notification configuration.
Upload one file to a bucket that C1FSS protected, and confirm that it is scanned. Use either case from step 2. Both the TrendAI Vision One scan activity and the object metadata should show the result.

This is your end-to-end confirmation on a bucket that C1FSS protected. C1FSS resources still exist at this point, so if the check fails, you can roll back by redeploying the C1FSS Bucket Listener function before you go on to step 4.

Remove the old C1FSS stacks.

Remove the promote-or-quarantine plugin, if you use one.

Do this before you delete the stacks, so that the plugin's trigger subscription is removed with its consumer rather than left pointing at a deleted topic. Do not leave the plugin in place while you dismantle the C1FSS stack, because it would keep moving objects that V1FSS is now the only product scanning.

If you still have the plugin's Terraform state, run the following in the plugin's directory, once for each instance.

terraform destroy

Otherwise, remove its resources by name. Delete the function first, so that nothing is still consuming the topic.

gcloud functions delete <plugin-function-name>
gcloud storage rm -r gs://artifacts-promote-and-quarantine-plugin-<suffix>
gcloud iam service-accounts delete qua-pro-plugin-sa-<suffix>@<project-id>.iam.gserviceaccount.com
gcloud iam roles delete plugin_storage_bucket_write_<suffix> --project="$(gcloud config get-value project)"
gcloud iam roles delete plugin_storage_bucket_access_<suffix> --project="$(gcloud config get-value project)"

Then confirm that nothing is left granting the plugin access to your buckets. No member should match qua-pro-plugin-sa-.

gcloud storage buckets get-iam-policy gs://<scanning-or-destination-bucket>

Important

The plugin's service account is not part of any C1FSS stack, so nothing in the stack teardown removes it. Skipping this substep leaves a live identity with delete and write access to your scanning, promote, and quarantine buckets, with no process monitoring or auditing it.

Repeat for every plugin instance in this region.

Delete the C1FSS stacks.

Follow the steps in Delete GCP stacks, using the teardown command for your C1FSS generation, which you identified in Before you begin.

Next steps

The update is complete. V1FSS is scanning your buckets and C1FSS is decommissioned.

Rollback for the zero-downtime update

If you encounter an issue while updating from C1FSS to V1FSS, you can follow these steps to roll back to C1FSS. Enabling V1FSS changed nothing about C1FSS, so in most cases there is nothing to restore and you only turn V1FSS off.

Procedure

If you have already removed the C1FSS bucket notification, put it back first, before you turn V1FSS off.

Redeploy the C1FSS Bucket Listener function. In the Google Cloud console, go to Cloud Functions, open the …-bucket-listener function, click Edit, change nothing, and then click Deploy.

Important

Do not try to recreate the notification configuration directly with gcloud storage buckets notifications create. Its target topic is in a Google-managed project with no IAM surface your account can reach, so the command fails with PERMISSION_DENIED regardless of the id and topic you recorded. Redeploying the function is what makes Cloud Functions provision the topic again and recreate the notification configuration.

Confirm that the notification configuration is back and matches what you recorded.

gcloud storage buckets notifications list gs://<bucket>

If you deleted the plugin function early to end the double move, recreate it with terraform apply in the plugin directory, using the settings you recorded.

Note

A new deployment_name value generates a fresh resource-name suffix, so the recreated instance is not named the same as the one you deleted.
In the TrendAI Vision One console, go to the File Security Inventory page and turn off scanning for the buckets.

This deletes only the V1FSS notification configuration. The TrendAI Vision One delete path is filtered by topic name, so the C1FSS configuration is never touched.

C1FSS scans the buckets as it did before the update.

Next steps

Important

Rollback is only possible before you delete the C1FSS stacks. After those are gone, rolling back means deploying C1FSS again from scratch.