Few enhancements to showoci

[hslange]

Hi,
I'm using showoci utility and I'm very satisfied with it.
I do have a few enhancements that make it even more useful:

1. KMS Key Vault information. KMS Key's are already supported, however some information is missing, like VaultID, CurrentKeyVersion and KeyShape data. This can be obtained relatively easy in the search query (in showoci_service.py). Instead of using "query key resources" use "query key resources return allAdditionalFields". This will return not only the Key information, but also the VaultID, CurrentKeyVersion and KeyShape data. This important data should also become part of the output (JSON or CSV) to make Key data complete.
2. Dynamic Groups Matching Rules. Identity Domain Dynamic Group data is currently missing data for an important field "maatchingRule" (current query always returns no data for the matching rule). This is highly likely due to a change in IAM API. and matching rules need to be explicitly specified in the call. In function __load_identity_domain_dynamic_resource_groups() add attributes="matchingRule" to the call to list_dynamic_resource_groups.
3. Vault Secrets support. As part of # Security and Logging, information related to Vault Secrets is currently missing. Would be nice to have this included in a future release to have an overview of all secrets being using and the Vaults they belong to. If using the similar mechanism as for KMS Keys, use the "query vaultsecret resources return allAdditionalFields" query to obtain the secret including vault data.

Hope this can be incorporated in a future release.
Thanks,
Herman

[adizohar]

Thank you, Herman.

I'll work on it and push the changes once they're completed.
I really appreciate the new suggestions!
I'll let you know once the code is ready. If you'd like to test it beforehand, I'd be happy to share it with you.

[hslange]

Thanks for the quick response.
Let me know when you have it ready for testing and I will support in the testing.

[adizohar]

Hi Herman,

Thank you for the detailed feedback and the enhancement suggestions. They were very helpful.

I've updated my code to implement all of the requested features:

KMS Key Vault information – added support for Vault ID, Current Key Version, and Key Shape.
Dynamic Group Matching Rules – fixed support for matchingRule and other attributes.
Vault Secrets – added support for Vault Secrets, including the associated Vault information.

I'm currently running a few days of testing to make sure everything is stable. If all goes well, I'm planning to include these changes in a release around July 14 or July 21.

If you'd like, I'm also happy to share a preview version of the code with you before the official release.

One interesting finding regarding Dynamic Groups: list_dynamic_groups does not return all attributes, even when attributes="matchingRule" (or other attributes) is specified. To work around this, I retrieve the list of Dynamic Groups first and then call get_dynamic_group for each one, which returns the complete set of attributes. In practice, this shouldn't have any noticeable performance impact since the number of Dynamic Groups is typically quite small.

Thanks again for taking the time to provide these suggestions and for using showoci!

Best regards,
Adi