|
| 1 | +# appe - Alerting Policy Price Estimator |
| 2 | + |
| 3 | +Starting January 2025, Google will begin charging for [Alerting Policies](https://cloud.google.com/monitoring/alerts). |
| 4 | + |
| 5 | +While Google has provided [documentation and examples](https://cloud.google.com/stackdriver/pricing#pricing-alerting), it is still very hard to actually estimate the cost of an Alerting Policy, let alone if you have dozens or possible hundreds of them. |
| 6 | +Using `appe`, you can easily estimate the price of not just an individual Alerting Policy, but all of them in your entire organization using a single command. |
| 7 | + |
| 8 | +## Quick Start |
| 9 | +1. Make sure you have Application Default Credentials set up correctly (See [Authentication](#authentication)) |
| 10 | +2. Make sure you have the [recommended roles](#recommended-roles) |
| 11 | +3. Download the [release](https://github.com/doitintl/gcp-tool-appe/releases) for your operating system and CPU architecture |
| 12 | +4. Run `appe` on your project with `appe -p PROJECT_ID` (or see [usage](#usage) for other examples) |
| 13 | + |
| 14 | +## Output |
| 15 | +`appe` can output human-readable output to the standard console output (`stdout`) or stream the results to a CSV file while it is scanning with the `--csvOutput FILENAME` flag. |
| 16 | + |
| 17 | +## Required Permissions |
| 18 | +In order to get the metadata of a policy or list the existing policies within a project, you will need the following permissions: |
| 19 | +- `monitoring.alertPolicies.get` |
| 20 | +- `monitoring.alertPolicies.list` |
| 21 | +These would be included in the [Monitoring AlertPolicy Viewer](https://cloud.google.com/iam/docs/understanding-roles#monitoring.alertPolicyViewer) (`roles/monitoring.alertPolicyViewer`) role. However, the metadata is not enough to estimate the price and we will need to actually execute the policy’s condition. This requires the `monitoring.timeSeries.list` permission, which is included in the [Monitoring Viewer](https://cloud.google.com/iam/docs/understanding-roles#monitoring.viewer) (`roles/monitoring.viewer`) role. |
| 22 | +If you want to run `appe` on more than individual policies, you will also need the `resourcemanager.projects.list` permission (which is also conveniently included in the Monitoring Viewer role). If you need to recursively scan for projects (i.e. go into subfolders), you will also need the `resourcemanager.folders.list` permission. |
| 23 | +You can also use the `--testPermissions` flag to let `appe` verify that you have the correct permissions before trying to use them in order to avoid errors in your logs. |
| 24 | + |
| 25 | +## Recommended Roles |
| 26 | +We recommend that you assign the following to roles for full compatibility: |
| 27 | +- [Monitoring Viewer](https://cloud.google.com/iam/docs/understanding-roles#monitoring.viewer) (`roles/monitoring.viewer`) |
| 28 | +- [Browser](https://cloud.google.com/iam/docs/understanding-roles#browser) (`roles/browser`) |
| 29 | + |
| 30 | +## Installation |
| 31 | +The easiest way to get and install `appe` is to download one of the pre-compiled binaries from the [releases](https://github.com/doitintl/gcp-tool-appe/releases). `appe` is a self-contained binary without any dependencies and can be run from anywhere. You do not need to download any runtime and there is no need for an installer. |
| 32 | + |
| 33 | +## Authentication |
| 34 | +`appe` uses [Application Default Credentials](https://cloud.google.com/docs/authentication/application-default-credentials) (ADC) to authenticate against the various APIs. |
| 35 | +If you are running `appe` on a Google Cloud compute service such as Compute Engine, it will use the service's Service Account to authenticate. |
| 36 | + |
| 37 | +If you are running `appe` locally, the easiest way to set up ADC is to use [gcloud](https://cloud.google.com/sdk/gcloud/reference/auth/application-default/login) by running: |
| 38 | +```bash |
| 39 | +gcloud auth application-default login |
| 40 | +``` |
| 41 | + |
| 42 | +See also https://cloud.google.com/docs/authentication/provide-credentials-adc#local-dev. |
| 43 | + |
| 44 | +### macOS |
| 45 | +Since the binary is not signed with an Apple Developer Certificate, your Mac will likely report it as untrustworthy. |
| 46 | +There are two ways to deal with this: |
| 47 | +1. Run `xattr -dr com.apple.quarantine <path to appe>` to add the executable to the allow list (credit to [openecoacoustics.org](https://openecoacoustics.org/resources/help-centre/software/unsigned/)) |
| 48 | +2. Compile it yourself (see below) |
| 49 | + |
| 50 | +### Compile appe Yourself |
| 51 | +The easiest way to do this is to: |
| 52 | +1. [Install Go](https://go.dev/doc/install) |
| 53 | +2. Run `go install github.com/doitintl/gcp-tool-appe@latest` |
| 54 | + |
| 55 | +This will download the dependencies, compile the program and put the executable in your `$GOPATH/bin` directory (see [GOPATH](https://go.dev/wiki/GOPATH)) |
| 56 | + |
| 57 | +Alternatively, you can also clone the repository and run `go build` to compile it manually. |
| 58 | + |
| 59 | +## Usage |
| 60 | +Using `appe` is fairly straightforward |
| 61 | + |
| 62 | +### Estimate the Price of Individual Policies |
| 63 | +To estimate the price for individual policies, you can reference them directly with the `--policy` flag: |
| 64 | +```bash |
| 65 | +./appe --policy projects/PROJECT_ID/alertPolicies/POLICY_ID |
| 66 | +``` |
| 67 | +You can also specify multiple policies: |
| 68 | +```bash |
| 69 | +./appe --policy projects/PROJECT_ID/alertPolicies/POLICY_ID_1,projects/PROJECT_ID/alertPolicies/POLICY_ID_2 |
| 70 | +``` |
| 71 | + |
| 72 | +### Estimate the Price for all Policies in a Project |
| 73 | +To estimate the price for all policies in a project, you can specify the project either with the `--project` flag or the shorthand `-p`: |
| 74 | +```bash |
| 75 | +./appe -p PROJECT_ID |
| 76 | +``` |
| 77 | +You can also specify multiple projects: |
| 78 | +```bash |
| 79 | +./appe -p PROJECT_ID_1,PROJECT_ID_2 |
| 80 | +``` |
| 81 | + |
| 82 | +### Estimate the Price for all Policies in all Projects in a Folder |
| 83 | +To estimate the price of all policies in all projects in a folder, you can specify the folder ID either with the `--folder` flag or the shorthand `-f`: |
| 84 | +```bash |
| 85 | +./appe -f FOLDER_ID |
| 86 | +``` |
| 87 | +You can also specify multiple folders: |
| 88 | +```bash |
| 89 | +./appe -f FOLDER_ID_1,FOLDER_ID_2 |
| 90 | +``` |
| 91 | +Note that you will need to specify the `--recursive` or `-r` flag to also scan subfolders. |
| 92 | + |
| 93 | +### Estimate the Price for all Policies in all Projects in an Organization |
| 94 | +To estimate the price of all policies in all projects in an organization, you can specify the organization ID either with the `--organization` flag or the shorthand `-o`: |
| 95 | +```bash |
| 96 | +./appe -o ORG_ID |
| 97 | +``` |
| 98 | +You can also specify multiple organizations: |
| 99 | +```bash |
| 100 | +./appe -o ORG_ID_1,ORG_ID_2 |
| 101 | +``` |
| 102 | +Note that you will need to specify the `--recursive` or `-r` flag to also scan subfolders. |
| 103 | + |
| 104 | +### All Flags |
| 105 | +``` |
| 106 | + -c, --csvOut string Path to a CSV file to redirect output to. If this is not set, human-readable output will be given on stdout. |
| 107 | + -d, --duration duration The delta from now to go back in time for query. Default is 30 days. (default 720h0m0s) |
| 108 | + -e, --excludeFolder strings One or more folders to exclude. Separated by ",". |
| 109 | + -f, --folder strings One or more folders to scan. Use the "-r" flag to scan recursively. Separated by ",". |
| 110 | + -h, --help help for appe |
| 111 | + -i, --includeDisabled If the application should also include disabled policies. (default false) |
| 112 | + -o, --organization strings One or more organizations to scan. Use the "-r" flag to scan recursively. Separated by ",". |
| 113 | + --policy strings One or more alerting policies to analyze. Names must be given in full in the format "projects/PROJECT_ID/alertPolicies/POLICY_ID". Separated by ",". |
| 114 | + -p, --project strings One or more projects to scan. Separated by ",". |
| 115 | + -q, --quotaProject string A quota or billing project. Useful if you don't have the serviceusage.services.use permission in the target project. |
| 116 | + -r, --recursive If parent should be scanned recursively. If this is not set, only projects at the root of the folder or organization will be scanned. (default false) |
| 117 | + -t, --testPermissions If the application should verify that the user has the necessary permissions before processing a project. (default false) |
| 118 | + --threads int Number of threads to use to process folders, projects and policies in parallel. (default 4) |
| 119 | + -v, --version version for appe |
| 120 | +``` |
0 commit comments