Security Command Center regional endpoints

gcloud

The following gcloud CLI command groups require you to use a regional endpoint:

• gcloud model-armor: manages Model Armor resources
• gcloud scc bqexports: manages BigQuery export configurations
• gcloud scc findings: manages findings
• gcloud scc muteconfigs: manages mute rule configurations
• gcloud scc notifications: manages continuous export configurations

For all other gcloud scc command groups, you must use the default endpoint for the Security Command Center API.

Change the service endpoint

To switch to a regional endpoint, run the following command:

gcloud config set api_endpoint_overrides/SERVICE \
    https://SERVICE.LOCATION.rep.googleapis.com/

To switch to the default endpoint, run the following command:

gcloud config unset api_endpoint_overrides/SERVICE

Replace the following:

• SERVICE: the service to configure; use modelarmor for the Model Armor API or securitycenter for the Security Command Center API
• LOCATION: a supported location for the service

Optionally, you can create a named configuration for the gcloud CLI that uses the regional endpoint. Before you run a gcloud CLI command, you can switch to the named configuration by running the gcloud config configurations activate command.

Run a gcloud CLI command

When you run a gcloud CLI command for the Security Command Center API, you must always specify the location. There are a few ways to do this:

• Use the --location flag.
• If you provide the full path of the resource name, use a format that specifies a location, like projects/123/sources/456/locations/LOCATION/findings/a1b2c3.

The following example shows how to use the --location flag.

The gcloud scc findings list command lists an organization's findings in a specific location.

Before using any of the command data below, make the following replacements:

• ORGANIZATION_ID: the numeric ID of the organization
• LOCATION: a supported location for the Security Command Center API

Execute the gcloud scc findings list command:

gcloud scc findings list ORGANIZATION_ID --location=LOCATION

gcloud scc findings list ORGANIZATION_ID --location=LOCATION

gcloud scc findings list ORGANIZATION_ID --location=LOCATION

The response contains a list of findings.

Terraform

To learn how to apply or remove a Terraform configuration, see Basic Terraform commands. For more information, see the Terraform provider reference documentation.

provider "google" {
  alias                              = "securitycenter_v2_endpoint_us"
  security_center_v2_custom_endpoint = "https://securitycenter.us.rep.googleapis.com/v2/"
}

Go

Use one of the following regional endpoints:

Model Armor API

modelarmor.LOCATION.rep.googleapis.com:443

Security Command Center API

securitycenter.LOCATION.rep.googleapis.com:443

Replace LOCATION with a supported location for the service.

The following code sample shows how to create a Security Command Center API client that uses a regional endpoint.

import (
	"context"
	"fmt"

	securitycenter "cloud.google.com/go/securitycenter/apiv2"
	"google.golang.org/api/option"
)

// createClientWithEndpoint creates a Security Command Center client for a
// regional endpoint.
func createClientWithEndpoint(repLocation string) error {
	// Assemble the regional endpoint URL using provided location.
	repEndpoint := fmt.Sprintf("securitycenter.%s.rep.googleapis.com:443", repLocation)
	// Instantiate client for regional endpoint. Use this client to access resources that
	// are subject to data residency controls, and that are located in the region
	// specified in repLocation.
	repCtx := context.Background()
	repClient, err := securitycenter.NewClient(repCtx, option.WithEndpoint(repEndpoint))
	if err != nil {
		return err
	}
	defer repClient.Close()

	return nil
}

Java

Use one of the following regional endpoints:

Model Armor API

modelarmor.LOCATION.rep.googleapis.com:443

Security Command Center API

securitycenter.LOCATION.rep.googleapis.com:443

Replace LOCATION with a supported location for the service.

The following code sample shows how to create a Security Command Center API client that uses a regional endpoint.

import com.google.cloud.securitycenter.v2.SecurityCenterClient;
import com.google.cloud.securitycenter.v2.SecurityCenterSettings;
import java.io.IOException;

public class CreateClientWithEndpoint {

  public static void main(String[] args) throws IOException {
    // TODO: Replace the value with the endpoint for the region in which your
    // Security Command Center data resides.
    String regionalEndpoint = "securitycenter.me-central2.rep.googleapis.com:443";
    SecurityCenterClient client = createClientWithEndpoint(regionalEndpoint);
    System.out.println("Client initiated with endpoint: " + client.getSettings().getEndpoint());
  }

  // Creates Security Command Center client for a regional endpoint.
  public static SecurityCenterClient createClientWithEndpoint(String regionalEndpoint)
      throws java.io.IOException {
    SecurityCenterSettings regionalSettings =
        SecurityCenterSettings.newBuilder().setEndpoint(regionalEndpoint).build();
    return SecurityCenterClient.create(regionalSettings);
  }
}

Python

Use one of the following regional endpoints:

Model Armor API

modelarmor.LOCATION.rep.googleapis.com

Security Command Center API

securitycenter.LOCATION.rep.googleapis.com

Replace LOCATION with a supported location for the service.

The following code sample shows how to create a Security Command Center API client that uses a regional endpoint.

from google.cloud import securitycenter_v2


def create_client_with_endpoint(api_endpoint) -> securitycenter_v2.SecurityCenterClient:
    """
    Creates a Security Command Center client for a regional endpoint.
    Args:
        api_endpoint: the regional endpoint's hostname, like 'securitycenter.REGION.rep.googleapis.com'
    Returns:
        securitycenter_v2.SecurityCenterClient: returns a client for the regional endpoint
    """
    regional_client = securitycenter_v2.SecurityCenterClient(
        client_options={"api_endpoint": api_endpoint}
    )
    print(
        "Regional client initiated with endpoint: {}".format(
            regional_client.api_endpoint
        )
    )
    return regional_client

REST

To access the following REST API resource types, you must use a regional service endpoint:

Model Armor API

Endpoint: https://modelarmor.LOCATION.rep.googleapis.com

Replace LOCATION with a supported location for the service.

Resource types: All resource types

Security Command Center API

Endpoint: https://securitycenter.LOCATION.rep.googleapis.com

Replace LOCATION with a supported location for the service.

Resource types:

• folders.locations.bigQueryExports
• folders.locations.findings
• folders.locations.muteConfigs
• folders.locations.notificationConfigs
• organizations.locations.bigQueryExports
• organizations.locations.findings
• organizations.locations.muteConfigs
• organizations.locations.notificationConfigs
• projects.locations.bigQueryExports
• projects.locations.findings
• projects.locations.muteConfigs
• projects.locations.notificationConfigs

Replace LOCATION with a supported location for the service.

For all other resource types, you must use the default endpoint.