Skip to content

Commit 013435b

Browse files
cx-andre-pereiracx-andre-pereira
committed
New samples and auxiliary functions to properly handle SQLSERVER databases (do not support 'TRUSTED_CLIENT_CERTIFICATE_REQUIRED' value
1 parent d04ce1d commit 013435b

7 files changed

Lines changed: 125 additions & 15 deletions

File tree

‎assets/queries/terraform/gcp/sql_db_instance_with_ssl_disabled/query.rego‎

Lines changed: 19 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ CxPolicy[result] {
1919
"keyExpectedValue": "'settings.ip_configuration' should be defined and not null",
2020
"keyActualValue": "'settings.ip_configuration' is undefined or null",
2121
"searchLine": common_lib.build_search_line(["resource", "google_sql_database_instance", name],["settings"]),
22-
"remediation": "ip_configuration {\n\t\trequire_ssl = true\n\t}\n",
22+
"remediation": sprintf("ip_configuration {\n\t\tssl_mode = %s\n\t}\n", [get_remediation(input.document[i].resource.google_sql_database_instance[name].database_version)]),
2323
"remediationType": "addition",
2424
}
2525
}
@@ -40,28 +40,30 @@ CxPolicy[result] {
4040
"keyExpectedValue": "'settings.ip_configuration.ssl_mode' should be defined and not null",
4141
"keyActualValue": "'settings.ip_configuration.ssl_mode' is undefined or null",
4242
"searchLine": common_lib.build_search_line(["resource", "google_sql_database_instance", name],["settings", "ip_configuration"]),
43-
"remediation": "ssl_mode = TRUSTED_CLIENT_CERTIFICATE_REQUIRED",
43+
"remediation": sprintf("ssl_mode = %s", [get_remediation(input.document[i].resource.google_sql_database_instance[name].database_version)]),
4444
"remediationType": "addition",
4545
}
4646
}
4747

4848
CxPolicy[result] {
49-
settings := input.document[i].resource.google_sql_database_instance[name].settings
49+
resource := input.document[i].resource.google_sql_database_instance[name]
50+
settings := resource.settings
5051

51-
not common_lib.inArray(allowed_ssl_modes, settings.ip_configuration.ssl_mode)
52+
database_version := input.document[i].resource.google_sql_database_instance[name].database_version
53+
kev := get_expected_key(database_version, settings.ip_configuration.ssl_mode)
5254

5355
result := {
5456
"documentId": input.document[i].id,
5557
"resourceType": "google_sql_database_instance",
5658
"resourceName": tf_lib.get_resource_name(input.document[i].resource.google_sql_database_instance[name].settings, name),
5759
"searchKey": sprintf("google_sql_database_instance[%s].settings.ip_configuration.ssl_mode", [name]),
5860
"issueType": "IncorrectValue",
59-
"keyExpectedValue": "'settings.ip_configuration.ssl_mode' should be set to 'ENCRYPTED_ONLY' or 'TRUSTED_CLIENT_CERTIFICATE_REQUIRED'",
61+
"keyExpectedValue": sprintf("'settings.ip_configuration.ssl_mode' should be set to %s", [kev]),
6062
"keyActualValue": sprintf("'settings.ip_configuration.ssl_mode' is set to '%s'", [settings.ip_configuration.ssl_mode]),
6163
"searchLine": common_lib.build_search_line(["resource", "google_sql_database_instance", name],["settings", "ip_configuration", "ssl_mode"]),
6264
"remediation": json.marshal({
6365
"before": settings.ip_configuration.ssl_mode,
64-
"after": "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
66+
"after": get_remediation(database_version)
6567
}),
6668
"remediationType": "replacement",
6769
}
@@ -88,3 +90,14 @@ CxPolicy[result] { # legacy support (terraform version < 6.0.1
8890
"remediationType": "replacement",
8991
}
9092
}
93+
94+
get_expected_key(database_version, ssl_mode) = "'ENCRYPTED_ONLY'" {
95+
contains(database_version, "SQLSERVER")
96+
ssl_mode == "ENCRYPTED_ONLY"
97+
} else = "'ENCRYPTED_ONLY' or 'TRUSTED_CLIENT_CERTIFICATE_REQUIRED'" {
98+
not common_lib.inArray(allowed_ssl_modes, ssl_mode)
99+
}
100+
101+
get_remediation(database_version) = "ENCRYPTED_ONLY" {
102+
contains(database_version, "SQLSERVER")
103+
} else = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"

‎assets/queries/terraform/gcp/sql_db_instance_with_ssl_disabled/test/negative1.tf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
1-
resource "google_sql_database_instance" "negative1" { # legacy support (terraform version < 6.0.1)
1+
resource "google_sql_database_instance" "negative1_1" { # legacy support (terraform version < 6.0.1)
22
provider = google-beta
33

44
name = "private-instance-${random_id.db_name_suffix.hex}"
5+
database_version = "POSTGRES_15"
56
region = "us-central1"
67

78
depends_on = [google_service_networking_connection.private_vpc_connection]

‎assets/queries/terraform/gcp/sql_db_instance_with_ssl_disabled/test/negative2.tf‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
1-
resource "google_sql_database_instance" "negative1" {
1+
resource "google_sql_database_instance" "negative2_1" {
22
name = "private-instance-encrypted"
3+
database_version = "POSTGRES_15"
34
region = "us-central1"
45

56
depends_on = [google_service_networking_connection.private_vpc_connection]
@@ -15,8 +16,9 @@ resource "google_sql_database_instance" "negative1" {
1516
}
1617
}
1718

18-
resource "google_sql_database_instance" "negative2" {
19+
resource "google_sql_database_instance" "negative2_2" {
1920
name = "private-instance-trusted-cert"
21+
database_version = "POSTGRES_15"
2022
region = "us-central1"
2123

2224
depends_on = [google_service_networking_connection.private_vpc_connection]

‎assets/queries/terraform/gcp/sql_db_instance_with_ssl_disabled/test/negative3.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
resource "google_sql_database_instance" "negative3_1" {
2+
name = "private-instance-encrypted"
3+
database_version = "SQLSERVER_2017_STANDARD"
4+
region = "us-central1"
5+
6+
depends_on = [google_service_networking_connection.private_vpc_connection]
7+
8+
settings {
9+
tier = "db-f1-micro"
10+
11+
ip_configuration {
12+
ipv4_enabled = false
13+
private_network = google_compute_network.private_network.id
14+
ssl_mode = "ENCRYPTED_ONLY" # Only allows connections encrypted with SSL/TLS
15+
}
16+
}
17+
}

‎assets/queries/terraform/gcp/sql_db_instance_with_ssl_disabled/test/positive1.tf‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
1-
resource "google_sql_database_instance" "positive1" { # legacy support (terraform version < 6.0.1)
1+
resource "google_sql_database_instance" "positive1_1" { # legacy support (terraform version < 6.0.1)
22
provider = google-beta
33

44
name = "private-instance-${random_id.db_name_suffix.hex}"
5+
database_version = "POSTGRES_15"
56
region = "us-central1"
67

78
depends_on = [google_service_networking_connection.private_vpc_connection]
@@ -11,10 +12,11 @@ resource "google_sql_database_instance" "positive1" { # legacy support (terraf
1112
}
1213
}
1314

14-
resource "google_sql_database_instance" "positive2" { # legacy support (terraform version < 6.0.1)
15+
resource "google_sql_database_instance" "positive1_2" { # legacy support (terraform version < 6.0.1)
1516
provider = google-beta
1617

1718
name = "private-instance-${random_id.db_name_suffix.hex}"
19+
database_version = "POSTGRES_15"
1820
region = "us-central1"
1921

2022
depends_on = [google_service_networking_connection.private_vpc_connection]
@@ -29,10 +31,11 @@ resource "google_sql_database_instance" "positive2" { # legacy support (terraf
2931
}
3032
}
3133

32-
resource "google_sql_database_instance" "positive3" { # legacy support (terraform version < 6.0.1)
34+
resource "google_sql_database_instance" "positive1_3" { # legacy support (terraform version < 6.0.1)
3335
provider = google-beta
3436

3537
name = "private-instance-${random_id.db_name_suffix.hex}"
38+
database_version = "POSTGRES_15"
3639
region = "us-central1"
3740

3841
depends_on = [google_service_networking_connection.private_vpc_connection]

‎assets/queries/terraform/gcp/sql_db_instance_with_ssl_disabled/test/positive2.tf‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11

2-
resource "google_sql_database_instance" "positive1" {
2+
resource "google_sql_database_instance" "positive2_1" {
33
name = "private-instance-no-ssl-mode"
4+
database_version = "POSTGRES_15"
45
region = "us-central1"
56

67
depends_on = [google_service_networking_connection.private_vpc_connection]
@@ -16,8 +17,9 @@ resource "google_sql_database_instance" "positive1" {
1617
}
1718
}
1819

19-
resource "google_sql_database_instance" "positive2" {
20+
resource "google_sql_database_instance" "positive2_2" {
2021
name = "private-instance-unspecified"
22+
database_version = "POSTGRES_15"
2123
region = "us-central1"
2224

2325
depends_on = [google_service_networking_connection.private_vpc_connection]
@@ -33,8 +35,9 @@ resource "google_sql_database_instance" "positive2" {
3335
}
3436
}
3537

36-
resource "google_sql_database_instance" "positive3" {
38+
resource "google_sql_database_instance" "positive2_3" {
3739
name = "private-instance-unencrypted"
40+
database_version = "POSTGRES_15"
3841
region = "us-central1"
3942

4043
depends_on = [google_service_networking_connection.private_vpc_connection]

‎assets/queries/terraform/gcp/sql_db_instance_with_ssl_disabled/test/positive3.tf‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
resource "google_sql_database_instance" "positive3_1" {
2+
name = "private-instance-no-ssl-mode"
3+
database_version = "SQLSERVER_2017_STANDARD"
4+
region = "us-central1"
5+
6+
depends_on = [google_service_networking_connection.private_vpc_connection]
7+
8+
settings {
9+
tier = "db-f1-micro"
10+
11+
ip_configuration {
12+
ipv4_enabled = false
13+
private_network = google_compute_network.private_network.id
14+
# Undefined "ssl_mode"
15+
}
16+
}
17+
}
18+
19+
resource "google_sql_database_instance" "positive3_2" {
20+
name = "private-instance-unspecified"
21+
database_version = "SQLSERVER_2017_STANDARD"
22+
region = "us-central1"
23+
24+
depends_on = [google_service_networking_connection.private_vpc_connection]
25+
26+
settings {
27+
tier = "db-f1-micro"
28+
29+
ip_configuration {
30+
ipv4_enabled = false
31+
private_network = google_compute_network.private_network.id
32+
ssl_mode = "SSL_MODE_UNSPECIFIED" # Unexpected value
33+
}
34+
}
35+
}
36+
37+
resource "google_sql_database_instance" "positive3_3" {
38+
name = "private-instance-unencrypted"
39+
database_version = "SQLSERVER_2017_STANDARD"
40+
region = "us-central1"
41+
42+
depends_on = [google_service_networking_connection.private_vpc_connection]
43+
44+
settings {
45+
tier = "db-f1-micro"
46+
47+
ip_configuration {
48+
ipv4_enabled = false
49+
private_network = google_compute_network.private_network.id
50+
ssl_mode = "ALLOW_UNENCRYPTED_AND_ENCRYPTED" # Allows unencrypted (non-SSL/non-TLS) connections
51+
}
52+
}
53+
}
54+
55+
resource "google_sql_database_instance" "positive3_4" {
56+
name = "private-instance-unspecified"
57+
database_version = "SQLSERVER_2017_STANDARD"
58+
region = "us-central1"
59+
60+
depends_on = [google_service_networking_connection.private_vpc_connection]
61+
62+
settings {
63+
tier = "db-f1-micro"
64+
65+
ip_configuration {
66+
ipv4_enabled = false
67+
private_network = google_compute_network.private_network.id
68+
ssl_mode = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED" # Value Unsupported by SQLSERVER databases
69+
}
70+
}
71+
}

0 commit comments

Comments
 (0)