Skip to content

Commit b41fea5

Browse files
cx-andre-pereiracx-andre-pereira
authored
feat(query): implements "Beta - SQL DB Instance With Unrecommended Logging Threshold" (#7782)
* implements query to ensure query to ensure that a "google_sql_database_instance" resource has the 'log_min_messages' flag set to a valid severity
1 parent d3d9fbd commit b41fea5

File tree

6 files changed

+254
-0
lines changed

6 files changed

+254
-0
lines changed

‎assets/queries/terraform/gcp/sql_db_instance_with_unrecommended_logging_threshold/metadata.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"id": "ecbbe763-95dc-47e6-8660-84ff751e5acf",
3+
"queryName": "Beta - SQL DB Instance With Unrecommended Logging Threshold",
4+
"severity": "LOW",
5+
"category": "Observability",
6+
"descriptionText": "All 'google_sql_database_instance' resources based on POSTGRES should have the 'log_min_messages' flag set to 'WARNING' or a higher severity to prevent excessive logging",
7+
"descriptionUrl": "https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance.html#settings-1",
8+
"platform": "Terraform",
9+
"descriptionID": "ecbbe763",
10+
"cloudProvider": "gcp",
11+
"cwe": "779",
12+
"riskScore": "1.0",
13+
"experimental": "true"
14+
}

‎assets/queries/terraform/gcp/sql_db_instance_with_unrecommended_logging_threshold/query.rego‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
package Cx
2+
3+
import data.generic.common as common_lib
4+
import data.generic.terraform as tf_lib
5+
6+
CxPolicy[result] {
7+
resource := input.document[i].resource.google_sql_database_instance[name]
8+
9+
contains(resource.database_version, "POSTGRES")
10+
results := get_results(resource, name)
11+
12+
result := {
13+
"documentId": input.document[i].id,
14+
"resourceType": "google_sql_database_instance",
15+
"resourceName": tf_lib.get_resource_name(resource, name),
16+
"searchKey": results.searchKey,
17+
"issueType": "IncorrectValue",
18+
"keyExpectedValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' should set 'log_min_messages' to 'WARNING' or a higher severity", [name]),
19+
"keyActualValue" : sprintf("'google_sql_database_instance[%s].settings.database_flags' sets 'log_min_messages' to '%s'", [name, results.value]),
20+
"searchLine": results.searchLine
21+
}
22+
}
23+
24+
get_results(resource, name) = results { # array
25+
resource.settings.database_flags[x].name == "log_min_messages"
26+
not common_lib.inArray(["WARNING", "ERROR", "LOG", "FATAL", "PANIC"], resource.settings.database_flags[x].value)
27+
28+
results := {
29+
"searchKey" : sprintf("google_sql_database_instance[%s].settings.database_flags[%d].name", [name, x]),
30+
"searchLine" : common_lib.build_search_line(["resource", "google_sql_database_instance", name, "settings", "database_flags", x, "name"], []),
31+
"value" : resource.settings.database_flags[x].value
32+
}
33+
} else = results { # single object
34+
resource.settings.database_flags.name == "log_min_messages"
35+
not common_lib.inArray(["WARNING", "ERROR", "LOG", "FATAL", "PANIC"], resource.settings.database_flags.value)
36+
37+
results := {
38+
"searchKey" : sprintf("google_sql_database_instance[%s].settings.database_flags.name", [name]),
39+
"searchLine" : common_lib.build_search_line(["resource", "google_sql_database_instance", name, "settings", "database_flags", "name"], []),
40+
"value" : resource.settings.database_flags.value
41+
}
42+
}

‎assets/queries/terraform/gcp/sql_db_instance_with_unrecommended_logging_threshold/test/negative.tf‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
resource "google_sql_database_instance" "negative_1" {
2+
name = "main-instance"
3+
database_version = "MYSQL_8_0" # Is not a POSTGRES instance
4+
region = "us-central1"
5+
6+
settings {
7+
tier = "db-f1-micro"
8+
9+
database_flags {
10+
name = "log_min_messages"
11+
value = "DEBUG3"
12+
}
13+
}
14+
}
15+
16+
resource "google_sql_database_instance" "negative_2" {
17+
name = "mysql-instance-without-flag"
18+
database_version = "POSTGRES_17"
19+
region = "us-central1"
20+
21+
# Defaults to "ERROR"
22+
}
23+
24+
resource "google_sql_database_instance" "negative_3" {
25+
name = "postgres-instance-without-flag"
26+
database_version = "POSTGRES_16"
27+
region = "us-central1"
28+
29+
settings {} # Defaults to "ERROR"
30+
}
31+
32+
resource "google_sql_database_instance" "negative_4" {
33+
name = "postgres-instance-without-flag"
34+
database_version = "POSTGRES_15"
35+
region = "us-central1"
36+
37+
settings {
38+
database_flags {
39+
name = "sample_flag1"
40+
value = "DEBUG3"
41+
}
42+
# Defaults to "ERROR"
43+
}
44+
}
45+
46+
resource "google_sql_database_instance" "negative_5" {
47+
name = "mysql-instance-with-flag"
48+
database_version = "POSTGRES_15"
49+
region = "us-central1"
50+
51+
settings {
52+
tier = "db-f1-micro"
53+
54+
database_flags {
55+
name = "sample_flag1"
56+
value = "off"
57+
}
58+
59+
database_flags {
60+
name = "log_min_messages"
61+
value = "FATAL"
62+
} # Has flag set to "FATAL"
63+
64+
database_flags {
65+
name = "sample_flag2"
66+
value = "off"
67+
}
68+
}
69+
}
70+
71+
resource "google_sql_database_instance" "negative_6" {
72+
name = "mysql-instance-with-flag"
73+
database_version = "POSTGRES_15"
74+
region = "us-central1"
75+
76+
settings {
77+
tier = "db-f1-micro"
78+
79+
database_flags {
80+
name = "log_min_messages"
81+
value = "ERROR"
82+
} # Has flag set to "ERROR"
83+
}
84+
}
85+
86+
resource "google_sql_database_instance" "negative_7" {
87+
name = "mysql-instance-with-flag"
88+
database_version = "POSTGRES_15"
89+
region = "us-central1"
90+
91+
settings {
92+
tier = "db-f1-micro"
93+
94+
database_flags {
95+
name = "log_min_messages"
96+
value = "LOG"
97+
} # Has flag set to "LOG"
98+
}
99+
}
100+
101+
resource "google_sql_database_instance" "negative_8" {
102+
name = "mysql-instance-with-flag"
103+
database_version = "POSTGRES_15"
104+
region = "us-central1"
105+
106+
settings {
107+
tier = "db-f1-micro"
108+
109+
database_flags {
110+
name = "log_min_messages"
111+
value = "WARNING"
112+
} # Has flag set to "WARNING" (minimum)
113+
}
114+
}
115+
116+
resource "google_sql_database_instance" "negative_9" {
117+
name = "mysql-instance-with-flag"
118+
database_version = "POSTGRES_15"
119+
region = "us-central1"
120+
121+
settings {
122+
tier = "db-f1-micro"
123+
124+
database_flags {
125+
name = "log_min_messages"
126+
value = "PANIC"
127+
} # Has flag set to "PANIC"
128+
}
129+
}

‎assets/queries/terraform/gcp/sql_db_instance_with_unrecommended_logging_threshold/test/positive.tf‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
resource "google_sql_database_instance" "positive_1" {
2+
name = "postgres-instance-with-flag"
3+
database_version = "POSTGRES_14"
4+
region = "us-central1"
5+
6+
settings {
7+
database_flags {
8+
name = "sample_flag1"
9+
value = "off"
10+
}
11+
12+
database_flags {
13+
name = "log_min_messages"
14+
value = "NOTICE"
15+
} # Flag is set to "NOTICE"
16+
17+
database_flags {
18+
name = "sample_flag2"
19+
value = "off"
20+
}
21+
}
22+
}
23+
24+
resource "google_sql_database_instance" "positive_2" {
25+
name = "postgres-instance-with-flag"
26+
database_version = "POSTGRES_13"
27+
region = "us-central1"
28+
29+
settings {
30+
database_flags {
31+
name = "log_min_messages"
32+
value = "DEBUG5"
33+
} # Flag is set to "DEBUG5"
34+
}
35+
}
36+
37+
resource "google_sql_database_instance" "positive_3" {
38+
name = "postgres-instance-with-flag"
39+
database_version = "POSTGRES_13"
40+
region = "us-central1"
41+
42+
settings {
43+
database_flags {
44+
name = "log_min_messages"
45+
value = "INFO"
46+
} # Flag is set to "INFO"
47+
}
48+
}

‎assets/queries/terraform/gcp/sql_db_instance_with_unrecommended_logging_threshold/test/positive_expected_result.json‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
[
2+
{
3+
"queryName": "Beta - SQL DB Instance With Unrecommended Logging Threshold",
4+
"severity": "LOW",
5+
"line": 13
6+
},
7+
{
8+
"queryName": "Beta - SQL DB Instance With Unrecommended Logging Threshold",
9+
"severity": "LOW",
10+
"line": 31
11+
},
12+
{
13+
"queryName": "Beta - SQL DB Instance With Unrecommended Logging Threshold",
14+
"severity": "LOW",
15+
"line": 44
16+
}
17+
]

‎assets/similarityID_transition/terraform_gcp.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@ similarityIDChangeList:
33
queryName: Beta - Google DNS Policy Logging Disabled
44
observations: ""
55
change: 2
6+
- queryId: ecbbe763-95dc-47e6-8660-84ff751e5acf
7+
queryName: Beta - SQL DB Instance With Unrecommended Logging Threshold
8+
observations: ""
9+
change: 2
610
- queryId: c3655703-569b-42ec-8027-ef8835d989c0
711
queryName: Beta - SQL DB Instance With Contained Database Authentication
812
observations: ""

0 commit comments

Comments
 (0)