feat(query): implements "Beta - Cloud Asset Inventory Disabled" - Terraform/gcp

[cx-andre-pereira]

Reason for Proposed Changes

• Currently there is no query to ensure that a given "google_project_service" resource included within its "service" field the API service name "cloudasset.googleapis.com”. Including this value is a prerequisite to allow the proper use of Cloud Asset Inventory.

• Quoting CIS_Google_Cloud_Platform_Foundation_Benchmark_v4.0.0 page 117: "The GCP resources and IAM policies captured by GCP Cloud Asset Inventory enables security analysis, resource change tracking, and compliance auditing. It is recommended GCP Cloud Asset Inventory be enabled for all GCP projects."

Proposed Changes

• Implemented the new query with support for :

  • "service" field set to "cloudasset.googleapis.com”
  • "service" field set with a "each.value" cycle dependent on the "for_each" field value that can set to a "toset()" declaration or a regular set.
  • Use of "locals" variables which supports the same 3 other value attributions if they are defined with the locals block and properly referred through local.VAR_NAME.

• The test samples exemplify all possible and supported value attribution, note this is not a comprehensive list of ways the "service" attribute can be set but it should cover most common scenarios.

• It was decided the query will scan to ensure at least one valid "service" field for each individual "project" that is scanned.

• When the query triggers for a given project all "google_project_service" for all documents will flag individually.

• If no "google_project_service" resource exists the query will not flag.

Tenable Reference

I submit this contribution under the Apache-2.0 license.

[github-actions]

KICS version: v2.1.13

Category Results CRITICAL 0 HIGH 0 MEDIUM 0 LOW 0 INFO 0 TRACE 0 TOTAL 0	Metric Values Files scanned 1 Files parsed 1 Files failed to scan 0 Total executed queries 47 Queries failed to execute 0 Execution time 0