diff --git a/assets/queries/terraform/gcp/sql_db_instance_with_minimum_log_duration/metadata.json b/assets/queries/terraform/gcp/sql_db_instance_with_minimum_log_duration/metadata.json new file mode 100644 index 00000000000..4ae6769bd9c --- /dev/null +++ b/assets/queries/terraform/gcp/sql_db_instance_with_minimum_log_duration/metadata.json @@ -0,0 +1,14 @@ +{ + "id": "00335e17-674c-442e-a64c-9436e60e6efb", + "queryName": "Beta - SQL DB Instance With Minimum Log Duration", + "severity": "MEDIUM", + "category": "Observability", + "descriptionText": "No 'google_sql_database_instance' resource based on POSTGRES should set the 'log_min_duration_statement' flag to a value that is not '-1'", + "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance.html#settings-1", + "platform": "Terraform", + "descriptionID": "00335e17", + "cloudProvider": "gcp", + "cwe": "532", + "riskScore": "3.0", + "experimental": "true" +} diff --git a/assets/queries/terraform/gcp/sql_db_instance_with_minimum_log_duration/query.rego b/assets/queries/terraform/gcp/sql_db_instance_with_minimum_log_duration/query.rego new file mode 100644 index 00000000000..e08ba591961 --- /dev/null +++ b/assets/queries/terraform/gcp/sql_db_instance_with_minimum_log_duration/query.rego @@ -0,0 +1,42 @@ +package Cx + +import data.generic.common as common_lib +import data.generic.terraform as tf_lib + +CxPolicy[result] { + resource := input.document[i].resource.google_sql_database_instance[name] + + contains(resource.database_version, "POSTGRES") + results := get_results(resource, name) + + result := { + "documentId": input.document[i].id, + "resourceType": "google_sql_database_instance", + "resourceName": tf_lib.get_resource_name(resource, name), + "searchKey": results.searchKey, + "issueType": "IncorrectValue", + "keyExpectedValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' should set 'log_min_duration_statement' to '-1'", [name]), + "keyActualValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' sets 'log_min_duration_statement' to '%s'", [name, results.value]), + "searchLine": results.searchLine + } +} + +get_results(resource, name) = results { # array + resource.settings.database_flags[x].name == "log_min_duration_statement" + resource.settings.database_flags[x].value != "-1" + + results := { + "searchKey" : sprintf("google_sql_database_instance[%s].settings.database_flags[%d].name", [name, x]), + "searchLine" : common_lib.build_search_line(["resource", "google_sql_database_instance", name, "settings", "database_flags", x, "name"], []), + "value" : resource.settings.database_flags[x].value + } +} else = results { # single object + resource.settings.database_flags.name == "log_min_duration_statement" + resource.settings.database_flags.value != "-1" + + results := { + "searchKey" : sprintf("google_sql_database_instance[%s].settings.database_flags.name", [name]), + "searchLine" : common_lib.build_search_line(["resource", "google_sql_database_instance", name, "settings", "database_flags", "name"], []), + "value" : resource.settings.database_flags.value + } +} diff --git a/assets/queries/terraform/gcp/sql_db_instance_with_minimum_log_duration/test/negative.tf b/assets/queries/terraform/gcp/sql_db_instance_with_minimum_log_duration/test/negative.tf new file mode 100644 index 00000000000..4556ec46bba --- /dev/null +++ b/assets/queries/terraform/gcp/sql_db_instance_with_minimum_log_duration/test/negative.tf @@ -0,0 +1,82 @@ +resource "google_sql_database_instance" "negative_1" { + name = "main-instance" + database_version = "MYSQL_8_0" # Is not a POSTGRES instance + region = "us-central1" + + settings { + database_flags { + name = "log_min_duration_statement" + value = "2" + } # Flag is not set to "-1" + } +} + +resource "google_sql_database_instance" "negative_2" { + name = "mysql-instance-without-flag" + database_version = "POSTGRES_17" + region = "us-central1" + + # Default value is -1 +} + +resource "google_sql_database_instance" "negative_3" { + name = "postgres-instance-without-flag" + database_version = "POSTGRES_16" + region = "us-central1" + + settings {} # Default value is -1 +} + +resource "google_sql_database_instance" "negative_4" { + name = "postgres-instance-without-flag" + database_version = "POSTGRES_15" + region = "us-central1" + + settings { + database_flags { + name = "sample_flag1" + value = "off" + } + # Default value is -1 + } +} + +resource "google_sql_database_instance" "negative_5" { + name = "mysql-instance-with-flag" + database_version = "POSTGRES_15" + region = "us-central1" + + settings { + tier = "db-f1-micro" + + database_flags { + name = "sample_flag1" + value = "off" + } + + database_flags { # Has flag set to "-1" + name = "log_min_duration_statement" + value = "-1" + } + + database_flags { + name = "sample_flag2" + value = "off" + } + } +} + +resource "google_sql_database_instance" "negative_6" { # Single object support test + name = "mysql-instance-with-flag" + database_version = "POSTGRES_15" + region = "us-central1" + + settings { + tier = "db-f1-micro" + + database_flags { + name = "log_min_duration_statement" + value = "-1" + } # Has flag set to "-1" + } +} diff --git a/assets/queries/terraform/gcp/sql_db_instance_with_minimum_log_duration/test/positive.tf b/assets/queries/terraform/gcp/sql_db_instance_with_minimum_log_duration/test/positive.tf new file mode 100644 index 00000000000..5b5411348de --- /dev/null +++ b/assets/queries/terraform/gcp/sql_db_instance_with_minimum_log_duration/test/positive.tf @@ -0,0 +1,35 @@ +resource "google_sql_database_instance" "positive_1" { + name = "postgres-instance-with-flag" + database_version = "POSTGRES_14" + region = "us-central1" + + settings { + database_flags { + name = "sample_flag1" + value = "off" + } + + database_flags { # Flag is not set to "-1" + name = "log_min_duration_statement" + value = "2" + } + + database_flags { + name = "sample_flag2" + value = "off" + } + } +} + +resource "google_sql_database_instance" "positive_2" { # Single object support test + name = "postgres-instance-with-flag" + database_version = "POSTGRES_14" + region = "us-central1" + + settings { + database_flags { + name = "log_min_duration_statement" + value = "3" + } # Flag is not set to "-1" + } +} diff --git a/assets/queries/terraform/gcp/sql_db_instance_with_minimum_log_duration/test/positive_expected_result.json b/assets/queries/terraform/gcp/sql_db_instance_with_minimum_log_duration/test/positive_expected_result.json new file mode 100644 index 00000000000..3838bb1e30e --- /dev/null +++ b/assets/queries/terraform/gcp/sql_db_instance_with_minimum_log_duration/test/positive_expected_result.json @@ -0,0 +1,12 @@ +[ + { + "queryName": "Beta - SQL DB Instance With Minimum Log Duration", + "severity": "MEDIUM", + "line": 13 + }, + { + "queryName": "Beta - SQL DB Instance With Minimum Log Duration", + "severity": "MEDIUM", + "line": 31 + } +] diff --git a/assets/similarityID_transition/terraform_gcp.yaml b/assets/similarityID_transition/terraform_gcp.yaml index e982e0a14a4..caf79063daf 100644 --- a/assets/similarityID_transition/terraform_gcp.yaml +++ b/assets/similarityID_transition/terraform_gcp.yaml @@ -3,6 +3,10 @@ similarityIDChangeList: queryName: Beta - Google DNS Policy Logging Disabled observations: "" change: 2 + - queryId: 00335e17-674c-442e-a64c-9436e60e6efb + queryName: Beta - SQL DB Instance With Minimum Log Duration + observations: "" + change: 2 - queryId: 8895abb4-6491-4ae6-9c33-c2f360752b7a queryName: Beta - SQL DB Instance Without Disconnections Logging observations: ""