From 5fefbc8bac74cb3d45e58cfee207c04a13f69491 Mon Sep 17 00:00:00 2001 From: Andre Pereira <219305055+cx-andre-pereira@users.noreply.github.com> Date: Mon, 20 Oct 2025 17:25:31 +0100 Subject: [PATCH 1/5] initial implementation --- .../metadata.json | 14 ++++ .../query.rego | 72 +++++++++++++++++++ .../test/negative.tf | 26 +++++++ .../test/positive.tf | 39 ++++++++++ .../test/positive_expected_result.json | 22 ++++++ 5 files changed, 173 insertions(+) create mode 100644 assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/metadata.json create mode 100644 assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego create mode 100644 assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf create mode 100644 assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive.tf create mode 100644 assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive_expected_result.json diff --git a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/metadata.json b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/metadata.json new file mode 100644 index 00000000000..a132f92e8d7 --- /dev/null +++ b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/metadata.json @@ -0,0 +1,14 @@ +{ + "id": "fc7187e5-b9a2-46c0-950d-3bfcaaacc5ca", + "queryName": "Beta - SQL DB Instance Without Connections Logging", + "severity": "MEDIUM", + "category": "Observability", + "descriptionText": "All 'google_sql_database_instance' resources based on POSTGRES should enable the 'log_connections' flag to log connection attempts", + "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance.html#settings-1", + "platform": "Terraform", + "descriptionID": "fc7187e5", + "cloudProvider": "gcp", + "cwe": "778", + "riskScore": "3.0", + "experimental": "true" +} diff --git a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego new file mode 100644 index 00000000000..d081ab5fffd --- /dev/null +++ b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego @@ -0,0 +1,72 @@ +package Cx + +import data.generic.common as common_lib +import data.generic.terraform as tf_lib + +CxPolicy[result] { + resource := input.document[i].resource.google_sql_database_instance[name] + + contains(resource.database_version, "POSTGRES") + results := get_results(resource, name) + + result := { + "documentId": input.document[i].id, + "resourceType": "google_sql_database_instance", + "resourceName": tf_lib.get_resource_name(resource, name), + "searchKey": results.searchKey, + "issueType": results.issueType, + "keyExpectedValue": results.keyExpectedValue, + "keyActualValue": results.keyActualValue, + "searchLine": results.searchLine + } +} + +get_results(resource, name) = results { + not common_lib.valid_key(resource, "settings") + + results := { + "searchKey": sprintf("google_sql_database_instance[%s]", [name]), + "issueType": "MissingAttribute", + "keyExpectedValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' be defined and set 'log_connections' to 'on'", [name]), + "keyActualValue": sprintf("'google_sql_database_instance[%s].settings' is undefined or null", [name]), + "searchLine": common_lib.build_search_line(["resource", "google_sql_database_instance", name], []) + + } +} else = results { + not common_lib.valid_key(resource.settings, "database_flags") + + results := { + "searchKey": sprintf("google_sql_database_instance[%s].settings", [name]), + "issueType": "MissingAttribute", + "keyExpectedValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' be defined and set 'log_connections' to 'on'", [name]), + "keyActualValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' is undefined or null", [name]), + "searchLine": common_lib.build_search_line(["resource", "google_sql_database_instance", name, "settings"], []) + } + +} else = results { + not has_flag(resource.settings.database_flags) + + results := { + "searchKey": sprintf("google_sql_database_instance[%s].settings.database_flags", [name]), + "issueType": "MissingAttribute", + "keyExpectedValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' be defined and set 'log_connections' to 'on'", [name]), + "keyActualValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' does not set 'log_connections'", [name]), + "searchLine": common_lib.build_search_line(["resource", "google_sql_database_instance", name, "settings", "database_flags"], []) + } + +} else = results { + resource.settings.database_flags[x].name == "log_connections" + resource.settings.database_flags[x].value != "on" + + results := { + "searchKey": sprintf("google_sql_database_instance[%s].settings.database_flags[%d]", [name, x]), + "issueType": "IncorrectValue", + "keyExpectedValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' be defined and set 'log_connections' to 'on'", [name]), + "keyActualValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' sets 'log_connections' to '%s'", [name, resource.settings.database_flags[x].value]), + "searchLine": common_lib.build_search_line(["resource", "google_sql_database_instance", name, "settings", "database_flags", x], []) + } +} + +has_flag(database_flags) { + database_flags[_].name == "log_connections" +} diff --git a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf new file mode 100644 index 00000000000..da38c4ea707 --- /dev/null +++ b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf @@ -0,0 +1,26 @@ +resource "google_sql_database_instance" "negative_1" { + name = "main-instance" + database_version = "MYSQL_8_0" # Is not a POSTGRES instance + region = "us-central1" + + settings { + tier = "db-f1-micro" + } +} + +resource "google_sql_database_instance" "negative_2" { + name = "mysql-instance-with-flag" + database_version = "POSTGRES_15" + region = "us-central1" + + settings { + tier = "db-f1-micro" + + database_flags = [ + { name = "log_connections1", value = "on" }, # Has flag set to "on" + { name = "log_connections2", value = "on" }, # Has flag set to "on" + { name = "log_connections3", value = "on" }, # Has flag set to "on" + { name = "log_connections", value = "on" }, # Has flag set to "on" + ] + } +} diff --git a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive.tf b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive.tf new file mode 100644 index 00000000000..9cee0dc3b56 --- /dev/null +++ b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive.tf @@ -0,0 +1,39 @@ +resource "google_sql_database_instance" "positive_1" { + name = "mysql-instance-without-flag" + database_version = "POSTGRES_17" + region = "us-central1" + + # Missing 'settings' field +} + +resource "google_sql_database_instance" "positive_2" { + name = "postgres-instance-without-flag" + database_version = "POSTGRES_16" + region = "us-central1" + + settings {} # Missing 'database_flags' field +} + +resource "google_sql_database_instance" "positive_3" { + name = "postgres-instance-without-flag" + database_version = "POSTGRES_15" + region = "us-central1" + + settings { + database_flags = [ + # Missing 'log_connections' flag + ] + } +} + +resource "google_sql_database_instance" "positive_4" { + name = "postgres-instance-with-flag" + database_version = "POSTGRES_14" + region = "us-central1" + + settings { + database_flags = [ + { name = "log_connections", value = "off" } # Flag is not set to "on" + ] + } +} diff --git a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive_expected_result.json b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive_expected_result.json new file mode 100644 index 00000000000..826344e16a0 --- /dev/null +++ b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive_expected_result.json @@ -0,0 +1,22 @@ +[ + { + "queryName": "Beta - SQL DB Instance Without Connections Logging", + "severity": "MEDIUM", + "line": 1 + }, + { + "queryName": "Beta - SQL DB Instance Without Connections Logging", + "severity": "MEDIUM", + "line": 14 + }, + { + "queryName": "Beta - SQL DB Instance Without Connections Logging", + "severity": "MEDIUM", + "line": 23 + }, + { + "queryName": "Beta - SQL DB Instance Without Connections Logging", + "severity": "MEDIUM", + "line": 36 + } +] From 9374d90c7d39a37e1db9bcc349fa8c4f4f91b574 Mon Sep 17 00:00:00 2001 From: Andre Pereira <219305055+cx-andre-pereira@users.noreply.github.com> Date: Mon, 20 Oct 2025 17:43:21 +0100 Subject: [PATCH 2/5] fixes --- .../query.rego | 12 ++++++------ .../test/negative.tf | 3 --- .../test/positive.tf | 4 +++- .../test/positive_expected_result.json | 2 +- 4 files changed, 10 insertions(+), 11 deletions(-) diff --git a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego index d081ab5fffd..f5fc618debc 100644 --- a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego +++ b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego @@ -27,7 +27,7 @@ get_results(resource, name) = results { results := { "searchKey": sprintf("google_sql_database_instance[%s]", [name]), "issueType": "MissingAttribute", - "keyExpectedValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' be defined and set 'log_connections' to 'on'", [name]), + "keyExpectedValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' should be defined and set 'log_connections' to 'on'", [name]), "keyActualValue": sprintf("'google_sql_database_instance[%s].settings' is undefined or null", [name]), "searchLine": common_lib.build_search_line(["resource", "google_sql_database_instance", name], []) @@ -38,7 +38,7 @@ get_results(resource, name) = results { results := { "searchKey": sprintf("google_sql_database_instance[%s].settings", [name]), "issueType": "MissingAttribute", - "keyExpectedValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' be defined and set 'log_connections' to 'on'", [name]), + "keyExpectedValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' should be defined and set 'log_connections' to 'on'", [name]), "keyActualValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' is undefined or null", [name]), "searchLine": common_lib.build_search_line(["resource", "google_sql_database_instance", name, "settings"], []) } @@ -49,7 +49,7 @@ get_results(resource, name) = results { results := { "searchKey": sprintf("google_sql_database_instance[%s].settings.database_flags", [name]), "issueType": "MissingAttribute", - "keyExpectedValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' be defined and set 'log_connections' to 'on'", [name]), + "keyExpectedValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' should be defined and set 'log_connections' to 'on'", [name]), "keyActualValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' does not set 'log_connections'", [name]), "searchLine": common_lib.build_search_line(["resource", "google_sql_database_instance", name, "settings", "database_flags"], []) } @@ -59,11 +59,11 @@ get_results(resource, name) = results { resource.settings.database_flags[x].value != "on" results := { - "searchKey": sprintf("google_sql_database_instance[%s].settings.database_flags[%d]", [name, x]), + "searchKey": sprintf("google_sql_database_instance[%s].settings.database_flags[%d].name", [name, x]), "issueType": "IncorrectValue", - "keyExpectedValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' be defined and set 'log_connections' to 'on'", [name]), + "keyExpectedValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' should be defined and set 'log_connections' to 'on'", [name]), "keyActualValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' sets 'log_connections' to '%s'", [name, resource.settings.database_flags[x].value]), - "searchLine": common_lib.build_search_line(["resource", "google_sql_database_instance", name, "settings", "database_flags", x], []) + "searchLine": common_lib.build_search_line(["resource", "google_sql_database_instance", name, "settings", "database_flags", x, "name"], []) } } diff --git a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf index da38c4ea707..11bd6c30c3c 100644 --- a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf +++ b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf @@ -17,9 +17,6 @@ resource "google_sql_database_instance" "negative_2" { tier = "db-f1-micro" database_flags = [ - { name = "log_connections1", value = "on" }, # Has flag set to "on" - { name = "log_connections2", value = "on" }, # Has flag set to "on" - { name = "log_connections3", value = "on" }, # Has flag set to "on" { name = "log_connections", value = "on" }, # Has flag set to "on" ] } diff --git a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive.tf b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive.tf index 9cee0dc3b56..f0348de48b8 100644 --- a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive.tf +++ b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive.tf @@ -33,7 +33,9 @@ resource "google_sql_database_instance" "positive_4" { settings { database_flags = [ - { name = "log_connections", value = "off" } # Flag is not set to "on" + { name = "sample_flag1", value = "off" }, + { name = "log_connections", value = "off" }, # Flag is not set to "on" + { name = "sample_flag2", value = "off" } ] } } diff --git a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive_expected_result.json b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive_expected_result.json index 826344e16a0..dd0c9f7dfe8 100644 --- a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive_expected_result.json +++ b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive_expected_result.json @@ -17,6 +17,6 @@ { "queryName": "Beta - SQL DB Instance Without Connections Logging", "severity": "MEDIUM", - "line": 36 + "line": 37 } ] From 657957f248a0247f4e40c91a9e731801fcc50a88 Mon Sep 17 00:00:00 2001 From: Andre Pereira <219305055+cx-andre-pereira@users.noreply.github.com> Date: Wed, 22 Oct 2025 10:28:52 +0100 Subject: [PATCH 3/5] support for single object --- .../query.rego | 15 ++++++++++++++- .../test/negative.tf | 16 ++++++++++++++++ .../test/positive.tf | 13 +++++++++++++ .../test/positive_expected_result.json | 5 +++++ 4 files changed, 48 insertions(+), 1 deletion(-) diff --git a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego index f5fc618debc..a210f11a472 100644 --- a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego +++ b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego @@ -54,7 +54,7 @@ get_results(resource, name) = results { "searchLine": common_lib.build_search_line(["resource", "google_sql_database_instance", name, "settings", "database_flags"], []) } -} else = results { +} else = results { # array resource.settings.database_flags[x].name == "log_connections" resource.settings.database_flags[x].value != "on" @@ -65,8 +65,21 @@ get_results(resource, name) = results { "keyActualValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' sets 'log_connections' to '%s'", [name, resource.settings.database_flags[x].value]), "searchLine": common_lib.build_search_line(["resource", "google_sql_database_instance", name, "settings", "database_flags", x, "name"], []) } +} else = results { # single object + resource.settings.database_flags.name == "log_connections" + resource.settings.database_flags.value != "on" + + results := { + "searchKey": sprintf("google_sql_database_instance[%s].settings.database_flags.name", [name]), + "issueType": "IncorrectValue", + "keyExpectedValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' should be defined and set 'log_connections' to 'on'", [name]), + "keyActualValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' sets 'log_connections' to '%s'", [name, resource.settings.database_flags.value]), + "searchLine": common_lib.build_search_line(["resource", "google_sql_database_instance", name, "settings", "database_flags", "name"], []) + } } has_flag(database_flags) { database_flags[_].name == "log_connections" +} else { + database_flags.name == "log_connections" } diff --git a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf index 11bd6c30c3c..33be83e9f7c 100644 --- a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf +++ b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf @@ -17,7 +17,23 @@ resource "google_sql_database_instance" "negative_2" { tier = "db-f1-micro" database_flags = [ + { name = "sample_flag1", value = "off" }, { name = "log_connections", value = "on" }, # Has flag set to "on" ] } } + +resource "google_sql_database_instance" "negative_3" { # Single object support test + name = "mysql-instance-with-flag" + database_version = "POSTGRES_15" + region = "us-central1" + + settings { + tier = "db-f1-micro" + + database_flags { + name = "log_connections" + value = "on" + } # Has flag set to "on" + } +} diff --git a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive.tf b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive.tf index f0348de48b8..5b185783acc 100644 --- a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive.tf +++ b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive.tf @@ -39,3 +39,16 @@ resource "google_sql_database_instance" "positive_4" { ] } } + +resource "google_sql_database_instance" "positive_5" { # Single object support test + name = "postgres-instance-with-flag" + database_version = "POSTGRES_14" + region = "us-central1" + + settings { + database_flags { + name = "log_connections" + value = "off" + } # Flag is not set to "on" + } +} diff --git a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive_expected_result.json b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive_expected_result.json index dd0c9f7dfe8..218f4b9549b 100644 --- a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive_expected_result.json +++ b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive_expected_result.json @@ -18,5 +18,10 @@ "queryName": "Beta - SQL DB Instance Without Connections Logging", "severity": "MEDIUM", "line": 37 + }, + { + "queryName": "Beta - SQL DB Instance Without Connections Logging", + "severity": "MEDIUM", + "line": 50 } ] From b6fba57fd31f81cbe7340f3afe0608f99b601a01 Mon Sep 17 00:00:00 2001 From: Andre Pereira <219305055+cx-andre-pereira@users.noreply.github.com> Date: Mon, 27 Oct 2025 16:27:15 +0000 Subject: [PATCH 4/5] fixed tests --- .../test/negative.tf | 18 ++++++++++--- .../test/positive.tf | 26 +++++++++++++------ .../test/positive_expected_result.json | 4 +-- 3 files changed, 34 insertions(+), 14 deletions(-) diff --git a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf index 33be83e9f7c..77fb0fbc8f3 100644 --- a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf +++ b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf @@ -16,10 +16,20 @@ resource "google_sql_database_instance" "negative_2" { settings { tier = "db-f1-micro" - database_flags = [ - { name = "sample_flag1", value = "off" }, - { name = "log_connections", value = "on" }, # Has flag set to "on" - ] + database_flags { + name = "sample_flag1" + value = "off" + } + + database_flags { + name = "log_connections" # Has flag set to "on" + value = "on" + } + + database_flags { + name = "sample_flag2" + value = "off" + } } } diff --git a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive.tf b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive.tf index 5b185783acc..79529acc406 100644 --- a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive.tf +++ b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive.tf @@ -20,9 +20,10 @@ resource "google_sql_database_instance" "positive_3" { region = "us-central1" settings { - database_flags = [ - # Missing 'log_connections' flag - ] + database_flags { + name = "sample_flag1" + value = "off" + } # Missing 'log_connections' flag } } @@ -32,11 +33,20 @@ resource "google_sql_database_instance" "positive_4" { region = "us-central1" settings { - database_flags = [ - { name = "sample_flag1", value = "off" }, - { name = "log_connections", value = "off" }, # Flag is not set to "on" - { name = "sample_flag2", value = "off" } - ] + database_flags { + name = "sample_flag1" + value = "off" + } + + database_flags { + name = "log_connections" # Flag is not set to "on" + value = "off" + } + + database_flags { + name = "sample_flag2" + value = "off" + } } } diff --git a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive_expected_result.json b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive_expected_result.json index 218f4b9549b..35ce66f2aee 100644 --- a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive_expected_result.json +++ b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/positive_expected_result.json @@ -17,11 +17,11 @@ { "queryName": "Beta - SQL DB Instance Without Connections Logging", "severity": "MEDIUM", - "line": 37 + "line": 42 }, { "queryName": "Beta - SQL DB Instance Without Connections Logging", "severity": "MEDIUM", - "line": 50 + "line": 60 } ] From 4f1ac67e8c832f5f3dfd4c5e0d2bc155ab98c0c4 Mon Sep 17 00:00:00 2001 From: Andre Pereira <219305055+cx-andre-pereira@users.noreply.github.com> Date: Tue, 28 Oct 2025 13:51:54 +0000 Subject: [PATCH 5/5] simId transition update --- assets/similarityID_transition/terraform_gcp.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/assets/similarityID_transition/terraform_gcp.yaml b/assets/similarityID_transition/terraform_gcp.yaml index c3eeee7d298..067d8682247 100644 --- a/assets/similarityID_transition/terraform_gcp.yaml +++ b/assets/similarityID_transition/terraform_gcp.yaml @@ -3,3 +3,7 @@ similarityIDChangeList: queryName: Beta - Google DNS Policy Logging Disabled observations: "" change: 2 + - queryId: fc7187e5-b9a2-46c0-950d-3bfcaaacc5ca + queryName: Beta - SQL DB Instance Without Connections Logging + observations: "" + change: 2