Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
{
"id": "5a8c5d26-c592-4c98-afac-9762c54cc868",
"queryName": "Beta - SQL DB Instance With Ownership Chaining Enabled",
"severity": "MEDIUM",
"category": "Insecure Configurations",
"descriptionText": "No 'google_sql_database_instance' resource based on SQLSERVER should enable the deprecated 'cross db ownership chaining'",
"descriptionUrl": "https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance.html#settings-1",
"platform": "Terraform",
"descriptionID": "5a8c5d26",
"cloudProvider": "gcp",
"cwe": "732",
"riskScore": "3.0",
"experimental": "true"
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
package Cx

import data.generic.common as common_lib
import data.generic.terraform as tf_lib

CxPolicy[result] {
resource := input.document[i].resource.google_sql_database_instance[name]

contains(resource.database_version, "SQLSERVER")
results := get_results(resource, name)

result := {
"documentId": input.document[i].id,
"resourceType": "google_sql_database_instance",
"resourceName": tf_lib.get_resource_name(resource, name),
"searchKey": results.searchKey,
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' should be defined and set 'cross db ownership chaining' to 'off'", [name]),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't this expectedValue misleading?
Following the documentation description: "This flag is deprecated for all SQL Server versions in CGP. Going forward, you can't set its value to on. However, if you have this flag enabled, we strongly recommend that you either remove the flag from your database or set it to off", the default value is off, I believe we should say that the expected value "should be defined and set"...

Maybe change the message to something similar to other related case queries:

Suggested change
"keyExpectedValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' should be defined and set 'cross db ownership chaining' to 'off'", [name]),
"keyExpectedValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' should set 'cross db ownership chaining' to 'off'", [name]),

"keyActualValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' sets 'cross db ownership chaining' to '%s'", [name, results.value]),
"searchLine": results.searchLine
}
}

get_results(resource, name) = results { # array
resource.settings.database_flags[x].name == "cross db ownership chaining"
resource.settings.database_flags[x].value != "off"

results := {
"searchKey": sprintf("google_sql_database_instance[%s].settings.database_flags[%d].name", [name, x]),
"searchLine": common_lib.build_search_line(["resource", "google_sql_database_instance", name, "settings", "database_flags", x, "name"], []),
"value": resource.settings.database_flags[x].value
}
} else = results { # single object
resource.settings.database_flags.name == "cross db ownership chaining"
resource.settings.database_flags.value != "off"

results := {
"searchKey": sprintf("google_sql_database_instance[%s].settings.database_flags.name", [name]),
"searchLine": common_lib.build_search_line(["resource", "google_sql_database_instance", name, "settings", "database_flags", "name"], []),
"value": resource.settings.database_flags.value
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,84 @@
resource "google_sql_database_instance" "negative_1" {
name = "main-instance"
database_version = "MYSQL_8_0" # Is not a SQLSERVER instance
region = "us-central1"

settings {
tier = "db-f1-micro"

database_flags {
name = "cross db ownership chaining"
value = "on"
}
}
}

resource "google_sql_database_instance" "negative_2" {
name = "mysql-instance-without-flag"
database_version = "SQLSERVER_2017_STANDARD"
region = "us-central1"

# Defaults to "off"
}

resource "google_sql_database_instance" "negative_3" {
name = "sqlserver-instance-without-flag"
database_version = "SQLSERVER_2017_STANDARD"
region = "us-central1"

settings {} # Defaults to "off"
}

resource "google_sql_database_instance" "negative_4" {
name = "sqlserver-instance-without-flag"
database_version = "SQLSERVER_2017_STANDARD"
region = "us-central1"

settings {
database_flags {
name = "sample_flag1"
value = "off"
}
# Defaults to "off"
}
}

resource "google_sql_database_instance" "negative_5" {
name = "mysql-instance-with-flag"
database_version = "SQLSERVER_2019_STANDARD"
region = "us-central1"

settings {
tier = "db-f1-micro"

database_flags {
name = "sample_flag1"
value = "off"
}

database_flags { # Has flag set to "off"
name = "cross db ownership chaining"
value = "off"
}

database_flags {
name = "sample_flag2"
value = "off"
}
}
}

resource "google_sql_database_instance" "negative_6" { # Single object support test
name = "mysql-instance-with-flag"
database_version = "SQLSERVER_2019_STANDARD"
region = "us-central1"

settings {
tier = "db-f1-micro"

database_flags {
name = "cross db ownership chaining"
value = "off"
} # Has flag set to "off"
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
resource "google_sql_database_instance" "positive_1" {
name = "sqlserver-instance-with-flag"
database_version = "SQLSERVER_2017_EXPRESS"
region = "us-central1"

settings {
database_flags {
name = "sample_flag1"
value = "off"
}

database_flags { # Flag is not set to "off"
name = "cross db ownership chaining"
value = "on"
}

database_flags {
name = "sample_flag2"
value = "off"
}
}
}

resource "google_sql_database_instance" "positive_2" { # Single object support test
name = "sqlserver-instance-with-flag"
database_version = "SQLSERVER_2017_EXPRESS"
region = "us-central1"

settings {
database_flags {
name = "cross db ownership chaining"
value = "on"
} # Flag is not set to "off"
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
[
{
"queryName": "Beta - SQL DB Instance With Ownership Chaining Enabled",
"severity": "MEDIUM",
"line": 13
},
{
"queryName": "Beta - SQL DB Instance With Ownership Chaining Enabled",
"severity": "MEDIUM",
"line": 31
}
]
4 changes: 4 additions & 0 deletions assets/similarityID_transition/terraform_gcp.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -3,3 +3,7 @@ similarityIDChangeList:
queryName: Beta - Google DNS Policy Logging Disabled
observations: ""
change: 2
- queryId: 5a8c5d26-c592-4c98-afac-9762c54cc868
queryName: Beta - SQL DB Instance With Ownership Chaining Enabled
observations: ""
change: 2
Loading