ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-01-25 02:08:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(cloudsql): add trusted client certificates case for cloudsql_instance_ssl_connections (#6686)

Browse Source 
Co-authored-by: Rubén De la Torre Vico <rubendltv22@gmail.com>
This commit is contained in:
Prowler Bot
2025-01-24 18:19:24 +01:00
committed by GitHub
parent 6bc68b785e
commit 67c2c9d53f
2 changed files with 52 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
prowler/providers/gcp/services/cloudsql/cloudsql_instance_ssl_connections/cloudsql_instance_ssl_connections.py
View File

@@ -15,7 +15,10 @@ class cloudsql_instance_ssl_connections(Check):
report.status_extended = (
f"Database Instance {instance.name} requires SSL connections."
)
if not instance.require_ssl or instance.ssl_mode != "ENCRYPTED_ONLY":
if (
not instance.require_ssl
or instance.ssl_mode == "ALLOW_UNENCRYPTED_AND_ENCRYPTED"
):
report.status = "FAIL"
report.status_extended = f"Database Instance {instance.name} does not require SSL connections."
findings.append(report)

48
tests/providers/gcp/services/cloudsql/cloudsql_instance_ssl_connections/cloudsql_instance_ssl_connections_test.py
View File

@@ -167,3 +167,51 @@ class Test_cloudsql_instance_ssl_connections:
assert result[0].resource_name == "instance1"
assert result[0].location == GCP_EU1_LOCATION
assert result[0].project_id == GCP_PROJECT_ID
def test_cloudsql_instance_ssl_connections_enabled_with_trusted_client_certificates(
self,
):
cloudsql_client = mock.MagicMock()
with mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_gcp_provider(),
), mock.patch(
"prowler.providers.gcp.services.cloudsql.cloudsql_instance_ssl_connections.cloudsql_instance_ssl_connections.cloudsql_client",
new=cloudsql_client,
):
from prowler.providers.gcp.services.cloudsql.cloudsql_instance_ssl_connections.cloudsql_instance_ssl_connections import (
cloudsql_instance_ssl_connections,
)
from prowler.providers.gcp.services.cloudsql.cloudsql_service import (
Instance,
)
cloudsql_client.instances = [
Instance(
name="instance1",
version="POSTGRES_15",
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
require_ssl=True,
ssl_mode="TRUSTED_CLIENT_CERTIFICATE_REQUIRED",
automated_backups=True,
authorized_networks=[],
flags=[],
project_id=GCP_PROJECT_ID,
)
]
check = cloudsql_instance_ssl_connections()
result = check.execute()
assert len(result) == 1
assert result[0].status == "PASS"
assert (
result[0].status_extended
== "Database Instance instance1 requires SSL connections."
)
assert result[0].resource_id == "instance1"
assert result[0].resource_name == "instance1"
assert result[0].location == GCP_EU1_LOCATION
assert result[0].project_id == GCP_PROJECT_ID