ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 04:51:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(gcp): check cloudsql sslMode (#4635)

Browse Source
This commit is contained in:
Pedro Martín
2024-08-05 18:12:00 +02:00
committed by GitHub
parent c8bc54aa48
commit 96d9cbd8af
25 changed files with 218 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/providers/gcp/services/cloudsql/cloudsql_instance_ssl_connections/cloudsql_instance_ssl_connections.py
+1 -1
View File
@@ -15,7 +15,7 @@ class cloudsql_instance_ssl_connections(Check):
report.status_extended = (
f"Database Instance {instance.name} requires SSL connections."
)
if not instance.ssl:
if not instance.require_ssl or instance.ssl_mode != "ENCRYPTED_ONLY":
report.status = "FAIL"
report.status_extended = f"Database Instance {instance.name} does not require SSL connections."
findings.append(report)
prowler/providers/gcp/services/cloudsql/cloudsql_service.py
+6 -2
View File
@@ -31,9 +31,12 @@ class CloudSQL(GCPService):
region=instance["region"],
ip_addresses=instance.get("ipAddresses", []),
public_ip=public_ip,
ssl=instance["settings"]["ipConfiguration"].get(
require_ssl=instance["settings"]["ipConfiguration"].get(
"requireSsl", False
),
ssl_mode=instance["settings"]["ipConfiguration"].get(
"sslMode", "ALLOW_UNENCRYPTED_AND_ENCRYPTED"
),
automated_backups=instance["settings"][
"backupConfiguration"
]["enabled"],
@@ -61,7 +64,8 @@ class Instance(BaseModel):
region: str
public_ip: bool
authorized_networks: list
ssl: bool
require_ssl: bool
ssl_mode: str
automated_backups: bool
flags: list
project_id: str
tests/providers/gcp/gcp_fixtures.py
+2
View File
@@ -583,6 +583,7 @@ def mock_api_instances_calls(client: MagicMock, service: str):
"settings": {
"ipConfiguration": {
"requireSsl": True,
"sslMode": "ENCRYPTED_ONLY",
"authorizedNetworks": [{"value": "test"}],
},
"backupConfiguration": {"enabled": True},
@@ -597,6 +598,7 @@ def mock_api_instances_calls(client: MagicMock, service: str):
"settings": {
"ipConfiguration": {
"requireSsl": False,
"sslMode": "ALLOW_UNENCRYPTED_AND_ENCRYPTED",
"authorizedNetworks": [{"value": "test"}],
},
"backupConfiguration": {"enabled": False},
tests/providers/gcp/services/cloudsql/cloudsql_instance_automated_backups/cloudsql_instance_automated_backups_test.py
+4 -2
View File
@@ -52,7 +52,8 @@ class Test_cloudsql_instance_automated_backups:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -97,7 +98,8 @@ class Test_cloudsql_instance_automated_backups:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=False,
authorized_networks=[],
flags=[],
tests/providers/gcp/services/cloudsql/cloudsql_instance_mysql_local_infile_flag/cloudsql_instance_mysql_local_infile_flag_test.py
+8 -4
View File
@@ -52,7 +52,8 @@ class Test_cloudsql_instance_mysql_local_infile_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -88,7 +89,8 @@ class Test_cloudsql_instance_mysql_local_infile_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -133,7 +135,8 @@ class Test_cloudsql_instance_mysql_local_infile_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "local_infile", "value": "off"}],
@@ -178,7 +181,8 @@ class Test_cloudsql_instance_mysql_local_infile_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "local_infile", "value": "on"}],
tests/providers/gcp/services/cloudsql/cloudsql_instance_mysql_skip_show_database_flag/cloudsql_instance_mysql_skip_show_database_flag_test.py
+8 -4
View File
@@ -52,7 +52,8 @@ class Test_cloudsql_instance_mysql_skip_show_database_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -88,7 +89,8 @@ class Test_cloudsql_instance_mysql_skip_show_database_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -133,7 +135,8 @@ class Test_cloudsql_instance_mysql_skip_show_database_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "skip_show_database", "value": "off"}],
@@ -178,7 +181,8 @@ class Test_cloudsql_instance_mysql_skip_show_database_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "skip_show_database", "value": "on"}],
tests/providers/gcp/services/cloudsql/cloudsql_instance_postgres_enable_pgaudit_flag/cloudsql_instance_postgres_enable_pgaudit_flag_test.py
+8 -4
View File
@@ -52,7 +52,8 @@ class Test_cloudsql_instance_postgres_enable_pgaudit_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -88,7 +89,8 @@ class Test_cloudsql_instance_postgres_enable_pgaudit_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -133,7 +135,8 @@ class Test_cloudsql_instance_postgres_enable_pgaudit_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "cloudsql.enable_pgaudit", "value": "off"}],
@@ -178,7 +181,8 @@ class Test_cloudsql_instance_postgres_enable_pgaudit_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "cloudsql.enable_pgaudit", "value": "on"}],
tests/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_connections_flag/cloudsql_instance_postgres_log_connections_flag_test.py
+8 -4
View File
@@ -52,7 +52,8 @@ class Test_cloudsql_instance_postgres_log_connections_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -88,7 +89,8 @@ class Test_cloudsql_instance_postgres_log_connections_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -133,7 +135,8 @@ class Test_cloudsql_instance_postgres_log_connections_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "log_connections", "value": "off"}],
@@ -178,7 +181,8 @@ class Test_cloudsql_instance_postgres_log_connections_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "log_connections", "value": "on"}],
tests/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_disconnections_flag/cloudsql_instance_postgres_log_disconnections_flag_test.py
+8 -4
View File
@@ -52,7 +52,8 @@ class Test_cloudsql_instance_postgres_log_disconnections_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -88,7 +89,8 @@ class Test_cloudsql_instance_postgres_log_disconnections_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -133,7 +135,8 @@ class Test_cloudsql_instance_postgres_log_disconnections_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "log_disconnections", "value": "off"}],
@@ -178,7 +181,8 @@ class Test_cloudsql_instance_postgres_log_disconnections_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "log_disconnections", "value": "on"}],
tests/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_error_verbosity_flag/cloudsql_instance_postgres_log_error_verbosity_flag_test.py
+8 -4
View File
@@ -52,7 +52,8 @@ class Test_cloudsql_instance_postgres_log_error_verbosity_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -88,7 +89,8 @@ class Test_cloudsql_instance_postgres_log_error_verbosity_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -133,7 +135,8 @@ class Test_cloudsql_instance_postgres_log_error_verbosity_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "log_error_verbosity", "value": "off"}],
@@ -178,7 +181,8 @@ class Test_cloudsql_instance_postgres_log_error_verbosity_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "log_error_verbosity", "value": "default"}],
tests/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_duration_statement_flag/cloudsql_instance_postgres_log_min_duration_statement_flag_test.py
+8 -4
View File
@@ -52,7 +52,8 @@ class Test_cloudsql_instance_postgres_log_min_duration_statement_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -88,7 +89,8 @@ class Test_cloudsql_instance_postgres_log_min_duration_statement_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -133,7 +135,8 @@ class Test_cloudsql_instance_postgres_log_min_duration_statement_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "log_min_duration_statement", "value": "0"}],
@@ -178,7 +181,8 @@ class Test_cloudsql_instance_postgres_log_min_duration_statement_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "log_min_duration_statement", "value": "-1"}],
tests/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_error_statement_flag/cloudsql_instance_postgres_log_min_error_statement_flag_test.py
+8 -4
View File
@@ -52,7 +52,8 @@ class Test_cloudsql_instance_postgres_log_min_error_statement_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -88,7 +89,8 @@ class Test_cloudsql_instance_postgres_log_min_error_statement_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -133,7 +135,8 @@ class Test_cloudsql_instance_postgres_log_min_error_statement_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "log_min_error_statement", "value": "warning"}],
@@ -178,7 +181,8 @@ class Test_cloudsql_instance_postgres_log_min_error_statement_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "log_min_error_statement", "value": "error"}],
tests/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_messages_flag/cloudsql_instance_postgres_log_min_messages_flag_test.py
+8 -4
View File
@@ -52,7 +52,8 @@ class Test_cloudsql_instance_postgres_log_min_messages_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -88,7 +89,8 @@ class Test_cloudsql_instance_postgres_log_min_messages_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -133,7 +135,8 @@ class Test_cloudsql_instance_postgres_log_min_messages_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "log_min_messages", "value": "debug"}],
@@ -178,7 +181,8 @@ class Test_cloudsql_instance_postgres_log_min_messages_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "log_min_messages", "value": "error"}],
tests/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_statement_flag/cloudsql_instance_postgres_log_statement_flag_test.py
+8 -4
View File
@@ -52,7 +52,8 @@ class Test_cloudsql_instance_postgres_log_statement_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -88,7 +89,8 @@ class Test_cloudsql_instance_postgres_log_statement_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -133,7 +135,8 @@ class Test_cloudsql_instance_postgres_log_statement_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "log_statement", "value": "all"}],
@@ -178,7 +181,8 @@ class Test_cloudsql_instance_postgres_log_statement_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "log_statement", "value": "ddl"}],
tests/providers/gcp/services/cloudsql/cloudsql_instance_public_access/cloudsql_instance_public_access_test.py
+4 -2
View File
@@ -52,7 +52,8 @@ class Test_cloudsql_instance_public_access:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[{"value": "192.168.1.1/32"}],
project_id=GCP_PROJECT_ID,
@@ -97,7 +98,8 @@ class Test_cloudsql_instance_public_access:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[{"value": "0.0.0.0/0"}],
project_id=GCP_PROJECT_ID,
tests/providers/gcp/services/cloudsql/cloudsql_instance_public_ip/cloudsql_instance_public_ip_test.py
+4 -2
View File
@@ -52,7 +52,8 @@ class Test_cloudsql_instance_public_ip:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -97,7 +98,8 @@ class Test_cloudsql_instance_public_ip:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=True,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_contained_database_authentication_flag/cloudsql_instance_sqlserver_contained_database_authentication_flag_test.py
+8 -4
View File
@@ -52,7 +52,8 @@ class Test_cloudsql_instance_sqlserver_contained_database_authentication_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -88,7 +89,8 @@ class Test_cloudsql_instance_sqlserver_contained_database_authentication_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -133,7 +135,8 @@ class Test_cloudsql_instance_sqlserver_contained_database_authentication_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[
@@ -180,7 +183,8 @@ class Test_cloudsql_instance_sqlserver_contained_database_authentication_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[
tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag/cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag_test.py
+8 -4
View File
@@ -52,7 +52,8 @@ class Test_cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -88,7 +89,8 @@ class Test_cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -133,7 +135,8 @@ class Test_cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "cross db ownership chaining", "value": "on"}],
@@ -178,7 +181,8 @@ class Test_cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "cross db ownership chaining", "value": "off"}],
tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_external_scripts_enabled_flag/cloudsql_instance_sqlserver_external_scripts_enabled_flag_test.py
+8 -4
View File
@@ -52,7 +52,8 @@ class Test_cloudsql_instance_sqlserver_external_scripts_enabled_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -88,7 +89,8 @@ class Test_cloudsql_instance_sqlserver_external_scripts_enabled_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -133,7 +135,8 @@ class Test_cloudsql_instance_sqlserver_external_scripts_enabled_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "external scripts enabled", "value": "on"}],
@@ -178,7 +181,8 @@ class Test_cloudsql_instance_sqlserver_external_scripts_enabled_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "external scripts enabled", "value": "off"}],
tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_remote_access_flag/cloudsql_instance_sqlserver_remote_access_flag_test.py
+8 -4
View File
@@ -52,7 +52,8 @@ class Test_cloudsql_instance_sqlserver_remote_access_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -88,7 +89,8 @@ class Test_cloudsql_instance_sqlserver_remote_access_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -133,7 +135,8 @@ class Test_cloudsql_instance_sqlserver_remote_access_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "remote access", "value": "on"}],
@@ -178,7 +181,8 @@ class Test_cloudsql_instance_sqlserver_remote_access_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "remote access", "value": "off"}],
tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_trace_flag/cloudsql_instance_sqlserver_trace_flag_test.py
+8 -4
View File
@@ -52,7 +52,8 @@ class Test_cloudsql_instance_sqlserver_trace_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -88,7 +89,8 @@ class Test_cloudsql_instance_sqlserver_trace_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -133,7 +135,8 @@ class Test_cloudsql_instance_sqlserver_trace_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "3625", "value": "off"}],
@@ -178,7 +181,8 @@ class Test_cloudsql_instance_sqlserver_trace_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "3625", "value": "on"}],
tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_user_connections_flag/cloudsql_instance_sqlserver_user_connections_flag_test.py
+8 -4
View File
@@ -52,7 +52,8 @@ class Test_cloudsql_instance_sqlserver_user_connections_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -88,7 +89,8 @@ class Test_cloudsql_instance_sqlserver_user_connections_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -133,7 +135,8 @@ class Test_cloudsql_instance_sqlserver_user_connections_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "user connections", "value": "1"}],
@@ -178,7 +181,8 @@ class Test_cloudsql_instance_sqlserver_user_connections_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "user connections", "value": "0"}],
tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_user_options_flag/cloudsql_instance_sqlserver_user_options_flag_test.py
+8 -4
View File
@@ -52,7 +52,8 @@ class Test_cloudsql_instance_sqlserver_user_options_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -88,7 +89,8 @@ class Test_cloudsql_instance_sqlserver_user_options_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -133,7 +135,8 @@ class Test_cloudsql_instance_sqlserver_user_options_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "user options", "value": ""}],
@@ -178,7 +181,8 @@ class Test_cloudsql_instance_sqlserver_user_options_flag:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=False,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[{"name": "user options", "value": "0"}],
tests/providers/gcp/services/cloudsql/cloudsql_instance_ssl_connections/cloudsql_instance_ssl_connections_test.py
+54 -4
View File
@@ -28,7 +28,7 @@ class Test_cloudsql_instance_ssl_connections:
result = check.execute()
assert len(result) == 0
def test_cloudsql_instance_ssl_connections_enabled(self):
def test_cloudsql_instance_ssl_connections_enabled_and_ssl_mode_encrypted(self):
cloudsql_client = mock.MagicMock
with mock.patch(
@@ -52,7 +52,8 @@ class Test_cloudsql_instance_ssl_connections:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=True,
require_ssl=True,
ssl_mode="ENCRYPTED_ONLY",
automated_backups=True,
authorized_networks=[],
flags=[],
@@ -73,7 +74,7 @@ class Test_cloudsql_instance_ssl_connections:
assert result[0].location == GCP_EU1_LOCATION
assert result[0].project_id == GCP_PROJECT_ID
def test_cloudsql_instance_ssl_connections_disabled(self):
def test_cloudsql_instance_ssl_connections_enabled_and_ssl_mode_not_encrypted(self):
cloudsql_client = mock.MagicMock
with mock.patch(
@@ -97,7 +98,56 @@ class Test_cloudsql_instance_ssl_connections:
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
ssl=False,
require_ssl=True,
ssl_mode="ALLOW_UNENCRYPTED_AND_ENCRYPTED",
automated_backups=True,
authorized_networks=[],
flags=[],
project_id=GCP_PROJECT_ID,
)
]
check = cloudsql_instance_ssl_connections()
result = check.execute()
assert len(result) == 1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== "Database Instance instance1 does not require SSL connections."
)
assert result[0].resource_id == "instance1"
assert result[0].resource_name == "instance1"
assert result[0].location == GCP_EU1_LOCATION
assert result[0].project_id == GCP_PROJECT_ID
def test_cloudsql_instance_ssl_connections_disabled_and_ssl_mode_not_encrypted(
self,
):
cloudsql_client = mock.MagicMock
with mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_gcp_provider(),
), mock.patch(
"prowler.providers.gcp.services.cloudsql.cloudsql_instance_ssl_connections.cloudsql_instance_ssl_connections.cloudsql_client",
new=cloudsql_client,
):
from prowler.providers.gcp.services.cloudsql.cloudsql_instance_ssl_connections.cloudsql_instance_ssl_connections import (
cloudsql_instance_ssl_connections,
)
from prowler.providers.gcp.services.cloudsql.cloudsql_service import (
Instance,
)
cloudsql_client.instances = [
Instance(
name="instance1",
version="POSTGRES_15",
ip_addresses=[],
region=GCP_EU1_LOCATION,
public_ip=False,
require_ssl=False,
ssl_mode="ALLOW_UNENCRYPTED_AND_ENCRYPTED",
automated_backups=True,
authorized_networks=[],
flags=[],
tests/providers/gcp/services/cloudsql/cloudsql_service_test.py
+7 -2
View File
@@ -33,7 +33,8 @@ class TestCloudSQLService:
{"type": "PRIMARY", "ipAddress": "66.66.66.66"}
]
assert cloudsql_client.instances[0].public_ip
assert cloudsql_client.instances[0].ssl
assert cloudsql_client.instances[0].require_ssl
assert cloudsql_client.instances[0].ssl_mode == "ENCRYPTED_ONLY"
assert cloudsql_client.instances[0].automated_backups
assert cloudsql_client.instances[0].authorized_networks == [
{"value": "test"}
@@ -48,7 +49,11 @@ class TestCloudSQLService:
{"type": "PRIMARY", "ipAddress": "22.22.22.22"}
]
assert cloudsql_client.instances[1].public_ip
assert not cloudsql_client.instances[1].ssl
assert not cloudsql_client.instances[1].require_ssl
assert (
cloudsql_client.instances[1].ssl_mode
== "ALLOW_UNENCRYPTED_AND_ENCRYPTED"
)
assert not cloudsql_client.instances[1].automated_backups
assert cloudsql_client.instances[1].authorized_networks == [
{"value": "test"}