From b7fc2542e862ea976d980477df442baf3cf0ab13 Mon Sep 17 00:00:00 2001 From: Prowler Bot Date: Sat, 15 Feb 2025 03:21:26 +0545 Subject: [PATCH] fix(gcp): Correct false positive when `sslMode=ENCRYPTED_ONLY` in CloudSQL (#6942) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Rubén De la Torre Vico --- .../cloudsql_instance_ssl_connections.py | 7 +-- .../cloudsql_instance_ssl_connections_test.py | 46 +++++++++++++++++++ 2 files changed, 50 insertions(+), 3 deletions(-) diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_ssl_connections/cloudsql_instance_ssl_connections.py b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_ssl_connections/cloudsql_instance_ssl_connections.py index 4882defaa6..f2badd878a 100644 --- a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_ssl_connections/cloudsql_instance_ssl_connections.py +++ b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_ssl_connections/cloudsql_instance_ssl_connections.py @@ -11,12 +11,13 @@ class cloudsql_instance_ssl_connections(Check): report.status_extended = ( f"Database Instance {instance.name} requires SSL connections." ) - if ( - not instance.require_ssl - or instance.ssl_mode == "ALLOW_UNENCRYPTED_AND_ENCRYPTED" + + if (instance.ssl_mode == "ALLOW_UNENCRYPTED_AND_ENCRYPTED") or ( + instance.ssl_mode == "SSL_MODE_UNSPECIFIED" and not instance.require_ssl ): report.status = "FAIL" report.status_extended = f"Database Instance {instance.name} does not require SSL connections." + findings.append(report) return findings diff --git a/tests/providers/gcp/services/cloudsql/cloudsql_instance_ssl_connections/cloudsql_instance_ssl_connections_test.py b/tests/providers/gcp/services/cloudsql/cloudsql_instance_ssl_connections/cloudsql_instance_ssl_connections_test.py index 83712c3a8d..8b398aee00 100644 --- a/tests/providers/gcp/services/cloudsql/cloudsql_instance_ssl_connections/cloudsql_instance_ssl_connections_test.py +++ b/tests/providers/gcp/services/cloudsql/cloudsql_instance_ssl_connections/cloudsql_instance_ssl_connections_test.py @@ -74,6 +74,52 @@ class Test_cloudsql_instance_ssl_connections: assert result[0].location == GCP_EU1_LOCATION assert result[0].project_id == GCP_PROJECT_ID + def test_cloudsql_instance_ssl_connections_disabled_and_ssl_mode_encrypted(self): + cloudsql_client = mock.MagicMock() + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), mock.patch( + "prowler.providers.gcp.services.cloudsql.cloudsql_instance_ssl_connections.cloudsql_instance_ssl_connections.cloudsql_client", + new=cloudsql_client, + ): + from prowler.providers.gcp.services.cloudsql.cloudsql_instance_ssl_connections.cloudsql_instance_ssl_connections import ( + cloudsql_instance_ssl_connections, + ) + from prowler.providers.gcp.services.cloudsql.cloudsql_service import ( + Instance, + ) + + cloudsql_client.instances = [ + Instance( + name="instance1", + version="POSTGRES_15", + ip_addresses=[], + region=GCP_EU1_LOCATION, + public_ip=False, + require_ssl=False, + ssl_mode="ENCRYPTED_ONLY", + automated_backups=True, + authorized_networks=[], + flags=[], + project_id=GCP_PROJECT_ID, + ) + ] + + check = cloudsql_instance_ssl_connections() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == "Database Instance instance1 requires SSL connections." + ) + assert result[0].resource_id == "instance1" + assert result[0].resource_name == "instance1" + assert result[0].location == GCP_EU1_LOCATION + assert result[0].project_id == GCP_PROJECT_ID + def test_cloudsql_instance_ssl_connections_enabled_and_ssl_mode_not_encrypted(self): cloudsql_client = mock.MagicMock()