From c7ead0d9604c544debf19173446d26e8a0f1ea4f Mon Sep 17 00:00:00 2001 From: Prowler Bot Date: Wed, 30 Oct 2024 16:10:36 +0100 Subject: [PATCH] fix(gcp): enforce correct severity levels in CloudSQL PostgreSQL `log_min_messages` (#5587) Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com> Co-authored-by: Sergio --- ...instance_postgres_log_min_messages_flag.py | 29 +++++++++++++------ 1 file changed, 20 insertions(+), 9 deletions(-) diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_messages_flag/cloudsql_instance_postgres_log_min_messages_flag.py b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_messages_flag/cloudsql_instance_postgres_log_min_messages_flag.py index 6a5d765496..9c6c501f4d 100644 --- a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_messages_flag/cloudsql_instance_postgres_log_min_messages_flag.py +++ b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_messages_flag/cloudsql_instance_postgres_log_min_messages_flag.py @@ -4,7 +4,16 @@ from prowler.providers.gcp.services.cloudsql.cloudsql_client import cloudsql_cli class cloudsql_instance_postgres_log_min_messages_flag(Check): def execute(self) -> Check_Report_GCP: - desired_log_min_messages = "error" + failing_log_levels = [ + "DEBUG5", + "DEBUG4", + "DEBUG3", + "DEBUG2", + "DEBUG1", + "INFO", + "NOTICE", + ] + findings = [] for instance in cloudsql_client.instances: if "POSTGRES" in instance.version: @@ -14,15 +23,17 @@ class cloudsql_instance_postgres_log_min_messages_flag(Check): report.resource_name = instance.name report.location = instance.region report.status = "FAIL" - report.status_extended = f"PostgreSQL Instance {instance.name} does not have 'log_min_messages' flag set minimum to '{desired_log_min_messages}'." + report.status_extended = f"PostgreSQL Instance {instance.name} does not have 'log_min_messages' flag set." + for flag in instance.flags: - if ( - flag["name"] == "log_min_messages" - and flag["value"] == desired_log_min_messages - ): - report.status = "PASS" - report.status_extended = f"PostgreSQL Instance {instance.name} has 'log_min_messages' flag set minimum to '{desired_log_min_messages}'." - break + if flag.get("name", "") == "log_min_messages": + current_level = flag.get("value", "").upper() + if current_level in failing_log_levels: + report.status = "FAIL" + report.status_extended = f"PostgreSQL Instance {instance.name} has 'log_min_messages' flag set to '{current_level}', which is below the recommended minimum of 'ERROR'." + else: + report.status = "PASS" + report.status_extended = f"PostgreSQL Instance {instance.name} has 'log_min_messages' flag set to an acceptable severity level: '{current_level}'." findings.append(report) return findings