diff --git a/internal/adapters/terraform/google/compute/networks.go b/internal/adapters/terraform/google/compute/networks.go index 26f50df9..14322575 100644 --- a/internal/adapters/terraform/google/compute/networks.go +++ b/internal/adapters/terraform/google/compute/networks.go @@ -10,6 +10,10 @@ import ( "github.com/aquasecurity/defsec/pkg/terraform" ) +const ( + defaultSubnetPurpose = "PRIVATE_RFC_1918" +) + func adaptNetworks(modules terraform.Modules) (networks []compute.Network) { networkMap := make(map[string]compute.Network) @@ -28,12 +32,13 @@ func adaptNetworks(modules terraform.Modules) (networks []compute.Network) { subnetwork := compute.SubNetwork{ Metadata: subnetworkBlock.GetMetadata(), Name: subnetworkBlock.GetAttribute("name").AsStringValueOrDefault("", subnetworkBlock), + Purpose: subnetworkBlock.GetAttribute("purpose").AsStringValueOrDefault(defaultSubnetPurpose, subnetworkBlock), EnableFlowLogs: defsecTypes.BoolDefault(false, subnetworkBlock.GetMetadata()), } // logging if logConfigBlock := subnetworkBlock.GetBlock("log_config"); logConfigBlock.IsNotNil() { - subnetwork.EnableFlowLogs = defsecTypes.BoolExplicit(true, subnetworkBlock.GetBlock("log_config").GetMetadata()) + subnetwork.EnableFlowLogs = defsecTypes.BoolExplicit(true, logConfigBlock.GetMetadata()) } nwAttr := subnetworkBlock.GetAttribute("network") diff --git a/internal/adapters/terraform/google/compute/networks_test.go b/internal/adapters/terraform/google/compute/networks_test.go index e0708c2a..19899913 100644 --- a/internal/adapters/terraform/google/compute/networks_test.go +++ b/internal/adapters/terraform/google/compute/networks_test.go @@ -75,6 +75,7 @@ func Test_adaptNetworks(t *testing.T) { Metadata: defsecTypes.NewTestMetadata(), Name: defsecTypes.String("test-subnetwork", defsecTypes.NewTestMetadata()), EnableFlowLogs: defsecTypes.Bool(true, defsecTypes.NewTestMetadata()), + Purpose: defsecTypes.StringDefault("PRIVATE_RFC_1918", defsecTypes.NewTestMetadata()), }, }, }, @@ -84,7 +85,8 @@ func Test_adaptNetworks(t *testing.T) { name: "defaults", terraform: ` resource "google_compute_subnetwork" "example" { - network = google_compute_network.example.id + network = google_compute_network.example.id + purpose = "REGIONAL_MANAGED_PROXY" } resource "google_compute_network" "example" { @@ -106,6 +108,7 @@ func Test_adaptNetworks(t *testing.T) { Metadata: defsecTypes.NewTestMetadata(), Name: defsecTypes.String("", defsecTypes.NewTestMetadata()), EnableFlowLogs: defsecTypes.Bool(false, defsecTypes.NewTestMetadata()), + Purpose: defsecTypes.String("REGIONAL_MANAGED_PROXY", defsecTypes.NewTestMetadata()), }, }, },