fix(gcp): check cloudsql sslMode (#4635)

prowler-cloud · Aug 5, 2024 · 8adc72a · 8adc72a
1 parent 9addf86
commit 8adc72a
Show file tree

Hide file tree

Showing 25 changed files with 218 additions and 83 deletions.
diff --git a/.../services/cloudsql/cloudsql_instance_ssl_connections/cloudsql_instance_ssl_connections.py b/.../services/cloudsql/cloudsql_instance_ssl_connections/cloudsql_instance_ssl_connections.py
@@ -15,7 +15,7 @@ def execute(self) -> Check_Report_GCP:
             report.status_extended = (
                 f"Database Instance {instance.name} requires SSL connections."
             )
-            if not instance.ssl:
+            if not instance.require_ssl or instance.ssl_mode != "ENCRYPTED_ONLY":
                 report.status = "FAIL"
                 report.status_extended = f"Database Instance {instance.name} does not require SSL connections."
             findings.append(report)

diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_service.py b/prowler/providers/gcp/services/cloudsql/cloudsql_service.py
@@ -31,9 +31,12 @@ def __get_instances__(self):
                                 region=instance["region"],
                                 ip_addresses=instance.get("ipAddresses", []),
                                 public_ip=public_ip,
-                                ssl=instance["settings"]["ipConfiguration"].get(
+                                require_ssl=instance["settings"]["ipConfiguration"].get(
                                     "requireSsl", False
                                 ),
+                                ssl_mode=instance["settings"]["ipConfiguration"].get(
+                                    "sslMode", "ALLOW_UNENCRYPTED_AND_ENCRYPTED"
+                                ),
                                 automated_backups=instance["settings"][
                                     "backupConfiguration"
                                 ]["enabled"],
@@ -61,7 +64,8 @@ class Instance(BaseModel):
     region: str
     public_ip: bool
     authorized_networks: list
-    ssl: bool
+    require_ssl: bool
+    ssl_mode: str
     automated_backups: bool
     flags: list
     project_id: str
diff --git a/tests/providers/gcp/gcp_fixtures.py b/tests/providers/gcp/gcp_fixtures.py
@@ -583,6 +583,7 @@ def mock_api_instances_calls(client: MagicMock, service: str):
                     "settings": {
                         "ipConfiguration": {
                             "requireSsl": True,
+                            "sslMode": "ENCRYPTED_ONLY",
                             "authorizedNetworks": [{"value": "test"}],
                         },
                         "backupConfiguration": {"enabled": True},
@@ -597,6 +598,7 @@ def mock_api_instances_calls(client: MagicMock, service: str):
                     "settings": {
                         "ipConfiguration": {
                             "requireSsl": False,
+                            "sslMode": "ALLOW_UNENCRYPTED_AND_ENCRYPTED",
                             "authorizedNetworks": [{"value": "test"}],
                         },
                         "backupConfiguration": {"enabled": False},

diff --git a/.../cloudsql/cloudsql_instance_automated_backups/cloudsql_instance_automated_backups_test.py b/.../cloudsql/cloudsql_instance_automated_backups/cloudsql_instance_automated_backups_test.py
@@ -52,7 +52,8 @@ def test_cloudsql_instance_with_automated_backups(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[],
@@ -97,7 +98,8 @@ def test_cloudsql_instance_without_automated_backups(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=False,
                     authorized_networks=[],
                     flags=[],

diff --git a/...oudsql_instance_mysql_local_infile_flag/cloudsql_instance_mysql_local_infile_flag_test.py b/...oudsql_instance_mysql_local_infile_flag/cloudsql_instance_mysql_local_infile_flag_test.py
@@ -52,7 +52,8 @@ def test_cloudsql_postgres_instance(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[],
@@ -88,7 +89,8 @@ def test_cloudsql_instance_with_no_flags(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[],
@@ -133,7 +135,8 @@ def test_cloudsql_instance_with_local_infile_flag_off(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[{"name": "local_infile", "value": "off"}],
@@ -178,7 +181,8 @@ def test_cloudsql_instance_with_local_infile_flag_on(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[{"name": "local_infile", "value": "on"}],

diff --git a/...nce_mysql_skip_show_database_flag/cloudsql_instance_mysql_skip_show_database_flag_test.py b/...nce_mysql_skip_show_database_flag/cloudsql_instance_mysql_skip_show_database_flag_test.py
@@ -52,7 +52,8 @@ def test_cloudsql_postgres_instance(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[],
@@ -88,7 +89,8 @@ def test_cloudsql_instance_no_flags(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[],
@@ -133,7 +135,8 @@ def test_cloudsql_instance_with_skip_show_databases_off(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[{"name": "skip_show_database", "value": "off"}],
@@ -178,7 +181,8 @@ def test_cloudsql_instance_with_skip_show_databases_on(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[{"name": "skip_show_database", "value": "on"}],

diff --git a/...tance_postgres_enable_pgaudit_flag/cloudsql_instance_postgres_enable_pgaudit_flag_test.py b/...tance_postgres_enable_pgaudit_flag/cloudsql_instance_postgres_enable_pgaudit_flag_test.py
@@ -52,7 +52,8 @@ def test_cloudsql_mysql_instance(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[],
@@ -88,7 +89,8 @@ def test_cloudsql_instance_no_flags(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[],
@@ -133,7 +135,8 @@ def test_cloudsql_instance_pgaudit_flag_off(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[{"name": "cloudsql.enable_pgaudit", "value": "off"}],
@@ -178,7 +181,8 @@ def test_cloudsql_instance_pgaudit_flag_on(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[{"name": "cloudsql.enable_pgaudit", "value": "on"}],

diff --git a/...nce_postgres_log_connections_flag/cloudsql_instance_postgres_log_connections_flag_test.py b/...nce_postgres_log_connections_flag/cloudsql_instance_postgres_log_connections_flag_test.py
@@ -52,7 +52,8 @@ def test_cloudsql_mysql_instance(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[],
@@ -88,7 +89,8 @@ def test_cloudsql_instance_no_flags(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[],
@@ -133,7 +135,8 @@ def test_cloudsql_instance_log_connections_flag_off(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[{"name": "log_connections", "value": "off"}],
@@ -178,7 +181,8 @@ def test_cloudsql_instance_log_connections_flag_on(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[{"name": "log_connections", "value": "on"}],

diff --git a/...stgres_log_disconnections_flag/cloudsql_instance_postgres_log_disconnections_flag_test.py b/...stgres_log_disconnections_flag/cloudsql_instance_postgres_log_disconnections_flag_test.py
@@ -52,7 +52,8 @@ def test_cloudsql_mysql_instance(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[],
@@ -88,7 +89,8 @@ def test_cloudsql_instance_no_flags(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[],
@@ -133,7 +135,8 @@ def test_cloudsql_instance_log_disconnections_flag_off(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[{"name": "log_disconnections", "value": "off"}],
@@ -178,7 +181,8 @@ def test_cloudsql_instance_log_disconnections_flag_on(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[{"name": "log_disconnections", "value": "on"}],

diff --git a/...gres_log_error_verbosity_flag/cloudsql_instance_postgres_log_error_verbosity_flag_test.py b/...gres_log_error_verbosity_flag/cloudsql_instance_postgres_log_error_verbosity_flag_test.py
@@ -52,7 +52,8 @@ def test_cloudsql_mysql_instance(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[],
@@ -88,7 +89,8 @@ def test_cloudsql_instance_no_flags(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[],
@@ -133,7 +135,8 @@ def test_cloudsql_instance_log_error_verbosity_flag_off(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[{"name": "log_error_verbosity", "value": "off"}],
@@ -178,7 +181,8 @@ def test_cloudsql_instance_log_error_verbosity_flag_on(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[{"name": "log_error_verbosity", "value": "default"}],

diff --git a/...uration_statement_flag/cloudsql_instance_postgres_log_min_duration_statement_flag_test.py b/...uration_statement_flag/cloudsql_instance_postgres_log_min_duration_statement_flag_test.py
@@ -52,7 +52,8 @@ def test_cloudsql_mysql_instance(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[],
@@ -88,7 +89,8 @@ def test_cloudsql_instance_no_flags(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[],
@@ -133,7 +135,8 @@ def test_cloudsql_instance_log_min_duration_statement_flag_off(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[{"name": "log_min_duration_statement", "value": "0"}],
@@ -178,7 +181,8 @@ def test_cloudsql_instance_log_min_duration_statement_flag_on(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[{"name": "log_min_duration_statement", "value": "-1"}],

diff --git a/..._min_error_statement_flag/cloudsql_instance_postgres_log_min_error_statement_flag_test.py b/..._min_error_statement_flag/cloudsql_instance_postgres_log_min_error_statement_flag_test.py
@@ -52,7 +52,8 @@ def test_cloudsql_mysql_instance(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[],
@@ -88,7 +89,8 @@ def test_cloudsql_instance_no_flags(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[],
@@ -133,7 +135,8 @@ def test_cloudsql_instance_log_min_error_statement_flag_off(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[{"name": "log_min_error_statement", "value": "warning"}],
@@ -178,7 +181,8 @@ def test_cloudsql_instance_log_min_error_statement_flag_on(self):
                     ip_addresses=[],
                     region=GCP_EU1_LOCATION,
                     public_ip=False,
-                    ssl=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
                     automated_backups=True,
                     authorized_networks=[],
                     flags=[{"name": "log_min_error_statement", "value": "error"}],