terraform.gcp.best-practice.gcp-postgresql-log-min-message.gcp-postgresql-log-min-message

profile photo of semgrepsemgrep
Author
unknown
Download Count*

Ensure PostgreSQL database 'log_min_messages' flag is set to a valid value

Run Locally

Run in CI

Defintion

rules:
  - id: gcp-postgresql-log-min-message
    patterns:
      - pattern: resource
      - pattern-inside: |
          resource "google_sql_database_instance" "..." {
            ...
            database_flags {
              ...
              name  = "log_min_messages"
              value = "$VALUE"
              ...
            }
            ...
          }
      - metavariable-pattern:
          metavariable: $VALUE
          language: generic
          patterns:
            - pattern-not-regex: (?i)(DEBUG5|DEBUG4|DEBUG3|DEBUG2|DEBUG1|INFO|NOTICE|WARNING|ERROR|LOG|FATAL|PANIC)
    message: Ensure PostgreSQL database 'log_min_messages' flag is set to a valid value
    metadata:
      category: best-practice
      technology:
        - terraform
        - gcp
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
    languages:
      - hcl
    severity: WARNING

Examples

gcp-postgresql-log-min-message.tf

# fail
# ruleid: gcp-postgresql-log-min-message
resource "google_sql_database_instance" "fail" {
  database_version = "POSTGRES_12"
  name             = "general-pos121"
  project          = "gcp-bridgecrew-deployment"
  region           = "us-central1"
  settings {
    activation_policy = "ALWAYS"
    availability_type = "ZONAL"
    database_flags {
      name  = "log_checkpoints"
      value = "on"
    }
    database_flags {
      name  = "log_connections"
      value = "on"
    }
    database_flags {
      name  = "log_disconnections"
      value = "off"
    }
    database_flags {
      name  = "log_min_messages"
      value = "debug6"
    }
    database_flags {
      name  = "log_lock_waits"
      value = "off"
    }
    database_flags {
      name  = "log_temp_files"
      value = "10"
    }
    database_flags {
      name  = "log_min_duration_statement"
      value = "1"
    }
    pricing_plan = "PER_USE"
    tier         = "db-custom-1-3840"
  }
}

# ok: gcp-postgresql-log-min-message
resource "google_sql_database_instance" "pass" {
  database_version = "POSTGRES_12"
  name             = "general-pos121"
  project          = "gcp-bridgecrew-deployment"
  region           = "us-central1"
  settings {
    activation_policy = "ALWAYS"
    availability_type = "ZONAL"
    database_flags {
      name  = "log_checkpoints"
      value = "off"
    }
    database_flags {
      name  = "log_connections"
      value = "on"
    }
    database_flags {
      name  = "log_disconnections"
      value = "on"
    }
    database_flags {
      name  = "log_min_messages"
      value = "debug5"
    }
    database_flags {
      name  = "log_lock_waits"
      value = "on"
    }
    database_flags {
      name  = "log_temp_files"
      value = "10"
    }
    database_flags {
      name  = "log_min_duration_statement"
      value = "1"
    }
    pricing_plan = "PER_USE"

    tier = "db-custom-1-3840"
  }
}