terraform.gcp.security.gcp-compute-ip-forward.gcp-compute-ip-forward

profile photo of semgrepsemgrep
Author
unknown
Download Count*
LGPL Commons Clause
License

Ensure that IP forwarding is not enabled on Instances. This lets the instance act as a traffic router and receive traffic not intended for it, which may route traffic through unintended passages.

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: gcp-compute-ip-forward
    patterns:
      - pattern: resource
      - pattern-inside: |
          resource "google_compute_instance" "..." {
          ...
          can_ip_forward = true
          ...
          }
    message: "Ensure that IP forwarding is not enabled on Instances. This lets the
      instance act as a traffic router and receive traffic not intended for it,
      which may route traffic through unintended passages.\t"
    metadata:
      owasp:
        - A05:2017 - Broken Access Control
        - A01:2021 - Broken Access Control
      cwe:
        - "CWE-284: Improper Access Control"
      category: security
      technology:
        - terraform
        - gcp
      references:
        - https://docs.bridgecrew.io/docs/google-cloud-policy-index
      subcategory:
        - audit
      likelihood: LOW
      impact: LOW
      confidence: LOW
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
      vulnerability_class:
        - Improper Authorization
    languages:
      - hcl
    severity: INFO

Examples

gcp-compute-ip-forward.tf

# fail
# ruleid: gcp-compute-ip-forward
resource "google_compute_instance" "fail" {
    name         = "test"
    machine_type = "n1-standard-1"
    zone         = "us-central1-a"
    can_ip_forward = true
}

# ok: gcp-compute-ip-forward
resource "google_compute_instance" "success" {
    name         = "test"
    machine_type = "n1-standard-1"
    zone         = "us-central1-a"
}

# ok: gcp-compute-ip-forward
resource "google_compute_instance" "success2" {
    name         = "gke-test"
    machine_type = "n1-standard-1"
    zone         = "us-central1-a"
    can_ip_forward = false
}