terraform.gcp.security.gcp-memory-store-for-redis-auth-enabled.gcp-memory-store-for-redis-auth-enabled
semgrep
Author
unknown
Download Count*
License
Ensure Memorystore for Redis has AUTH enabled
Run Locally
Run in CI
Defintion
rules:
- id: gcp-memory-store-for-redis-auth-enabled
patterns:
- pattern: resource
- pattern-inside: |
resource "google_redis_instance" "..." {
...
}
- pattern-not-inside: |
resource "google_redis_instance" "..." {
...
auth_enabled = true
...
}
message: Ensure Memorystore for Redis has AUTH enabled
metadata:
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
cwe:
- "CWE-284: Improper Access Control"
category: security
technology:
- terraform
- gcp
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Commons Clause License Condition v1.0[LGPL-2.1-only]
vulnerability_class:
- Improper Authorization
languages:
- hcl
severity: WARNING
Examples
gcp-memory-store-for-redis-auth-enabled.tf
# ok: gcp-memory-store-for-redis-auth-enabled
resource "google_redis_instance" "pass" {
name = "my-pass-instance"
memory_size_gb = 1
tier = "STANDARD_HA"
location_id = "us-central1-a"
alternative_location_id = "us-central1-f"
redis_version = "REDIS_6_X"
labels = {
foo = "bar"
}
auth_enabled = true
}
# fail
# ruleid: gcp-memory-store-for-redis-auth-enabled
resource "google_redis_instance" "fail1" {
name = "my-fail-instance1"
tier = "STANDARD_HA"
memory_size_gb = 1
location_id = "us-central1-a"
alternative_location_id = "us-central1-f"
redis_version = "REDIS_4_0"
display_name = "I am insecure"
maintenance_policy {
weekly_maintenance_window {
day = "TUESDAY"
start_time {
hours = 0
minutes = 30
seconds = 0
nanos = 0
}
}
}
}
# fail
# ruleid: gcp-memory-store-for-redis-auth-enabled
resource "google_redis_instance" "fail2" {
name = "my-fail-instance2"
memory_size_gb = 1
auth_enabled = false
}
Short Link: https://sg.run/Gvvq