terraform.gcp.security.gcp-memory-store-for-redis-intransit-encryption.gcp-memory-store-for-redis-intransit-encryption
semgrep
Author
unknown
Download Count*
License
Ensure Memorystore for Redis uses intransit encryption
Run Locally
Run in CI
Defintion
rules:
- id: gcp-memory-store-for-redis-intransit-encryption
patterns:
- pattern: |
resource "google_redis_instance" $ANYTHING {
...
}
- pattern-not-inside: |
resource "google_redis_instance" $ANYTHING {
...
transit_encryption_mode = "SERVER_AUTHENTICATION"
...
}
message: Ensure Memorystore for Redis uses intransit encryption
languages:
- hcl
severity: WARNING
metadata:
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
cwe:
- "CWE-284: Improper Access Control"
technology:
- terraform
- gcp
category: security
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Commons Clause License Condition v1.0[LGPL-2.1-only]
vulnerability_class:
- Improper Authorization
Examples
gcp-memory-store-for-redis-intransit-encryption.tf
# ok: gcp-memory-store-for-redis-intransit-encryption
resource "google_redis_instance" "pass" {
provider = google-beta
name = "mrr-memory-cache"
tier = "STANDARD_HA"
memory_size_gb = 5
location_id = "us-central1-a"
alternative_location_id = "us-central1-f"
authorized_network = data.google_compute_network.redis-network.id
redis_version = "REDIS_6_X"
display_name = "Terraform Test Instance"
reserved_ip_range = "192.168.0.0/28"
replica_count = 5
read_replicas_mode = "READ_REPLICAS_ENABLED"
labels = {
my_key = "my_val"
other_key = "other_val"
}
transit_encryption_mode = "SERVER_AUTHENTICATION"
}
# fail
# ruleid: gcp-memory-store-for-redis-intransit-encryption
resource "google_redis_instance" "fail" {
provider = google-beta
name = "mrr-memory-cache"
tier = "STANDARD_HA"
memory_size_gb = 5
location_id = "us-central1-a"
alternative_location_id = "us-central1-f"
authorized_network = data.google_compute_network.redis-network.id
redis_version = "REDIS_6_X"
display_name = "Terraform Test Instance"
reserved_ip_range = "192.168.0.0/28"
replica_count = 5
read_replicas_mode = "READ_REPLICAS_ENABLED"
labels = {
my_key = "my_val"
other_key = "other_val"
}
}
# fail
# ruleid: gcp-memory-store-for-redis-intransit-encryption
resource "google_redis_instance" "fail2" {
provider = google-beta
name = "mrr-memory-cache"
tier = "STANDARD_HA"
memory_size_gb = 5
location_id = "us-central1-a"
alternative_location_id = "us-central1-f"
authorized_network = data.google_compute_network.redis-network.id
redis_version = "REDIS_6_X"
display_name = "Terraform Test Instance"
reserved_ip_range = "192.168.0.0/28"
replica_count = 5
read_replicas_mode = "READ_REPLICAS_ENABLED"
labels = {
my_key = "my_val"
other_key = "other_val"
}
transit_encryption_mode = "DISABLED"
}
Short Link: https://sg.run/Rvvq