terraform.gcp.security.gcp-sql-public-database.gcp-sql-public-database

profile photo of semgrepsemgrep
Author
unknown
Download Count*
LGPL Commons Clause
License

Ensure that Cloud SQL database Instances are not open to the world

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: gcp-sql-public-database
    patterns:
      - pattern: resource
      - pattern-either:
          - pattern-inside: |
              resource "google_sql_database_instance" "..." {
              ...
              ip_configuration {
                ...
                authorized_networks {
                  ...
                  value = "0.0.0.0/0"
                  ...
                }
                ...
              }
              ...
              }
          - pattern-inside: |
              resource "google_sql_database_instance" "..." {
              ...
              ip_configuration {
                ...
                dynamic "authorized_networks" {
                  ...
                  content {
                    ...
                    value = "0.0.0.0/0"
                    ...
                  }
                  ...
                }
                ...
              }
              ...
              }
    message: Ensure that Cloud SQL database Instances are not open to the world
    metadata:
      owasp:
        - A05:2017 - Broken Access Control
        - A01:2021 - Broken Access Control
      cwe:
        - "CWE-284: Improper Access Control"
      category: security
      technology:
        - terraform
        - gcp
      references:
        - https://owasp.org/Top10/A01_2021-Broken_Access_Control
      subcategory:
        - vuln
      likelihood: MEDIUM
      impact: MEDIUM
      confidence: MEDIUM
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
      vulnerability_class:
        - Improper Authorization
    languages:
      - hcl
    severity: WARNING

Examples

gcp-sql-public-database.tf

# fail
# ruleid: gcp-sql-public-database
resource "google_sql_database_instance" "instance1-fail" {
  database_version = "MYSQL_8_0"
  name             = "instance"
  region           = "us-central1"
  settings {
    tier = "db-f1-micro"
    ip_configuration {
      ipv4_enabled = true
      authorized_networks {
        name  = "XYZ"
        value = "1.2.3.4"
      }
      authorized_networks {
        name  = "Public"
        value = "0.0.0.0/0"
      }
      authorized_networks {
        name  = "ABC"
        value = "5.5.5.0/24"
      }
    }
  }
}

# fail
# ruleid: gcp-sql-public-database
resource "google_sql_database_instance" "instance4-fail" {
  name             = "instance"
  database_version = "POSTGRES_11"

  settings {
    tier = "db-f1-micro"

    ip_configuration {

      dynamic "authorized_networks" {
        for_each = google_compute_instance.apps
        iterator = apps

        content {
          name  = apps.value.name
          value = apps.value.network_interface.0.access_config.0.nat_ip
        }
      }

      dynamic "authorized_networks" {
        for_each = local.onprem
        iterator = onprem

        content {
          name  = "onprem-${onprem.key}"
          value = "0.0.0.0/0"
        }
      }
    }
  }
}

# ok: gcp-sql-public-database
resource "google_sql_database_instance" "instance2-pass" {
  database_version = "MYSQL_8_0"
  name             = "instance"
  region           = "us-central1"
  settings {
    tier = "db-f1-micro"
    ip_configuration {
      ipv4_enabled = true
      authorized_networks {
        name  = "XYZ"
        value = "1.2.3.4"
      }
      authorized_networks {
        name  = "ABC"
        value = "5.5.5.0/24"
      }
    }
  }
}

# ok: gcp-sql-public-database
resource "google_sql_database_instance" "instance5-pass" {
  name             = "instance"
  database_version = "POSTGRES_11"
  settings {
    tier = "db-f1-micro"

    ip_configuration {

      dynamic "authorized_networks" {
        for_each = google_compute_instance.apps
        iterator = apps

        content {
          name  = apps.value.name
          value = apps.value.network_interface.0.access_config.0.nat_ip
        }
      }

      dynamic "authorized_networks" {
        for_each = local.onprem
        iterator = onprem

        content {
          name  = "onprem-${onprem.key}"
          value = onprem.value
        }
      }
    }
  }
}

# ok: gcp-sql-public-database
resource "google_sql_database_instance" "instance6-pass" {
  provider = google-beta

  name   = "private-instance-${random_id.db_name_suffix.hex}"
  region = "us-central1"

  depends_on = [google_service_networking_connection.private_vpc_connection]

  settings {
    tier = "db-f1-micro"
    ip_configuration {
      ipv4_enabled    = false
      private_network = google_compute_network.private_network.id
    }
  }
}