checkov icon indicating copy to clipboard operation
checkov copied to clipboard

GoogleCloudPostgreSql checks falsely pass when not declared at all

Open losisin opened this issue 1 year ago • 0 comments

Describe the issue Checks regarding GoogleCloudPostgreSql (database_flags) seems to return failure only when explicitly set while not taking into account default behaviour from cloud provider. Instead, I would suggest we invert the logic of the tests and also add missing flags as failure. I've tested this with log_lock_waits and log_connections and by looking at code it seems to expand to more. I would like to volunteer to fine comb all those checks according to official documentation and maybe even add some more checks.

Examples It should be if (flag['name'] == 'log_lock_waits') and (flag['value'] == 'on'): and also fix pass2 in example as fail2 and add it in test.

Version (please complete the following information):

  • Checkov Version 2.1.90

losisin avatar Aug 08 '22 06:08 losisin