checkov
checkov copied to clipboard
GoogleCloudPostgreSql checks falsely pass when not declared at all
Describe the issue
Checks regarding GoogleCloudPostgreSql (database_flags) seems to return failure only when explicitly set while not taking into account default behaviour from cloud provider. Instead, I would suggest we invert the logic of the tests and also add missing flags as failure. I've tested this with log_lock_waits
and log_connections
and by looking at code it seems to expand to more. I would like to volunteer to fine comb all those checks according to official documentation and maybe even add some more checks.
Examples
It should be if (flag['name'] == 'log_lock_waits') and (flag['value'] == 'on'):
and also fix pass2
in example as fail2
and add it in test.
Version (please complete the following information):
- Checkov Version 2.1.90