checkov icon indicating copy to clipboard operation
checkov copied to clipboard

fix(terraform): Added ssl_mode attribute support to CKV_GCP_6

Open jbrule opened this issue 6 months ago • 1 comments

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Description

Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change.

Fixes # Adds support for ssl_mode attribute that replaces the deprecated require_ssl attribute used previously (policy still supports require_ssl is present but ssl_mode supercedes). Checks to make sure the "TRUSTED_CLIENT_CERTIFICATE_REQUIRED" option is used as require_ssl = true enforced certificate verification https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1/instances#SslMode

Terraform dropped support for require_ssl in v6.0.1 -> https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/version_6_upgrade#settingsip_configurationrequire_ssl-is-now-removed-in-601

Closes issues #6102

New/Edited policies (Delete if not relevant)

CKV_GCP_6

Description

require_ssl has been deprecated and has been removed from the google Terraform provider v6.0.1

Fix

Replace require_ssl = true with ssl_mode = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"

Checklist:

  • [X] I have performed a self-review of my own code
  • [X] I have commented my code, particularly in hard-to-understand areas
  • [X] I have made corresponding changes to the documentation -> Docs PR.
  • [X] I have added tests that prove my feature, policy, or fix is effective and works
  • [X] New and existing tests pass locally with my changes

jbrule avatar Sep 03 '24 21:09 jbrule