Skip to content

Commit 8525131

Browse files
james-zhou-inspire11james-zhou-inspire11
committed
featI(CG-1306): add gcp cis 1.30 6.2.9
1 parent b718845 commit 8525131

3 files changed

Lines changed: 184 additions & 0 deletions

File tree

‎src/gcp/cis-1.3.0/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,7 @@ Policy Pack based on the GCP Foundations 1.3.0 benchmark provided by the [Center
119119
| GCP CIS 6.2.6 | Ensure that the 'log_min_messages' database flag for Cloud SQL PostgreSQL instance is set appropriately |
120120
| GCP CIS 6.2.7 | Ensure 'log_min_error_statement' database flag for Cloud SQL PostgreSQL instance is set to 'Error' or stricter |
121121
| GCP CIS 6.2.8 | Ensure that the 'log_min_duration_statement' database flag for Cloud SQL PostgreSQL instance is set to '-1' (disabled) |
122+
| GCP CIS 6.2.9 | Ensure That 'cloudsql.enable_pgaudit' Database Flag for each Cloud Sql Postgresql Instance Is Set to 'on' For Centralized Logging |
122123
| GCP CIS 6.3.1 | Ensure 'external scripts enabled' database flag for Cloud SQL SQL Server instance is set to 'off' |
123124
| GCP CIS 6.3.2 | Ensure that the 'cross db ownership chaining' database flag for Cloud SQL SQL Server instance is set to 'off' |
124125
| GCP CIS 6.3.3 | Ensure 'user connections' database flag for Cloud SQL SQL Server instance is set as appropriate |

‎src/gcp/cis-1.3.0/rules/gcp-cis-1.3.0-2.15.ts‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
export default {
2+
id: 'gcp-cis-1.3.0-2.15',
3+
title:
4+
'GCP CIS 2.15 Ensure \'Access Approval\' is \'Enabled\'',
5+
description: `GCP Access Approval enables you to require your organizations' explicit approval
6+
whenever Google support try to access your projects. You can then select users within your
7+
organization who can approve these requests through giving them a security role in IAM.
8+
All access requests display which Google Employee requested them in an email or Pub/Sub
9+
message that you can choose to Approve. This adds an additional control and logging of
10+
who in your organization approved/denied these requests.`,
11+
audit: `**Determine if Access Transparency is Enabled**
12+
13+
1. From the Google Cloud Home, click on the Navigation hamburger menu in the top left. Hover over the IAM & Admin Menu. Select settings in the middle of the column that opens.
14+
2. The status should be "Enabled' under the heading *Access Transparency*
15+
16+
**Enable Access Transparency**
17+
18+
1. From the Google Cloud Home, click on the Navigation hamburger menu in the top left. Hover over the *IAM & Admin* Menu. Select *settings* in the middle of the column that opens.
19+
2. Click the blue button labeled Enable *Access Transparency for Organization*
20+
21+
**Determine if Access Approval is Enabled**
22+
23+
1. From the Google Cloud Home, within the project you wish to check, click on the Navigation hamburger menu in the top left. Hover over the *Security* Menu. Select *Access Approval* in the middle of the column that opens.
24+
2. The status will be displayed here. If you see a screen saying you need to enroll in Access Approval, it is not enabled.
25+
26+
**From CLI:
27+
28+
Determine if Access Approval is Enabled**
29+
30+
1. From within the project you wish to audit, run the following command.
31+
32+
gcloud access-approval settings get
33+
34+
2. The status will be displayed in the output.`,
35+
36+
rationale: `Controlling access to your information is one of the foundations of information security.
37+
Google Employees do have access to your organizations' projects for support reasons. With
38+
Access Approval, organizations can then be certain that their information is accessed by
39+
only approved Google Personnel.`,
40+
remediation: `**From Console:**
41+
42+
1. From the Google Cloud Home, within the project you wish to enable, click on the Navigation hamburger menu in the top left. Hover over the *Security* Menu. Select *Access Approval* in the middle of the column that opens.
43+
2. The status will be displayed here. On this screen, there is an option to click *Enroll*. If
44+
it is greyed out and you see an error bar at the top of the screen that says *Access Transparency is not enabled* please view the corresponding reference within this section to enable it.
45+
3. In the second screen click *Enroll*.
46+
47+
**Grant an IAM Group or User the role with permissions to Add Users to be Access Approval message Recipients**
48+
49+
1. From the Google Cloud Home, within the project you wish to enable, click on the Navigation hamburger menu in the top left. Hover over the *IAM and Admin*. Select *IAM* in the middle of the column that opens.
50+
2. Click the blue button the says *+add* at the top of the screen.
51+
3. In the *principals* field, select a user or group by typing in their associated email address.
52+
4. Click on the role field to expand it. In the filter field enter *Access Approval Approver* and select it.
53+
5. Click *save*.
54+
55+
**Add a Group or User as an Approver for Access Approval Requests**
56+
57+
1. As a user with the *Access Approval Approver* permission, within the project where you wish to add an email address to which request will be sent, click on the Navigation hamburger menu in the top left. Hover over the *Security* Menu. Select *Access Approval* in the middle of the column that opens.
58+
2. Click *Manage Settings*
59+
3. Under *Set up approval notifications*s, enter the email address associated with a Google Cloud User or Group you wish to send Access Approval requests to. All future access approvals will be sent as emails to this address.
60+
61+
**From CLI:**
62+
63+
1. To update all services in an entire project, run the following command from an account that has permissions as an 'Approver for Access Approval Requests'
64+
65+
gcloud access-approval settings update --project=<project name> --
66+
enrolled_services=all --notification_emails='<email recipient for access
67+
approval requests>@<domain name>'
68+
69+
**Default Value:**
70+
71+
By default Access Approval and its dependency of Access Transparency are not enabled.`,
72+
references: [
73+
'https://cloud.google.com/cloud-provider-access-management/accessapproval/docs',
74+
'https://cloud.google.com/cloud-provider-access-management/accessapproval/docs/overview',
75+
'https://cloud.google.com/cloud-provider-access-management/accessapproval/docs/quickstart-custom-key',
76+
'https://cloud.google.com/cloud-provider-access-management/accessapproval/docs/supported-services',
77+
'https://cloud.google.com/cloud-provider-access-management/accessapproval/docs/view-historical-requests',
78+
],
79+
gql: `{
80+
querygcpAsset {
81+
id
82+
__typename
83+
}
84+
}`,
85+
resource: 'querygcpProject[*]',
86+
severity: 'unknown',
87+
check: ({ resource }: any) => {
88+
const { assets } = resource
89+
return !!assets
90+
},
91+
}

‎src/gcp/cis-1.3.0/tests/gcp-cis-1.3.0-6.x.test.ts‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import Gcp_CIS_130_625 from '../rules/gcp-cis-1.3.0-6.2.5'
1313
import Gcp_CIS_130_626 from '../rules/gcp-cis-1.3.0-6.2.6'
1414
import Gcp_CIS_130_627 from '../rules/gcp-cis-1.3.0-6.2.7'
1515
import Gcp_CIS_130_628 from '../rules/gcp-cis-1.3.0-6.2.8'
16+
import Gcp_CIS_130_629 from '../rules/gcp-cis-1.3.0-6.2.9'
1617
import Gcp_CIS_130_631 from '../rules/gcp-cis-1.3.0-6.3.1'
1718
import Gcp_CIS_130_632 from '../rules/gcp-cis-1.3.0-6.3.2'
1819
import Gcp_CIS_130_633 from '../rules/gcp-cis-1.3.0-6.3.3'
@@ -882,6 +883,97 @@ describe('CIS Google Cloud Platform Foundations: 1.3.0', () => {
882883
})
883884
})
884885

886+
describe("GCP CIS 6.2.9 Ensure That 'cloudsql.enable_pgaudit' Database Flag for each Cloud Sql Postgresql Instance Is Set to 'on' For Centralized Logging", () => {
887+
const getRuleFixture = (): SqlInstances => {
888+
return {
889+
id: 'db-id',
890+
databaseVersion: 'POSTGRES',
891+
name: 'test-postgres-instance',
892+
settings: {
893+
databaseFlags: [
894+
{
895+
name: 'cloudsql.enable_pgaudit',
896+
value: 'on',
897+
},
898+
],
899+
},
900+
}
901+
}
902+
903+
const testRule = async (
904+
data: SqlInstances,
905+
expectedResult: Result
906+
): Promise<void> => {
907+
// Act
908+
const [processedRule] = await rulesEngine.processRule(
909+
Gcp_CIS_130_629 as Rule,
910+
{ querygcpSqlInstance: [data] }
911+
)
912+
913+
// Asserts
914+
expect(processedRule.result).toBe(expectedResult)
915+
}
916+
917+
test("No Security Issue when all POSTGRES instances have the 'cloudsql.enable_pgaudit' set to 'on'", async () => {
918+
const data = {
919+
id: 'db-id',
920+
databaseVersion: 'POSTGRES',
921+
name: 'test-postgres-instance',
922+
settings: {
923+
databaseFlags: [
924+
{
925+
name: 'dummy_key',
926+
value: 'on',
927+
},
928+
{
929+
name: 'cloudsql.enable_pgaudit',
930+
value: 'on',
931+
},
932+
],
933+
},
934+
}
935+
await testRule(data, Result.PASS)
936+
})
937+
938+
test('Security Issue when the POSTGRES instances have no database flags', async () => {
939+
const data = getRuleFixture()
940+
data.settings.databaseFlags = []
941+
await testRule(data, Result.FAIL)
942+
})
943+
944+
test("Security Issue when the POSTGRES instances do NOT have a 'cloudsql.enable_pgaudit' database flag", async () => {
945+
const data = getRuleFixture()
946+
data.settings.databaseFlags = [
947+
{
948+
name: 'dummy_key',
949+
value: '-1',
950+
},
951+
]
952+
await testRule(data, Result.FAIL)
953+
})
954+
955+
test("Security Issue when the POSTGRES instances do have a 'cloudsql.enable_pgaudit' database flag set to 'off'", async () => {
956+
const data = {
957+
id: 'db-id',
958+
databaseVersion: 'POSTGRES',
959+
name: 'test-postgres-instance',
960+
settings: {
961+
databaseFlags: [
962+
{
963+
name: 'dummy_key',
964+
value: 'on',
965+
},
966+
{
967+
name: 'cloudsql.enable_pgaudit',
968+
value: 'off',
969+
},
970+
],
971+
},
972+
}
973+
await testRule(data, Result.FAIL)
974+
})
975+
})
976+
885977
describe("GCP CIS 6.3.1 Ensure 'external scripts enabled' database flag for Cloud SQL SQL Server instance is set to 'off'", () => {
886978
const getRuleFixture = (): SqlInstances => {
887979
return {

0 commit comments

Comments
 (0)