Skip to content

Commit c189fe0

Browse files
tyler-dunkeltyler-dunkel
authored
Merge pull request #122 from cloudgraphdev/feature/CG-1306-GCP-CIS-130-629
Feature/cg 1306 gcp cis 130 629
2 parents 2bdb9bc + 256cd5c commit c189fe0

3 files changed

Lines changed: 256 additions & 0 deletions

File tree

‎src/gcp/cis-1.3.0/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,7 @@ Policy Pack based on the GCP Foundations 1.3.0 benchmark provided by the [Center
120120
| GCP CIS 6.2.6 | Ensure that the 'log_min_messages' database flag for Cloud SQL PostgreSQL instance is set appropriately |
121121
| GCP CIS 6.2.7 | Ensure 'log_min_error_statement' database flag for Cloud SQL PostgreSQL instance is set to 'Error' or stricter |
122122
| GCP CIS 6.2.8 | Ensure that the 'log_min_duration_statement' database flag for Cloud SQL PostgreSQL instance is set to '-1' (disabled) |
123+
| GCP CIS 6.2.9 | Ensure That 'cloudsql.enable_pgaudit' Database Flag for each Cloud Sql Postgresql Instance Is Set to 'on' For Centralized Logging |
123124
| GCP CIS 6.3.1 | Ensure 'external scripts enabled' database flag for Cloud SQL SQL Server instance is set to 'off' |
124125
| GCP CIS 6.3.2 | Ensure that the 'cross db ownership chaining' database flag for Cloud SQL SQL Server instance is set to 'off' |
125126
| GCP CIS 6.3.3 | Ensure 'user connections' database flag for Cloud SQL SQL Server instance is set as appropriate |

‎src/gcp/cis-1.3.0/rules/gcp-cis-1.3.0-6.2.9.ts‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
export default {
2+
id: 'gcp-cis-1.3.0-6.2.9',
3+
title:
4+
"GCP CIS 6.2.9 Ensure That 'cloudsql.enable_pgaudit' Database Flag for each Cloud Sql Postgresql Instance Is Set to 'on' For Centralized Logging",
5+
description: `Ensure *cloudsql.enable_pgaudit* database flag for Cloud SQL PostgreSQL instance is set
6+
to *on* to allow for centralized logging.`,
7+
audit: `**Determining if the pgAudit Flag is set to 'on'
8+
9+
From Console:**
10+
11+
1. Go to https://console.cloud.google.com/sql/instances.
12+
2. Select the instance to open its *Overview* page.
13+
3. Click *Edit*.
14+
4. Scroll down and expand Flags.
15+
5. Ensure that *cloudsql.enable_pgaudit* flag is set to *on*.
16+
17+
**From Command Line:**
18+
19+
Run the command by providing *<INSTANCE_NAME>*. Ensure the value of the flag is *on*.
20+
21+
gcloud sql instances describe <INSTANCE_NAME> --format="json" | jq '.settings|.|.databaseFlags[]|select(.name=="cloudsql.enable_pgaudit")|.value '
22+
23+
**Determine if the pgAudit extension is installed**
24+
25+
1. Connect to the the server running PostgreSQL or through a SQL client of your choice.
26+
2. Via command line open the PostgreSQL shell by typing psql
27+
3. Run the following command
28+
29+
SELECT * FROM pg_extension;
30+
31+
4. If pgAudit is in this list. If so, it is installed.
32+
33+
**Determine if Data Access Audit logs are enabled for your project and have sufficient privileges**
34+
35+
1. From the homepage open the hamburger menu in the top left.
36+
2. Scroll down to IAM & Adminand hover over it.
37+
3. In the menu that opens up, select Audit Logs
38+
4. In the middle of the page, in the search box next to filter search for Cloud Composer API
39+
5. Select it, and ensure that both 'Admin Read' and 'Data Read' are checked.
40+
41+
**Determine if logs are being sent to Logs Explorer**
42+
43+
1. From the Google Console home page, open the hamburger menu in the top left.
44+
2. In the menu that pops open, scroll down to Logs Explorer under Operations.
45+
3. In the query box, paste the following and search
46+
47+
resource.type="cloudsql_database"
48+
logName="projects/<your-project-name>/logs/cloudaudit.googleapis.com%2Fdata_access"
49+
protoPayload.request.@type="type.googleapis.com/google.cloud.sql.audit.v1.PgA uditEntry"
50+
51+
4. If it returns any log sources, they are correctly setup.
52+
`,
53+
rationale: 'As numerous other recommendations in this section consist of turning on flags for logging purposes, your organization will need a way to manage these logs. You may have a solution already in place. If you do not, consider installing and enabling the open source pgaudit extension within PostgreSQL and enabling its corresponding flag of cloudsql.enable_pgaudit. This flag and installing the extension enables database auditing in PostgreSQL through the open-source pgAudit extension. This extension provides detailed session and object logging to comply with government, financial, & ISO standards and provides auditing capabilities to mitigate threats by monitoring security events on the instance. Enabling the flag and settings later in this recommendation will send these logs to Google Logs Explorer so that you can access them in a central location. to This recommendation is applicable only to PostgreSQL database instances.',
54+
remediation: `**Initialize the pgAudit flag
55+
56+
From Console:**
57+
58+
1. Go to https://console.cloud.google.com/sql/instances.
59+
2. Select the instance to open its Overview page.
60+
3. Click *Edit*.
61+
4. Scroll down and expand Flags.
62+
5. To set a flag that has not been set on the instance before, click *Add item*.
63+
6. Enter *cloudsql.enable_pgaudit* for the flag name and set the flag to *on*.
64+
7. Click *Done*.
65+
8. Click *Save* to update the configuration.
66+
9. Confirm your changes under *Flags* on the *Overview* page.
67+
68+
**From Command Line:**
69+
70+
Run the below command by providing *<INSTANCE_NAME>* to enable *cloudsql.enable_pgaudit* flag.
71+
72+
gcloud sql instances patch <INSTANCE_NAME> --database- flags=cloudsql.enable_pgaudit=on
73+
74+
Note: *RESTART* is required to get this configuration in effect.
75+
76+
**Creating the extension**
77+
78+
1. Connect to the the server running PostgreSQL or through a SQL client of your choice.
79+
2. If SSHing to the server in the command line open the PostgreSQL shell by typing *psql*
80+
3. Run the following command as a superuser.
81+
82+
CREATE EXTENSION pgaudit;
83+
84+
**Updating the previously created pgaudit.log flag for your Logging Needs
85+
86+
From Console:**
87+
88+
Note: there are multiple options here. This command will enable logging for all databases on a server. Please see the customizing database audit logging reference for more flag options.
89+
90+
1. Go to https://console.cloud.google.com/sql/instances.
91+
2. Select the instance to open its *Overview* page.
92+
3. Click *Edit*.
93+
4. Scroll down and expand *Flags*.
94+
5. To set a flag that has not been set on the instance before, click *Add item*.
95+
6. Enter *pgaudit.log=all* for the flag name and set the flag to on.
96+
7. Click *Done*.
97+
8. Click *Save* to update the configuration.
98+
9. Confirm your changes under *Flags* on the *Overview* page.
99+
100+
**From Command Line:**
101+
Run the command
102+
103+
gcloud sql instances patch <INSTANCE_NAME> --database-flags cloudsql.enable_pgaudit=on,pgaudit.log=all
104+
105+
**Determine if logs are being sent to Logs Explorer**
106+
107+
1. From the Google Console home page, open the hamburger menu in the top left.
108+
2. In the menu that pops open, scroll down to Logs Explorer under Operations.
109+
3. In the query box, paste the following and search
110+
111+
resource.type="cloudsql_database" logName="projects//logs/cloudaudit.googleapis.com%2Fdata_access" protoPayload.request.@type="type.googleapis.com/google.cloud.sql.audit.v1.PgAuditEntry "
112+
113+
If it returns any log sources, they are correctly setup.
114+
115+
**Default Value:**
116+
117+
By default *cloudsql.enable_pgaudit* database flag is set to *off* and the extension is not enabled.`,
118+
references: [
119+
'https://cloud.google.com/sql/docs/postgres/flags#list-flags-postgres',
120+
'https://cloud.google.com/sql/docs/postgres/pg-audit#enable-auditing-flag',
121+
'https://cloud.google.com/sql/docs/postgres/pg-audit#customizing-database-audit-logging',
122+
'https://cloud.google.com/logging/docs/audit/configure-data-access#config-console-enable',
123+
],
124+
gql: `{
125+
querygcpSqlInstance(filter:{ databaseVersion: {regexp: "/POSTGRES*/"}}){
126+
name
127+
id
128+
__typename
129+
settings{
130+
databaseFlags{
131+
name
132+
value
133+
}
134+
}
135+
}
136+
}`,
137+
resource: 'querygcpSqlInstance[*]',
138+
exclude: { not: { path: '@.databaseVersion', match: /POSTGRES*/ } },
139+
severity: 'medium',
140+
conditions: {
141+
and: [
142+
{
143+
path: '@.settings.databaseFlags',
144+
isEmpty: false,
145+
},
146+
{
147+
path: '@.settings.databaseFlags',
148+
array_any: {
149+
and: [
150+
{
151+
path: '[*].name',
152+
equal: 'cloudsql.enable_pgaudit',
153+
},
154+
{
155+
path: '[*].value',
156+
equal: 'on',
157+
},
158+
],
159+
},
160+
},
161+
],
162+
},
163+
}

‎src/gcp/cis-1.3.0/tests/gcp-cis-1.3.0-6.x.test.ts‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import Gcp_CIS_130_625 from '../rules/gcp-cis-1.3.0-6.2.5'
1313
import Gcp_CIS_130_626 from '../rules/gcp-cis-1.3.0-6.2.6'
1414
import Gcp_CIS_130_627 from '../rules/gcp-cis-1.3.0-6.2.7'
1515
import Gcp_CIS_130_628 from '../rules/gcp-cis-1.3.0-6.2.8'
16+
import Gcp_CIS_130_629 from '../rules/gcp-cis-1.3.0-6.2.9'
1617
import Gcp_CIS_130_631 from '../rules/gcp-cis-1.3.0-6.3.1'
1718
import Gcp_CIS_130_632 from '../rules/gcp-cis-1.3.0-6.3.2'
1819
import Gcp_CIS_130_633 from '../rules/gcp-cis-1.3.0-6.3.3'
@@ -882,6 +883,97 @@ describe('CIS Google Cloud Platform Foundations: 1.3.0', () => {
882883
})
883884
})
884885

886+
describe("GCP CIS 6.2.9 Ensure That 'cloudsql.enable_pgaudit' Database Flag for each Cloud Sql Postgresql Instance Is Set to 'on' For Centralized Logging", () => {
887+
const getRuleFixture = (): SqlInstances => {
888+
return {
889+
id: 'db-id',
890+
databaseVersion: 'POSTGRES',
891+
name: 'test-postgres-instance',
892+
settings: {
893+
databaseFlags: [
894+
{
895+
name: 'cloudsql.enable_pgaudit',
896+
value: 'on',
897+
},
898+
],
899+
},
900+
}
901+
}
902+
903+
const testRule = async (
904+
data: SqlInstances,
905+
expectedResult: Result
906+
): Promise<void> => {
907+
// Act
908+
const [processedRule] = await rulesEngine.processRule(
909+
Gcp_CIS_130_629 as Rule,
910+
{ querygcpSqlInstance: [data] }
911+
)
912+
913+
// Asserts
914+
expect(processedRule.result).toBe(expectedResult)
915+
}
916+
917+
test("No Security Issue when all POSTGRES instances have the 'cloudsql.enable_pgaudit' set to 'on'", async () => {
918+
const data = {
919+
id: 'db-id',
920+
databaseVersion: 'POSTGRES',
921+
name: 'test-postgres-instance',
922+
settings: {
923+
databaseFlags: [
924+
{
925+
name: 'dummy_key',
926+
value: 'on',
927+
},
928+
{
929+
name: 'cloudsql.enable_pgaudit',
930+
value: 'on',
931+
},
932+
],
933+
},
934+
}
935+
await testRule(data, Result.PASS)
936+
})
937+
938+
test('Security Issue when the POSTGRES instances have no database flags', async () => {
939+
const data = getRuleFixture()
940+
data.settings.databaseFlags = []
941+
await testRule(data, Result.FAIL)
942+
})
943+
944+
test("Security Issue when the POSTGRES instances do NOT have a 'cloudsql.enable_pgaudit' database flag", async () => {
945+
const data = getRuleFixture()
946+
data.settings.databaseFlags = [
947+
{
948+
name: 'dummy_key',
949+
value: '-1',
950+
},
951+
]
952+
await testRule(data, Result.FAIL)
953+
})
954+
955+
test("Security Issue when the POSTGRES instances do have a 'cloudsql.enable_pgaudit' database flag set to 'off'", async () => {
956+
const data = {
957+
id: 'db-id',
958+
databaseVersion: 'POSTGRES',
959+
name: 'test-postgres-instance',
960+
settings: {
961+
databaseFlags: [
962+
{
963+
name: 'dummy_key',
964+
value: 'on',
965+
},
966+
{
967+
name: 'cloudsql.enable_pgaudit',
968+
value: 'off',
969+
},
970+
],
971+
},
972+
}
973+
await testRule(data, Result.FAIL)
974+
})
975+
})
976+
885977
describe("GCP CIS 6.3.1 Ensure 'external scripts enabled' database flag for Cloud SQL SQL Server instance is set to 'off'", () => {
886978
const getRuleFixture = (): SqlInstances => {
887979
return {

0 commit comments

Comments
 (0)