CKV2_GCP_3 a1b2c3d4-e5f6-7890-abcd-ef1234567890

assets/queries/terraform/gcp/legacy_networks_exist_for_project/metadata.json

@@ -5,7 +5,7 @@
   "severity": "HIGH",
   "category": "Networking",
   "descriptionText": "Ensures that no legacy networks with auto_create_subnetworks enabled exist in a project.",
-  "descriptionUrl": "https://cloud.google.com/vpc/docs/vpc#legacy",
+  "descriptionUrl": "https://cloud.google.com/vpc/docs/legacy",
   "platform": "Terraform",
   "cloudProvider": "GCP",
   "cwe": "CWE-400"

assets/queries/terraform/gcp/service_has_non_gcp_managed_service_account_keys/metadata.json

@@ -0,0 +1,12 @@
+{
+  "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
+  "descriptionID": "a1b2c3d4",
+  "queryName": "There are non GCP-managed service account keys for a service account",
+  "severity": "HIGH",
+  "category": "ENCRYPTION",
+  "descriptionText": "Ensures that only GCP-managed service account keys are used, preventing manually created keys that pose security risks.",
+  "descriptionUrl": "https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys",
+  "platform": "Terraform",
+  "cloudProvider": "GCP",
+  "cwe": "CWE-522"
+}

assets/queries/terraform/gcp/service_has_non_gcp_managed_service_account_keys/query.rego

@@ -0,0 +1,21 @@
+package Cx
+
+import data.generic.common as common_lib
+import data.generic.terraform as tf_lib
+
+CxPolicy[result] {
+    resource := input.document[i].resource.google_service_account_key[name]
+    common_lib.valid_key(resource, "public_key_data")
+    result := {
+        "documentId": input.document[i].id,
+        "resourceType": "google_service_account_key",
+        "resourceName": tf_lib.get_resource_name(resource, name),
+        "searchKey": sprintf("google_service_account_key[%s].public_key_data", [name]),
+        "issueType": "IncorrectValue",
+        "keyExpectedValue": "google_service_account_key should not have a public_key_data attribute",
+        "keyActualValue": "google_service_account_key has a public_key_data attribute",
+        "searchLine": common_lib.build_search_line(["resource", "google_service_account_key", name],["public_key_data"]),
+        "remediation": "Remove the google_service_account_key resource to rely only on GCP-managed keys.",
+        "remediationType": "removal",
+    }
+}

assets/queries/terraform/gcp/service_has_non_gcp_managed_service_account_keys/test/negative.tf

@@ -0,0 +1,3 @@
+resource "google_service_account_key" "bad_key" {
+  service_account_id = "projects/my-project/serviceAccounts/my-service-account"
+}

assets/queries/terraform/gcp/service_has_non_gcp_managed_service_account_keys/test/positive.tf

@@ -0,0 +1,4 @@
+resource "google_service_account_key" "bad_key" {
+  service_account_id = "projects/my-project/serviceAccounts/my-service-account"
+  public_key_data    = "dummy-key"
+}

assets/queries/terraform/gcp/service_has_non_gcp_managed_service_account_keys/test/positive_expected_result.json

@@ -0,0 +1,7 @@
+[
+  {
+    "queryName": "Ensure that there are only GCP-managed service account keys for each service account",
+    "severity": "HIGH",
+    "line": 3
+  }
+]

dd-iac-scan.config

@@ -1,3 +1,3 @@
 {
-  "exclude-severities":[low],
+  "exclude-severities":[low, info],
 }