turbot/gcp_compliance

Query: kubernetes_cluster_incoming_traffic_open_to_all

Usage

powerpipe query gcp_compliance.query.kubernetes_cluster_incoming_traffic_open_to_all

SQL

with network_open_to_all as (
select
distinct network
from
gcp_compute_firewall
where
direction = 'INGRESS'
and action = 'Allow'
and source_ranges ?& array['0.0.0.0/0']
)
select
distinct self_link resource,
case
when a.network is not null then 'alarm'
else 'ok'
end as status,
case
when a.network is not null then title || ' allows incoming traffic from any source on the internet across all protocols.'
else title || ' restrict incoming traffic from any source on the internet across all protocols.'
end as reason
, location as location, project as project
from
gcp_kubernetes_cluster as c
left join network_open_to_all as a on c.network_config ->> 'network' = concat('projects/' || split_part(a.network, 'projects/', 2));

Controls

The query is being used by the following controls: