turbot/steampipe-mod-terraform-gcp-compliance

Control: Ensure that the 'cross db ownership chaining' database flag for Cloud SQL SQL Server instance is set to 'off'

Description

It is recommended to set cross DB ownership chaining database flag for Cloud SQL SQL Server instance to off.

Usage

Run the control in your terminal:

powerpipe control run terraform_gcp_compliance.control.sql_instance_sql_cross_db_ownership_chaining_database_flag_off

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run terraform_gcp_compliance.control.sql_instance_sql_cross_db_ownership_chaining_database_flag_off --share

SQL

This control uses a named query:

select
address as resource,
case
when coalesce(trim((attributes_std ->> 'database_version')), '') = '' then 'alarm'
when (attributes_std ->> 'database_version') not like 'SQLSERVER%' then 'skip'
when (attributes_std -> 'settings' -> 'database_flags' ->> 'name' = 'cross db ownership chaining') and
(attributes_std -> 'settings' -> 'database_flags' ->> 'value') = 'off'
then 'ok'
else 'alarm'
end as status,
split_part(address, '.', 2) || case
when coalesce(trim((attributes_std ->> 'database_version')), '') = ''
then ' ''database_version'' is not defined'
when (attributes_std ->> 'database_version') not like 'SQLSERVER%'
then ' not a SQL Server database'
when (attributes_std -> 'settings') is null then ' ''settings'' is not defined'
when (attributes_std -> 'settings' -> 'database_flags') is null then ' ''settings.database_flags'' is not defined'
when coalesce(trim((attributes_std -> 'settings' -> 'database_flags' ->> 'name')), '') = ''
then ' ''settings.database_flags.name'' is not defined'
when coalesce(trim((attributes_std -> 'settings' -> 'database_flags' ->> 'value')), '') = ''
then ' ''settings.database_flags.value'' is not defined'
when (attributes_std -> 'settings' -> 'database_flags' ->> 'name') <> 'cross db ownership chaining'
then ' ''cross db ownership chaining'' database flag not set'
when (attributes_std -> 'settings' -> 'database_flags' ->> 'name') = 'cross db ownership chaining' and
(attributes_std -> 'settings' -> 'database_flags' ->> 'value') = 'off'
then ' ''cross db ownership chaining'' database flag set to ''off'''
else ' ''cross db ownership chaining'' database flag set to ''on'''
end || '.' reason
, path || ':' || start_line
from
terraform_resource
where
type = 'google_sql_database_instance';

Tags