Control: Ensure that the 'cross db ownership chaining' database flag for Cloud SQL SQL Server instance is set to 'off'
Description
It is recommended to set cross DB ownership chaining database flag for Cloud SQL SQL Server instance to off.
Usage
Run the control in your terminal:
powerpipe control run terraform_gcp_compliance.control.sql_instance_sql_cross_db_ownership_chaining_database_flag_off
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run terraform_gcp_compliance.control.sql_instance_sql_cross_db_ownership_chaining_database_flag_off --share
SQL
This control uses a named query:
select address as resource, case when coalesce(trim((attributes_std ->> 'database_version')), '') = '' then 'alarm' when (attributes_std ->> 'database_version') not like 'SQLSERVER%' then 'skip' when (attributes_std -> 'settings' -> 'database_flags' ->> 'name' = 'cross db ownership chaining') and (attributes_std -> 'settings' -> 'database_flags' ->> 'value') = 'off' then 'ok' else 'alarm' end as status, split_part(address, '.', 2) || case when coalesce(trim((attributes_std ->> 'database_version')), '') = '' then ' ''database_version'' is not defined' when (attributes_std ->> 'database_version') not like 'SQLSERVER%' then ' not a SQL Server database' when (attributes_std -> 'settings') is null then ' ''settings'' is not defined' when (attributes_std -> 'settings' -> 'database_flags') is null then ' ''settings.database_flags'' is not defined' when coalesce(trim((attributes_std -> 'settings' -> 'database_flags' ->> 'name')), '') = '' then ' ''settings.database_flags.name'' is not defined' when coalesce(trim((attributes_std -> 'settings' -> 'database_flags' ->> 'value')), '') = '' then ' ''settings.database_flags.value'' is not defined' when (attributes_std -> 'settings' -> 'database_flags' ->> 'name') <> 'cross db ownership chaining' then ' ''cross db ownership chaining'' database flag not set' when (attributes_std -> 'settings' -> 'database_flags' ->> 'name') = 'cross db ownership chaining' and (attributes_std -> 'settings' -> 'database_flags' ->> 'value') = 'off' then ' ''cross db ownership chaining'' database flag set to ''off''' else ' ''cross db ownership chaining'' database flag set to ''on''' end || '.' reason , path || ':' || start_linefrom terraform_resourcewhere type = 'google_sql_database_instance';