Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

terraform GKE policies: they pass when a config block is missing #90

Open
czunker opened this issue Dec 8, 2022 · 0 comments
Open

terraform GKE policies: they pass when a config block is missing #90

czunker opened this issue Dec 8, 2022 · 0 comments
Assignees
Labels
bug Something isn't working terraform Terraform

Comments

@czunker
Copy link
Contributor

czunker commented Dec 8, 2022

Describe the bug
E.g., the policy terraform-gcp-security-gke-enable-auto-repair is not applied to this GKE config:

resource "google_container_node_pool" "node_pool" {
  name       = "mondoo-operator-pool-${random_string.suffix.result}"
  location   = "us-central1-a"
  cluster    = google_container_cluster.cluster.id
  node_count = 1

  node_config {
    spot         = true
    machine_type = "e2-standard-2"
  }
}

The config block management is missing. So, the setting is missing and the policy should fail.

This applies to some more policies.

To Reproduce
Steps to reproduce the behavior:

  1. Enable terraform GCP policy
  2. Run cnspec against a terraform file containing above node pool.
  3. See the above control is skipped.

Expected behavior
The control should fail.

Desktop (please complete the following information):

  • OS: Ubuntu 22.04
  • cnspec version: 7.7.1
@chris-rock chris-rock added bug Something isn't working terraform Terraform labels Jan 8, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working terraform Terraform
Projects
None yet
Development

No branches or pull requests

3 participants