自定义检查GCP云SQL数据库标志

Question

我已经用了大约一个星期的时间了，所以我还在摸索。到目前为止，这个产品非常棒。也就是说，我有一点麻烦让这个自定义检查谷歌云SQL工作如预期。检查的目的是确保远程访问的数据库标志设置为"关闭"。下面的TF代码应该通过自定义检查，但是没有通过。相反，我得到一个错误(见下文):

我想也许我没有正确使用subMatch/Predicatedmatch，但无论我做什么，检查总是失败。还有一个类似的检查，作为GCP的标准检查。我通过一个YAML检查器运行自定义检查逻辑，它返回正常，因此我可以排除任何YAML特定的语法错误。

TF Code (Pass example)

resource "random_id" "db_name_suffix" {
byte_length = 4
}
resource "google_sql_database_instance" "instance" {
provider = google-beta
name             = "private-instance-${random_id.db_name_suffix.hex}"
region           = "us-central1"
database_version = "SQLSERVER_2019_STANDARD"
root_password    = "#######"
depends_on = [google_service_networking_connection.private_vpc_connection]
settings {
tier = "db-f1-micro"
ip_configuration {
ipv4_enabled    = false
private_network = google_compute_network.private_network.id
require_ssl = true
}
backup_configuration {
enabled = true
}
password_validation_policy {
min_length                  = 6
reuse_interval              = 2
complexity                  = "COMPLEXITY_DEFAULT"
disallow_username_substring = true
password_change_interval    = "30s"
enable_password_policy      = true
}

database_flags {
name  = "contained database authentication"
value = "off"
}
database_flags {
name  = "cross db ownership chaining"
value = "off"
}
database_flags {
name  = "remote access"
value = "off"
}
} 
}

Tfsec Custom Check:

---
checks:
- code: SQL-01 Ensure Remote Access is disabled
description: Ensure Remote Access is disabled
impact: Prevents locally stored procedures form being run remotely
resolution: configure remote access = off
requiredTypes:
- resource
requiredLabels:
- google_sql_database_instance
severity: HIGH
matchSpec:
name: settings
action: isPresent
subMatchOne:
- name: database_flags
action: isPresent
predicateMatchSpec:
- name: name
action: equals
value: remote access
- name: value
action: equals
value: off
errorMessage: DB remote access has not been disabled
relatedLinks:
- http://testcontrols.com/gcp

错误消息

Error: invalid option: failed to load custom checks from ./custom_checks: Check did not pass the expected schema. yaml: unmarshal errors:
line 15: cannot unmarshal !!map into []custom.MatchSpec

Answer 1

昨晚我终于能让它工作了。

---
checks:
- code: SQL-01 Ensure Remote Access is disabled
description: Ensure Remote Access is disabled
impact: Prevents locally stored procedures form being run remotely
resolution: configure remote access = off
requiredTypes:
- resource
requiredLabels:
- google_sql_database_instance
severity: HIGH
matchSpec:
name: settings
action: isPresent
predicateMatchSpec:
- name: database_flags
action: isPresent
subMatch:
name: name
action: equals
value: remote access
- action: and
subMatch:
name: value
action: equals
value: off
errorMessage: DB remote access has not been disabled
relatedLinks:
- http://testcontrols.com/gcp