Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade google_redis_instance() to expose 'transit_encryption_mode' attribute #305

Open
sukchomb-zz opened this issue Feb 1, 2021 · 2 comments

Comments

@sukchomb-zz
Copy link

We want to be able to test if a memstore redis instance has TLS enabled.

Detailed Description

When TLS is enabled 'transit_encryption_mode' is set to 'SERVER_AUTHENTICATION' in @fetched

During Inspec resource execution, although 'transit_encryption_mode' is brought back in @fetched object, there is no corresponding method in google_redis_instance#methods which can be used to test it in the resource.

Context

We can explicitly test this attribute and further check the security posture of the platform.

Possible Implementation

As an interim fix to , I have implemented this as:

 this_redis_instance= google_redis_instance(project: p_gcp_project_id, region: p_redis_instance_region, name: p_redis_instance_name)
      
 describe "Instance $#{p_redis_instance_name}$, its TLS settings is expected to be 'SERVER_AUTHENTICATION'"  do
   subject {this_redis_instance.inspect.to_s.match?('transitEncryptionMode\"=>\"SERVER_AUTHENTICATION')}
    it {should cmp true}
 end
trickyearlobe pushed a commit to trickyearlobe/magic-modules that referenced this issue Feb 2, 2021
As requested in inspec/inspec-gcp#305
Adding an Enum for transitEncryptionMode on google_redis_instance.

Impact on Terraform has not been tested... is it more appropriate
to do this in the inspec.yaml to avoid unexpected problems with
existing terraform plans?

Signed-off-by: Richard Nixon <[email protected]>
@slevenick
Copy link
Collaborator

This will be done via GoogleCloudPlatform/magic-modules#4444

@trickyearlobe
Copy link

@sukchomb , sorry this took a while... could you go ahead and test please.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants