github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/cloud/policies/google/gke/enable_master_networks.go (about) 1 package gke 2 3 import ( 4 "github.com/khulnasoft-lab/defsec/internal/rules" 5 "github.com/khulnasoft-lab/defsec/pkg/providers" 6 "github.com/khulnasoft-lab/defsec/pkg/scan" 7 "github.com/khulnasoft-lab/defsec/pkg/severity" 8 "github.com/khulnasoft-lab/defsec/pkg/state" 9 ) 10 11 var CheckEnableMasterNetworks = rules.Register( 12 scan.Rule{ 13 AVDID: "AVD-GCP-0061", 14 Provider: providers.GoogleProvider, 15 Service: "gke", 16 ShortCode: "enable-master-networks", 17 Summary: "Master authorized networks should be configured on GKE clusters", 18 Impact: "Unrestricted network access to the master", 19 Resolution: "Enable master authorized networks", 20 Explanation: `Enabling authorized networks means you can restrict master access to a fixed set of CIDR ranges`, 21 Links: []string{}, 22 Terraform: &scan.EngineMetadata{ 23 GoodExamples: terraformEnableMasterNetworksGoodExamples, 24 BadExamples: terraformEnableMasterNetworksBadExamples, 25 Links: terraformEnableMasterNetworksLinks, 26 RemediationMarkdown: terraformEnableMasterNetworksRemediationMarkdown, 27 }, 28 Severity: severity.High, 29 }, 30 func(s *state.State) (results scan.Results) { 31 for _, cluster := range s.Google.GKE.Clusters { 32 if cluster.Metadata.IsUnmanaged() { 33 continue 34 } 35 if cluster.MasterAuthorizedNetworks.Enabled.IsFalse() { 36 results.Add( 37 "Cluster does not have master authorized networks enabled.", 38 cluster.MasterAuthorizedNetworks.Enabled, 39 ) 40 } else { 41 results.AddPassed(&cluster) 42 } 43 44 } 45 return 46 }, 47 )