github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/cloud/policies/google/gke/enable_stackdriver_monitoring.tf.go (about)

     1  package gke
     2  
     3  var terraformEnableStackdriverMonitoringGoodExamples = []string{
     4  	`
     5   resource "google_service_account" "default" {
     6     account_id   = "service-account-id"
     7     display_name = "Service Account"
     8   }
     9   
    10   resource "google_container_cluster" "good_example" {
    11     name     = "my-gke-cluster"
    12     location = "us-central1"
    13   
    14     # We can't create a cluster with no node pool defined, but we want to only use
    15     # separately managed node pools. So we create the smallest possible default
    16     # node pool and immediately delete it.
    17     remove_default_node_pool = true
    18     initial_node_count       = 1
    19     monitoring_service = "monitoring.googleapis.com/kubernetes"
    20   }
    21   
    22   resource "google_container_node_pool" "primary_preemptible_nodes" {
    23     name       = "my-node-pool"
    24     location   = "us-central1"
    25     cluster    = google_container_cluster.primary.name
    26     node_count = 1
    27   
    28     node_config {
    29       preemptible  = true
    30       machine_type = "e2-medium"
    31   
    32       # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
    33       service_account = google_service_account.default.email
    34       oauth_scopes    = [
    35         "https://www.googleapis.com/auth/cloud-platform"
    36       ]
    37     }
    38   }
    39   `,
    40  }
    41  
    42  var terraformEnableStackdriverMonitoringBadExamples = []string{
    43  	`
    44   resource "google_service_account" "default" {
    45     account_id   = "service-account-id"
    46     display_name = "Service Account"
    47   }
    48   
    49   resource "google_container_cluster" "bad_example" {
    50     name     = "my-gke-cluster"
    51     location = "us-central1"
    52   
    53     # We can't create a cluster with no node pool defined, but we want to only use
    54     # separately managed node pools. So we create the smallest possible default
    55     # node pool and immediately delete it.
    56     remove_default_node_pool = true
    57     initial_node_count       = 1
    58     monitoring_service = "monitoring.googleapis.com"
    59   }
    60   
    61   resource "google_container_node_pool" "primary_preemptible_nodes" {
    62     name       = "my-node-pool"
    63     location   = "us-central1"
    64     cluster    = google_container_cluster.primary.name
    65     node_count = 1
    66   
    67     node_config {
    68       preemptible  = true
    69       machine_type = "e2-medium"
    70   
    71       # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
    72       service_account = google_service_account.default.email
    73       oauth_scopes    = [
    74         "https://www.googleapis.com/auth/cloud-platform"
    75       ]
    76     }
    77   }
    78   `,
    79  }
    80  
    81  var terraformEnableStackdriverMonitoringLinks = []string{
    82  	`https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#monitoring_service`,
    83  }
    84  
    85  var terraformEnableStackdriverMonitoringRemediationMarkdown = ``