github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/cloud/policies/google/sql/no_cross_db_ownership_chaining.go (about) 1 package sql 2 3 import ( 4 "github.com/khulnasoft-lab/defsec/internal/rules" 5 "github.com/khulnasoft-lab/defsec/pkg/providers" 6 "github.com/khulnasoft-lab/defsec/pkg/providers/google/sql" 7 "github.com/khulnasoft-lab/defsec/pkg/scan" 8 "github.com/khulnasoft-lab/defsec/pkg/severity" 9 "github.com/khulnasoft-lab/defsec/pkg/state" 10 ) 11 12 var CheckNoCrossDbOwnershipChaining = rules.Register( 13 scan.Rule{ 14 AVDID: "AVD-GCP-0019", 15 Provider: providers.GoogleProvider, 16 Service: "sql", 17 ShortCode: "no-cross-db-ownership-chaining", 18 Summary: "Cross-database ownership chaining should be disabled", 19 Impact: "Unintended access to sensitive data", 20 Resolution: "Disable cross database ownership chaining", 21 Explanation: `Cross-database ownership chaining, also known as cross-database chaining, is a security feature of SQL Server that allows users of databases access to other databases besides the one they are currently using.`, 22 Links: []string{ 23 "https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/cross-db-ownership-chaining-server-configuration-option?view=sql-server-ver15", 24 }, 25 Terraform: &scan.EngineMetadata{ 26 GoodExamples: terraformNoCrossDbOwnershipChainingGoodExamples, 27 BadExamples: terraformNoCrossDbOwnershipChainingBadExamples, 28 Links: terraformNoCrossDbOwnershipChainingLinks, 29 RemediationMarkdown: terraformNoCrossDbOwnershipChainingRemediationMarkdown, 30 }, 31 Severity: severity.Medium, 32 }, 33 func(s *state.State) (results scan.Results) { 34 for _, instance := range s.Google.SQL.Instances { 35 if instance.Metadata.IsUnmanaged() { 36 continue 37 } 38 if instance.DatabaseFamily() != sql.DatabaseFamilySQLServer { 39 continue 40 } 41 if instance.Settings.Flags.CrossDBOwnershipChaining.IsTrue() { 42 results.Add( 43 "Database instance has cross database ownership chaining enabled.", 44 instance.Settings.Flags.CrossDBOwnershipChaining, 45 ) 46 } else { 47 results.AddPassed(&instance) 48 } 49 50 } 51 return 52 }, 53 )