github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/cloud/policies/google/sql/pg_log_lock_waits.go (about) 1 package sql 2 3 import ( 4 "github.com/khulnasoft-lab/defsec/internal/rules" 5 "github.com/khulnasoft-lab/defsec/pkg/providers" 6 "github.com/khulnasoft-lab/defsec/pkg/providers/google/sql" 7 "github.com/khulnasoft-lab/defsec/pkg/scan" 8 "github.com/khulnasoft-lab/defsec/pkg/severity" 9 "github.com/khulnasoft-lab/defsec/pkg/state" 10 ) 11 12 var CheckPgLogLockWaits = rules.Register( 13 scan.Rule{ 14 AVDID: "AVD-GCP-0020", 15 Provider: providers.GoogleProvider, 16 Service: "sql", 17 ShortCode: "pg-log-lock-waits", 18 Summary: "Ensure that logging of lock waits is enabled.", 19 Impact: "Issues leading to denial of service may not be identified.", 20 Resolution: "Enable lock wait logging.", 21 Explanation: `Lock waits are often an indication of poor performance and often an indicator of a potential denial of service vulnerability, therefore occurrences should be logged for analysis.`, 22 Links: []string{ 23 "https://www.postgresql.org/docs/13/runtime-config-logging.html#GUC-LOG-LOCK-WAITS", 24 }, 25 Terraform: &scan.EngineMetadata{ 26 GoodExamples: terraformPgLogLockWaitsGoodExamples, 27 BadExamples: terraformPgLogLockWaitsBadExamples, 28 Links: terraformPgLogLockWaitsLinks, 29 RemediationMarkdown: terraformPgLogLockWaitsRemediationMarkdown, 30 }, 31 Severity: severity.Medium, 32 }, 33 func(s *state.State) (results scan.Results) { 34 for _, instance := range s.Google.SQL.Instances { 35 if instance.Metadata.IsUnmanaged() { 36 continue 37 } 38 if instance.DatabaseFamily() != sql.DatabaseFamilyPostgres { 39 continue 40 } 41 if instance.Settings.Flags.LogLockWaits.IsFalse() { 42 results.Add( 43 "Database instance is not configured to log lock waits.", 44 instance.Settings.Flags.LogLockWaits, 45 ) 46 } else { 47 results.AddPassed(&instance) 48 } 49 50 } 51 return 52 }, 53 )