forked from aquasecurity/cloudsploit
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathpostgresqlLogLockWaits.js
More file actions
82 lines (67 loc) · 3.62 KB
/
Copy pathpostgresqlLogLockWaits.js
File metadata and controls
82 lines (67 loc) · 3.62 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
var async = require('async');
var helpers = require('../../../helpers/google');
module.exports = {
title: 'PostgreSQL Log Lock Waits Flag Enabled',
category: 'SQL',
domain: 'Databases',
description: 'Ensures SQL instances for PostgreSQL type have log_lock_waits flag enabled.',
more_info: 'SQL instance for PostgreSQL database provides log_lock_waits flag. It is not enabled by default. Enabling it will make sure that log messages are generated whenever a session waits longer than deadlock_timeout to acquire a lock.',
link: 'https://cloud.google.com/sql/docs/postgres/flags#config',
recommended_action: 'Ensure that log_lock_waits flag is enabled for all PostgreSQL instances.',
apis: ['instances:sql:list'],
run: function(cache, settings, callback) {
var results = [];
var source = {};
var regions = helpers.regions();
let projects = helpers.addSource(cache, source,
['projects','get', 'global']);
if (!projects || projects.err || !projects.data) {
helpers.addResult(results, 3,
'Unable to query for projects: ' + helpers.addError(projects), 'global', null, null, projects.err);
return callback(null, results, source);
}
let project = projects.data[0].name;
async.each(regions.instances.sql, function(region, rcb){
let sqlInstances = helpers.addSource(
cache, source, ['instances', 'sql', 'list', region]);
if (!sqlInstances) return rcb();
if (sqlInstances.err || !sqlInstances.data) {
helpers.addResult(results, 3, 'Unable to query SQL instances: ' + helpers.addError(sqlInstances), region);
return rcb();
}
if (!sqlInstances.data.length) {
helpers.addResult(results, 0, 'No SQL instances found', region);
return rcb();
}
sqlInstances.data.forEach(sqlInstance => {
if (sqlInstance.instanceType && sqlInstance.instanceType.toUpperCase() === 'READ_REPLICA_INSTANCE') return;
let resource = helpers.createResourceName('instances', sqlInstance.name, project);
if (sqlInstance.databaseVersion && !sqlInstance.databaseVersion.toLowerCase().includes('postgres')) {
helpers.addResult(results, 0,
'SQL instance database type is not of postgreSQL type', region, resource);
return;
}
if (sqlInstance.settings &&
sqlInstance.settings.databaseFlags &&
sqlInstance.settings.databaseFlags.length) {
let found = sqlInstance.settings.databaseFlags.find(flag => flag.name && flag.name == 'log_lock_waits' &&
flag.value && flag.value == 'on');
if (found) {
helpers.addResult(results, 0,
'SQL instance have log_lock_waits flag enabled', region, resource);
} else {
helpers.addResult(results, 2,
'SQL instance does not have log_lock_waits flag enabled', region, resource);
}
} else {
helpers.addResult(results, 2,
'SQL instance does not have log_lock_waits flag enabled', region, resource);
}
});
rcb();
}, function(){
// Global checking goes here
callback(null, results, source);
});
}
};