forked from aquasecurity/cloudsploit
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathpostgresqlLogMinDuration.js
More file actions
82 lines (67 loc) · 3.71 KB
/
Copy pathpostgresqlLogMinDuration.js
File metadata and controls
82 lines (67 loc) · 3.71 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
var async = require('async');
var helpers = require('../../../helpers/google');
module.exports = {
title: 'PostgreSQL Log Min Duration Statement',
category: 'SQL',
domain: 'Databases',
description: 'Ensures SQL instances for PostgreSQL type have log min duration statement flag disabled.',
more_info: 'SQL instance for PostgreSQL databases provides log_min_duration_statement flag. It is used to log the duration of every completed statement. This should always be disabled as there can be sensitive information as well that should not be recorded in the logs.',
link: 'https://cloud.google.com/sql/docs/postgres/flags',
recommended_action: 'Ensure that log_min_duration_statement flag is disabled for all PostgreSQL instances.',
apis: ['instances:sql:list'],
run: function(cache, settings, callback) {
var results = [];
var source = {};
var regions = helpers.regions();
let projects = helpers.addSource(cache, source,
['projects','get', 'global']);
if (!projects || projects.err || !projects.data) {
helpers.addResult(results, 3,
'Unable to query for projects: ' + helpers.addError(projects), 'global', null, null, projects.err);
return callback(null, results, source);
}
let project = projects.data[0].name;
async.each(regions.instances.sql, function(region, rcb) {
let sqlInstances = helpers.addSource(
cache, source, ['instances', 'sql', 'list', region]);
if (!sqlInstances) return rcb();
if (sqlInstances.err || !sqlInstances.data) {
helpers.addResult(results, 3, 'Unable to query SQL instances: ' + helpers.addError(sqlInstances), region);
return rcb();
}
if (!sqlInstances.data.length) {
helpers.addResult(results, 0, 'No SQL instances found', region);
return rcb();
}
sqlInstances.data.forEach(sqlInstance => {
if (sqlInstance.instanceType && sqlInstance.instanceType.toUpperCase() === 'READ_REPLICA_INSTANCE') return;
let resource = helpers.createResourceName('instances', sqlInstance.name, project);
if (sqlInstance.databaseVersion && !sqlInstance.databaseVersion.toLowerCase().includes('postgres')) {
helpers.addResult(results, 0,
'SQL instance database type is not of PostgreSQL type', region, resource);
return;
}
if (sqlInstance.settings &&
sqlInstance.settings.databaseFlags &&
sqlInstance.settings.databaseFlags.length) {
let found = sqlInstance.settings.databaseFlags.find(flag => flag.name && flag.name == 'log_min_duration_statement' &&
flag.value && flag.value == '-1');
if (found) {
helpers.addResult(results, 0,
'SQL instance does not have log_min_duration_statement flag enabled', region, resource);
} else {
helpers.addResult(results, 2,
'SQL instance have log_min_duration_statement flag enabled', region, resource);
}
} else {
helpers.addResult(results, 0,
'SQL instance does not have log_min_duration_statement flag enabled', region, resource);
}
});
rcb();
}, function() {
// Global checking goes here
callback(null, results, source);
});
}
};