Legacy Client Certificate Auth Enabled
- Query id: 73fb21a1-b19a-45b1-b648-b47b1678681e
- Query name: Legacy Client Certificate Auth Enabled
- Platform: Terraform
- Severity: Low
- Category: Insecure Configurations
- CWE: 299
- URL: Github
Description¶
Kubernetes Clusters must use the default OAuth authentication, which means 'master_auth' must either be undefined or have 'client_certificate_config' with the attribute 'issue_client_certificate' equal to false
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Positive test num. 1 - tf file
#this is a problematic code where the query should report a result(s)
resource "google_container_cluster" "positive1" {
name = "marcellus-wallace"
location = "us-central1-a"
initial_node_count = 3
master_auth {
}
timeouts {
create = "30m"
update = "40m"
}
}
resource "google_container_cluster" "positive2" {
name = "marcellus-wallace"
location = "us-central1-a"
initial_node_count = 3
master_auth {
client_certificate_config {
issue_client_certificate = true
}
}
timeouts {
create = "30m"
update = "40m"
}
}
Code samples without security vulnerabilities¶
Negative test num. 1 - tf file
#this code is a correct code for which the query should not find any result
resource "google_container_cluster" "negative1" {
name = "marcellus-wallace"
location = "us-central1-a"
initial_node_count = 3
master_auth {
client_certificate_config {
issue_client_certificate = false
}
}
timeouts {
create = "30m"
update = "40m"
}
}
# leaving the field undefined is acceptable
resource "google_container_cluster" "negative2" {
name = "marcellus-wallace"
location = "us-central1-a"
initial_node_count = 3
timeouts {
create = "30m"
update = "40m"
}
}