SQL DB Instance With SSL Disabled

• Query id: 02474449-71aa-40a1-87ae-e14497747b00
• Query name: SQL DB Instance With SSL Disabled
• Platform: Terraform
• Severity: High
• Category: Encryption
• CWE: 732
• Risk score: 7.2
• URL: Github

Description

Cloud SQL Database Instance should have SSL enabled
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - tf file

resource "google_sql_database_instance" "positive1_1" {   # legacy support (terraform version < 6.0.1)
  provider = google-beta

  name   = "private-instance-${random_id.db_name_suffix.hex}"
  database_version = "POSTGRES_15"
  region = "us-central1"

  depends_on = [google_service_networking_connection.private_vpc_connection]

  settings {
    tier = "db-f1-micro"  # Undefined "ip_configuration"
  }
}

resource "google_sql_database_instance" "positive1_2" {   # legacy support (terraform version < 6.0.1)
  provider = google-beta

  name   = "private-instance-${random_id.db_name_suffix.hex}"
  database_version = "POSTGRES_15"
  region = "us-central1"

  depends_on = [google_service_networking_connection.private_vpc_connection]

  settings {
    tier = "db-f1-micro"
    ip_configuration {
      ipv4_enabled    = false
      private_network = google_compute_network.private_network.id
      # Undefined "require_ssl"
    }
  }
}

resource "google_sql_database_instance" "positive1_3" {   # legacy support (terraform version < 6.0.1)
  provider = google-beta

  name   = "private-instance-${random_id.db_name_suffix.hex}"
  database_version = "POSTGRES_15"
  region = "us-central1"

  depends_on = [google_service_networking_connection.private_vpc_connection]

  settings {
    tier = "db-f1-micro"
    ip_configuration {
      ipv4_enabled    = false
      private_network = google_compute_network.private_network.id
        require_ssl       = false
    }
  }
}

Positive test num. 2 - tf file

resource "google_sql_database_instance" "positive2_1" {
  name   = "private-instance-no-ssl-mode"
  database_version = "POSTGRES_15"
  region = "us-central1"

  depends_on = [google_service_networking_connection.private_vpc_connection]

  settings {
    tier = "db-f1-micro"

    ip_configuration {
      ipv4_enabled    = false
      private_network = google_compute_network.private_network.id
      # Undefined "ssl_mode"
    }
  }
}

resource "google_sql_database_instance" "positive2_2" {
  name   = "private-instance-unspecified"
  database_version = "POSTGRES_15"
  region = "us-central1"

  depends_on = [google_service_networking_connection.private_vpc_connection]

  settings {
    tier = "db-f1-micro"

    ip_configuration {
      ipv4_enabled    = false
      private_network = google_compute_network.private_network.id
      ssl_mode        = "SSL_MODE_UNSPECIFIED"  # Unexpected value
    }
  }
}

resource "google_sql_database_instance" "positive2_3" {
  name   = "private-instance-unencrypted"
  database_version = "POSTGRES_15"
  region = "us-central1"

  depends_on = [google_service_networking_connection.private_vpc_connection]

  settings {
    tier = "db-f1-micro"

    ip_configuration {
      ipv4_enabled    = false
      private_network = google_compute_network.private_network.id
      ssl_mode        = "ALLOW_UNENCRYPTED_AND_ENCRYPTED"  # Allows unencrypted (non-SSL/non-TLS) connections
    }
  }
}

Positive test num. 3 - tf file

resource "google_sql_database_instance" "positive3_1" {
  provider = google-beta

  name   = "private-instance-${random_id.db_name_suffix.hex}"
  database_version = "POSTGRES_15"
  region = "us-central1"

  depends_on = [google_service_networking_connection.private_vpc_connection]

  settings {
    tier = "db-f1-micro"  # Undefined "ip_configuration"
  }
}

resource "google_sql_database_instance" "positive3_2" {
  name   = "private-instance-no-ssl-mode"
  database_version = "SQLSERVER_2017_STANDARD"
  region = "us-central1"

  depends_on = [google_service_networking_connection.private_vpc_connection]

  settings {
    tier = "db-f1-micro"

    ip_configuration {
      ipv4_enabled    = false
      private_network = google_compute_network.private_network.id
      # Undefined "ssl_mode"
    }
  }
}

resource "google_sql_database_instance" "positive3_3" {
  name   = "private-instance-unspecified"
  database_version = "SQLSERVER_2017_STANDARD"
  region = "us-central1"

  depends_on = [google_service_networking_connection.private_vpc_connection]

  settings {
    tier = "db-f1-micro"

    ip_configuration {
      ipv4_enabled    = false
      private_network = google_compute_network.private_network.id
      ssl_mode        = "SSL_MODE_UNSPECIFIED"  # Unexpected value
    }
  }
}

resource "google_sql_database_instance" "positive3_4" {
  name   = "private-instance-unencrypted"
  database_version = "SQLSERVER_2017_STANDARD"
  region = "us-central1"

  depends_on = [google_service_networking_connection.private_vpc_connection]

  settings {
    tier = "db-f1-micro"

    ip_configuration {
      ipv4_enabled    = false
      private_network = google_compute_network.private_network.id
      ssl_mode        = "ALLOW_UNENCRYPTED_AND_ENCRYPTED"  # Allows unencrypted (non-SSL/non-TLS) connections
    }
  }
}

resource "google_sql_database_instance" "positive3_5" {
  name   = "private-instance-unspecified"
  database_version = "SQLSERVER_2017_STANDARD"
  region = "us-central1"

  depends_on = [google_service_networking_connection.private_vpc_connection]

  settings {
    tier = "db-f1-micro"

    ip_configuration {
      ipv4_enabled    = false
      private_network = google_compute_network.private_network.id
      ssl_mode        = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"  # Value Unsupported by SQLSERVER databases
    }
  }
}

Code samples without security vulnerabilities

Negative test num. 1 - tf file

resource "google_sql_database_instance" "negative1_1" {   # legacy support (terraform version < 6.0.1)
  provider = google-beta

  name   = "private-instance-${random_id.db_name_suffix.hex}"
  database_version = "POSTGRES_15"
  region = "us-central1"

  depends_on = [google_service_networking_connection.private_vpc_connection]

  settings {
    tier = "db-f1-micro"
    ip_configuration {
      ipv4_enabled    = false
      private_network = google_compute_network.private_network.id
        require_ssl       = true
    }
  }
}

Negative test num. 2 - tf file

resource "google_sql_database_instance" "negative2_1" {
  name   = "private-instance-encrypted"
  database_version = "POSTGRES_15"
  region = "us-central1"

  depends_on = [google_service_networking_connection.private_vpc_connection]

  settings {
    tier = "db-f1-micro"

    ip_configuration {
      ipv4_enabled    = false
      private_network = google_compute_network.private_network.id
      ssl_mode        = "ENCRYPTED_ONLY"  # Only allows connections encrypted with SSL/TLS
    }
  }
}

resource "google_sql_database_instance" "negative2_2" {
  name   = "private-instance-trusted-cert"
  database_version = "POSTGRES_15"
  region = "us-central1"

  depends_on = [google_service_networking_connection.private_vpc_connection]

  settings {
    tier = "db-f1-micro"

    ip_configuration {
      ipv4_enabled    = false
      private_network = google_compute_network.private_network.id
      ssl_mode        = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"  # Only allow connections encrypted with SSL/TLS and with valid client certificates
    }
  }
}

Negative test num. 3 - tf file

resource "google_sql_database_instance" "negative3_1" {
  name   = "private-instance-encrypted"
  database_version = "SQLSERVER_2017_STANDARD"
  region = "us-central1"

  depends_on = [google_service_networking_connection.private_vpc_connection]

  settings {
    tier = "db-f1-micro"

    ip_configuration {
      ipv4_enabled    = false
      private_network = google_compute_network.private_network.id
      ssl_mode        = "ENCRYPTED_ONLY"  # Only allows connections encrypted with SSL/TLS
    }
  }
}