accurics.gcp.NS.112 suggest basic auth is enabled when is not

[lucas-giaco]

• terrascan version: v0.1.10
• Operating System: MacOS 10.15.7

Description

As per Hardening your cluster doc, we should disable basic-auth.
As per Terraform docs the way to accomplish so is by providing an empty username and password.
However, terrascan is suggesting that I have basic-auth enabled which I'm not.
Please note that not specifying these fields at all won't enable basic-auth and doesn't fire the rule.

What I Did

cat <<EOF > cluster.tf
resource "google_container_cluster" "cluster" {
  master_auth {
    username = ""
    password = ""
  }
}
EOF
terrascan scan -t gcp -f cluster.tf
results:
  violations:
  - rule_name: gkeBasicAuthDisabled
    description: Ensure GKE basic auth is disabled.
    rule_id: accurics.gcp.IAM.110
    severity: HIGH
    category: Identity & Access Management
    resource_name: cluster
    resource_type: google_container_cluster
    file: cluster.tf
    line: 1
  count:
    low: 0
    medium: 0
    high: 1
    total: 1

What I Expect

cat <<EOF > cluster.tf
resource "google_container_cluster" "cluster" {
  master_auth {
    username = ""
    password = ""
  }
}
EOF
terrascan scan -t gcp -f cluster.tf
results:
  violations: []
  count:
    low: 0
    medium: 0
    high: 0
    total: 0

[acc-jon]

Thanks for catching this and providing a reproducer, @lucas-giaco!

[lucas-giaco]

Thanks to you for the quick fix :)