Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

accurics.gcp.IAM.104 Fire rule when client certificate is enabled #402

Merged
merged 5 commits into from
Nov 24, 2020
Merged

accurics.gcp.IAM.104 Fire rule when client certificate is enabled #402

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
a4dc4ef
Fire clientCertificateEnabled rule when client certificate is enabled
lucas-giaco Nov 22, 2020
66c14cd
Fixing policy description
lucas-giaco Nov 22, 2020
f87e2b7
fixes docs
Nov 24, 2020
766bae8
Update mkdocs-material from 6.1.5 to 6.1.6
pyup-bot Nov 22, 2020
f4c70ae
Merge remote-tracking branch 'origin/master' into lucas-giaco/master
Nov 24, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/policies/gcp.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@
| Network Security | gcp | HIGH | Ensure Master Authentication is set to enabled on Kubernetes Engine Clusters. | accurics.gcp.NS.112 |
| Operational Efficiency | gcp | HIGH | Ensure Kubernetes Cluster is created with Alias IP ranges enabled | accurics.gcp.OPS.115 |
| Network Security | gcp | HIGH | Ensure GKE Control Plane is not public. | accurics.gcp.NS.109 |
| Identity & Access Management | gcp | HIGH | Ensure Kubernetes Cluster is created with Client Certificate enabled. | accurics.gcp.IAM.104 |
| Identity & Access Management | gcp | HIGH | Ensure Kubernetes Cluster is created with Client Certificate disabled. | accurics.gcp.IAM.104 |
| Operational Efficiency | gcp | HIGH | Ensure Kubernetes Clusters are configured with Labels. | accurics.gcp.OPS.113 |
| Identity & Access Management | gcp | HIGH | Ensure Legacy Authorization is set to disabled on Kubernetes Engine Clusters. | accurics.gcp.IAM.142 |
| Logging | gcp | HIGH | Ensure Stackdriver Logging is enabled on Kubernetes Engine Clusters. | accurics.gcp.LOG.100 |
Expand Down
4 changes: 2 additions & 2 deletions pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.IAM.104.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@
"file": "clientCertificateEnabled.rego",
"template_args": null,
"severity": "HIGH",
"description": "Ensure Kubernetes Cluster is created with Client Certificate enabled.",
"description": "Ensure Kubernetes Cluster is created with Client Certificate disabled.",
"reference_id": "accurics.gcp.IAM.104",
"category": "Identity \u0026 Access Management",
"version": 1
}
}
2 changes: 1 addition & 1 deletion pkg/policies/opa/rego/gcp/google_container_cluster/clientCertificateEnabled.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,5 +3,5 @@ package accurics
clientCertificateEnabled[container_cluster.id] {
container_cluster := input.google_container_cluster[_]
master := container_cluster.config.master_auth[_]
master.client_certificate_config[_].issue_client_certificate == false
master.client_certificate_config[_].issue_client_certificate == true
}