CIS 6.2.1 Ensure that the 'log_checkpoints' database flag for Cloud SQL PostgreSQL instance is set to 'on' #410
Conversation
|
@morgante Please review this PR. |
|
@morgante Checked the CFT scorecard too for this policy. All works fine. Please review this PR. |
|
@palani-ram-google-partner Before we merge this, can you fix your previous two PRs to make sure they work in CFT scorecard? |
| template_name := "GCPPostgreSQLCheckpointsConstraintV1" | ||
|
|
||
| #1. postgresql with correct key | ||
| test_postgresql_log_checkpoints_no_violations { |
There was a problem hiding this comment.
This test / fixture is confusingly named and I'm not sure if the logic is right. If it's meant to have no violations, you should not be expecting a violation. Please update.
There was a problem hiding this comment.
@morgante I have fixed the naming for the correct key we are checking.
| settings_databaseflags(settings) { | ||
| setdata := settings.databaseFlags[_] | ||
| setdata.name == "log_checkpoints" | ||
| setdata.value != "on" |
There was a problem hiding this comment.
Aren't you looking for cases where it is on?
There was a problem hiding this comment.
@morgante I am looking for the case where it is ON condition. Fixed it for the corresponding key value.
|
@morgante Changed the required files and CFT scorecard is working fine too.Please review this PR. |
|
|
||
| #1. postgresql with correct key | ||
| test_postgresql_log_checkpoints_with_correctkey { | ||
| expected_resource_names := {"//cloudsql.googleapis.com/projects/my-test-project/instances/tf-pg-ha-62380f9c-no-violation"} |
There was a problem hiding this comment.
Are you expecting this fixture to raise a violation? If so, it should not be called "with_correctkey" and you definitely should not expect a resource called "no-violation" to raise a violation. Either your naming or logic is wrong.
There was a problem hiding this comment.
@morgante This case(postgresql with correct key) don't raise a violation in our case. So I have removed the test case since it's not needed. Violated test cases alone is attached. Hope this is Ok. Please review it.
|
@morgante Added the test case with correct naming. |
|
|
||
| #1. postgresql with correct key | ||
| test_postgresql_log_checkpoints_required_databaseflag { | ||
| expected_resource_names := {"//cloudsql.googleapis.com/projects/my-test-project/instances/tf-pg-ha-62380f9c-required"} |
There was a problem hiding this comment.
Unfortunately, this is still wrong.
check_test_violations_count is asserting how many violations a particular fixture (data set) should raise. According to the naming of your fixture, it should NOT be violating.
Yet it is violating, since you:
(a) Are expecting a violation (count = 1).
(b) Have the name of the supposedly correct resource in the expected_resource_names. expected_resource_names is the list of resources you expect to raise a violation. A correct resource should never be found here.
It seems like your logic and tests are likely both broken.
Please read through the full test utils and look through other tests. It's important that you get this right.
CIS 6.2.1 Ensure that the 'log_checkpoints' database flag for Cloud SQL PostgreSQL instance is set to 'on'