Custom Check for GCP Cloud SQL Database Flags

Question

I have been working with tfsec for about a week so I am still figuring things out. So far the product is pretty awesome. That being said I'm having a bit of trouble getting this custom check for Google Cloud SQL to work as expected. The goal of the check is to ensure the database flag for remote access is set to "off." The TF code below should pass the custom check, but it does not. Instead I get an error (see below):

I figured maybe I am not using subMatch/Predicatedmatch correctly, but no matter what I do the check keeps failing. There is a similar check that is included as a standard check for GCP. I ran the custom check logic through a YAML checker and it came back okay so I can rule that out any YAML specific syntax errors.

TF Code (Pass example)

resource "random_id" "db_name_suffix" {
  byte_length = 4
}

resource "google_sql_database_instance" "instance" {
  provider = google-beta

  name             = "private-instance-${random_id.db_name_suffix.hex}"
  region           = "us-central1"
  database_version = "SQLSERVER_2019_STANDARD"
  root_password    = "#######"

  depends_on = [google_service_networking_connection.private_vpc_connection]

  settings {
    tier = "db-f1-micro"
    ip_configuration {
      ipv4_enabled    = false
      private_network = google_compute_network.private_network.id
      require_ssl = true
    }

    backup_configuration {
      enabled = true
    }
    password_validation_policy {
      min_length                  = 6
      reuse_interval              = 2
      complexity                  = "COMPLEXITY_DEFAULT"
      disallow_username_substring = true
      password_change_interval    = "30s"
      enable_password_policy      = true
    }
    
    database_flags {
      name  = "contained database authentication"
      value = "off"
    }
    database_flags {
      name  = "cross db ownership chaining"
      value = "off"
    }
    database_flags {
      name  = "remote access"
      value = "off"
    }
  } 
}

Tfsec Custom Check:

---
  checks:
    - code: SQL-01 Ensure Remote Access is disabled
      description: Ensure Remote Access is disabled
      impact: Prevents locally stored procedures form being run remotely
      resolution: configure remote access = off
      requiredTypes:
      - resource
      requiredLabels:
      - google_sql_database_instance
      severity: HIGH
      matchSpec:
        name: settings
        action: isPresent
        subMatchOne:
          - name: database_flags
            action: isPresent
            predicateMatchSpec:
              - name: name
                action: equals
                value: remote access
              - name: value
                action: equals
                value: off
        errorMessage: DB remote access has not been disabled
        relatedLinks:
        - http://testcontrols.com/gcp

Error Message

Error: invalid option: failed to load custom checks from ./custom_checks: Check did not pass the expected schema. yaml: unmarshal errors:
  line 15: cannot unmarshal !!map into []custom.MatchSpec

Answer 1

I was able to get this working last night finally. This worked for me:

---
  checks:
    - code: SQL-01 Ensure Remote Access is disabled
      description: Ensure Remote Access is disabled
      impact: Prevents locally stored procedures form being run remotely
      resolution: configure remote access = off
      requiredTypes:
      - resource
      requiredLabels:
      - google_sql_database_instance
      severity: HIGH
      matchSpec:
        name: settings
        action: isPresent
        predicateMatchSpec:
          - name: database_flags
            action: isPresent
            subMatch:
              name: name
              action: equals
              value: remote access
          - action: and
            subMatch:
              name: value
              action: equals
              value: off
        errorMessage: DB remote access has not been disabled
        relatedLinks:
        - http://testcontrols.com/gcp