rage.fail

gcp-memorystore-explicit-auth-enabled

explicit gcp emits HasPolicy

match (record)

{ "field": "authEnabled", "resource_type": "google.redis.Instance" }

emit

source type	`Cache`
target type	`Policy`
source	`<Memorystore Cache instance node>`
target	`<ResourcePolicy recording authEnabled state>`

Narrative

{instance.name} has AUTH {enabled/disabled} (authEnabled={value}). When enabled, clients must supply the AUTH string to connect. When disabled, any in-VPC client with network reach has full Redis access without credentials.

Raw rule rules/explicit/gcp-memorystore.yaml

id: gcp-memorystore-explicit-auth-enabled
emits: HasPolicy
applies_to:
- gcp
match_record:
  resource_type: google.redis.Instance
  field: authEnabled
emit:
  source_type: Cache
  target_type: Policy
  source: <Memorystore Cache instance node>
  target: <ResourcePolicy recording authEnabled state>
  api_source: redis.instances.get
  evidence_field: authEnabled
  narrative: '{instance.name} has AUTH {enabled/disabled} (authEnabled={value}). When enabled, clients
    must supply the AUTH string to connect. When disabled, any in-VPC client with network reach has full
    Redis access without credentials.'