Automatic Storage Increase Limit Not Configured for Cloud SQL

ID: gcloud-sql-auto-storage-limit-not-configured

Severity: medium

Author: princechaddha

Tags: cloud,devops,gcp,gcloud,google-cloud-sql,storage,gcp-cloud-config

Description

Ensure that an optimal limit is configured for the Automatic Storage Increase feature within your Cloud SQL database instance settings to avoid unexpected charges on your Google Cloud bill. Having no limit or an excessively high limit for this feature can lead to unplanned costs.

YAML Source

id: gcloud-sql-auto-storage-limit-not-configured

info:
  name: Automatic Storage Increase Limit Not Configured for Cloud SQL
  author: princechaddha
  severity: medium
  description: |
    Ensure that an optimal limit is configured for the Automatic Storage Increase feature within your Cloud SQL database instance settings to avoid unexpected charges on your Google Cloud bill. Having no limit or an excessively high limit for this feature can lead to unplanned costs.
  impact: |
    Without an appropriate storage increase limit, unexpected charges may occur due to unlimited or excessive storage usage.
  remediation: |
    Configure an appropriate limit for the Automatic Storage Increase feature in your Cloud SQL database instance settings to control costs and maintain predictability.
  reference:
    - https://cloud.google.com/sql/docs/configure-storage
  tags: cloud,devops,gcp,gcloud,google-cloud-sql,storage,gcp-cloud-config

flow: |
  code(1)
  for(let projectId of iterate(template.projectIds)){
    set("projectId", projectId)
    code(2)
    for(let sqlInstance of iterate(template.sqlInstances)){
      set("sqlInstance", sqlInstance)
      code(3)
    }
  }

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      gcloud projects list --format="json(projectId)"

    extractors:
      - type: json
        name: projectIds
        internal: true
        json:
          - '.[].projectId'

  - engine:
      - sh
      - bash
    source: |
      gcloud sql instances list --project $projectId --format="json(name)"

    extractors:
      - type: json
        name: sqlInstances
        internal: true
        json:
          - '.[].name'

  - engine:
      - sh
      - bash
    source: |
      gcloud sql instances describe $sqlInstance --project $projectId --format="value(settings.storageAutoResizeLimit)" | jq -r 'if . == null then "null" else . end'

    matchers:
      - type: word
        words:
          - '0'

    extractors:
      - type: dsl
        dsl:
          - '"The automatic storage increase limit is not configured or is set to unlimited for SQL instance " + sqlInstance + " in project " + projectId'
# digest: 4b0a00483046022100b26ac96f4aab4b4a81d0c3934e30687a7d49844f891baa52c42ddedba6f29cbf0221008d032141e08cfa8e40614987576b6ac27a59fdd3423c8d577d91f03f989e58c6:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "cloud/gcp/sql/gcloud-sql-auto-storage-limit-not-configured.yaml"

View on Github