fix(queries): better interpreter for gcp queries

[cx-andre-pereira]

Closes #

Reason for Proposed Changes

• The current query implementations use a regex to determine whether a filter is valid or not. This was not the best approach, as the filter could not appear defined exactly as defined in the CIS_Google_Cloud_Platform_Foundation_Benchmark_v4.0.0.

Proposed Changes

• All the three queries, does the same verifications:

  • There is at least one"google_logging_metric" resource in the project and none contain the correct filter.
  • There is at least one "google_monitoring_alert_policy" resource in the project and none contain the filter/reference a logging metric that contains the correct filter.
  • There is at least one "google_monitoring_alert_policy" resource that contains the filter but none of them declare "notification_channels".

• The only thing that changes is the way they analyse the filter:

• The query Beta - Logs And Alerts Missing Custom Role Changes checks if the resource.type includes the mandatory iam_role. Also checks through the contains_method helper function if all 4 target methods are included(protoPayload.methodName = ("google.iam.admin.v1.CreateRole", "google.iam.admin.v1.UndeleteRole", "google.iam.admin.v1.UpdateRole", "google.iam.admin.v1.DeleteRole")

• If the methods are not all defined, there are two valid alternatives:

  • There isn’t a single protoPayload.methodName restriction in place.
  • The only “restriction” in place is the wildcard (*) : protoPayload.methodName = *

• Also the filter will be considered improper if any contraditory condition is defined.

• The query Beta - Logs And Alerts Missing Project Ownership Assignment And Changes uses a similar approach as above, but checking if the serviceName is defined to protoPayload.serviceName="cloudresourcemanager.googleapis.com", if it has ProjectOwnership OR projectOwnerInvitee (or vice versa). Also verifies that for the role roles/owner it has the actions "REMOVE" and "ADD".

• The query Beta - Logs And Alerts Missing Audit Configuration Changes is simpler, it just checks if the methodName is defined to SetIamPolicy and if protoPayload.serviceData.policyDelta.auditConfigDeltas is defined to *.

I submit this contribution under the Apache-2.0 license.

[github-actions]

KICS version: v2.1.18

Category Results CRITICAL 0 HIGH 0 MEDIUM 0 LOW 0 INFO 0 TRACE 0 TOTAL 0	Metric Values Files scanned 1 Files parsed 1 Files failed to scan 0 Total executed queries 47 Queries failed to execute 0 Execution time 0