gcloud-check-legacy-networks: Check for Legacy Networks

id: gcloud-check-legacy-networks

info:
  name: Check for Legacy Networks
  author: princechaddha
  severity: medium
  description: |
    Ensure that your Google Cloud Platform (GCP) projects are not using legacy networks. Legacy networks are no longer recommended for production environments as they do not support advanced networking features. It is strongly advised to use Virtual Private Cloud (VPC) networks instead.
  impact: |
    Using legacy networks limits access to advanced networking features and can hinder scalability and security.
  remediation: |
    Migrate your GCP project from legacy networks to Virtual Private Cloud (VPC) networks to utilize the latest networking capabilities.
  reference:
    - https://cloud.google.com/vpc/docs/vpc
  tags: cloud,devops,gcp,gcloud,vpc,networking,security,gcp-cloud-config

flow: |
  code(1)
  for(let projectId of iterate(template.projectIds)){
    set("projectId", projectId)
    code(2)
  }

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      gcloud projects list --format="json(projectId)"

    extractors:
      - type: json
        name: projectIds
        internal: true
        json:
          - '.[].projectId'

  - engine:
      - sh
      - bash
    source: |
      gcloud compute networks list --project $projectId --format="json(name,subnetMode)"

    matchers:
      - type: word
        words:
          - LEGACY

    extractors:
      - type: dsl
        dsl:
          - '"Legacy network found in project " + projectId + ": " + name'
# digest: 4a0a0047304502205b37ed7fb934be0633b43d63aaf0e30ea40f72b80dbcb5a2a0399b673ed07bc7022100a8c6be38dfb9247f6bdb8b97999ece56031d6b72fee83866949bd9d020b58b86:922c64590222798bb761d5b6d8e72950