gcloud-sql-auto-storage-limit-not-configured: Automatic Storage Increase Limit Not Configured for Cloud SQL

id: gcloud-sql-auto-storage-limit-not-configured

info:
  name: Automatic Storage Increase Limit Not Configured for Cloud SQL
  author: princechaddha
  severity: medium
  description: |
    Ensure that an optimal limit is configured for the Automatic Storage Increase feature within your Cloud SQL database instance settings to avoid unexpected charges on your Google Cloud bill. Having no limit or an excessively high limit for this feature can lead to unplanned costs.
  impact: |
    Without an appropriate storage increase limit, unexpected charges may occur due to unlimited or excessive storage usage.
  remediation: |
    Configure an appropriate limit for the Automatic Storage Increase feature in your Cloud SQL database instance settings to control costs and maintain predictability.
  reference:
    - https://cloud.google.com/sql/docs/configure-storage
  tags: cloud,devops,gcp,gcloud,google-cloud-sql,storage,gcp-cloud-config

flow: |
  code(1)
  for(let projectId of iterate(template.projectIds)){
    set("projectId", projectId)
    code(2)
    for(let sqlInstance of iterate(template.sqlInstances)){
      set("sqlInstance", sqlInstance)
      code(3)
    }
  }

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      gcloud projects list --format="json(projectId)"

    extractors:
      - type: json
        name: projectIds
        internal: true
        json:
          - '.[].projectId'

  - engine:
      - sh
      - bash
    source: |
      gcloud sql instances list --project $projectId --format="json(name)"

    extractors:
      - type: json
        name: sqlInstances
        internal: true
        json:
          - '.[].name'

  - engine:
      - sh
      - bash
    source: |
      gcloud sql instances describe $sqlInstance --project $projectId --format="value(settings.storageAutoResizeLimit)" | jq -r 'if . == null then "null" else . end'

    matchers:
      - type: word
        words:
          - '0'

    extractors:
      - type: dsl
        dsl:
          - '"The automatic storage increase limit is not configured or is set to unlimited for SQL instance " + sqlInstance + " in project " + projectId'
# digest: 4b0a00483046022100b26ac96f4aab4b4a81d0c3934e30687a7d49844f891baa52c42ddedba6f29cbf0221008d032141e08cfa8e40614987576b6ac27a59fdd3423c8d577d91f03f989e58c6:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.