diff --git a/checkov/terraform/checks/resource/gcp/BigQueryTableDeletionProtection.py b/checkov/terraform/checks/resource/gcp/BigQueryTableDeletionProtection.py new file mode 100644 index 00000000000..2d87c89bb36 --- /dev/null +++ b/checkov/terraform/checks/resource/gcp/BigQueryTableDeletionProtection.py @@ -0,0 +1,21 @@ +from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck +from checkov.common.models.enums import CheckCategories, CheckResult + + +class BigQueryTableDeletionProtection(BaseResourceValueCheck): + def __init__(self) -> None: + name = "Ensure BigQuery tables have deletion protection enabled" + id = "CKV_GCP_121" + supported_resources = ['google_bigquery_table'] + categories = [CheckCategories.GENERAL_SECURITY] + super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, + missing_block_result=CheckResult.FAILED) + + def get_inspected_key(self) -> str: + return 'deletion_protection' + + def get_expected_value(self) -> bool: + return True + + +check = BigQueryTableDeletionProtection() diff --git a/checkov/terraform/checks/resource/gcp/BigTableInstanceDeletionProtection.py b/checkov/terraform/checks/resource/gcp/BigTableInstanceDeletionProtection.py new file mode 100644 index 00000000000..37545c10152 --- /dev/null +++ b/checkov/terraform/checks/resource/gcp/BigTableInstanceDeletionProtection.py @@ -0,0 +1,21 @@ +from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck +from checkov.common.models.enums import CheckCategories, CheckResult + + +class BigTableInstanceDeletionProtection(BaseResourceValueCheck): + def __init__(self): + name = "Ensure Big Table Instances have deletion protection enabled" + id = "CKV_GCP_122" + supported_resources = ['google_bigtable_instance'] + categories = [CheckCategories.ENCRYPTION] + super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, + missing_block_result=CheckResult.FAILED) + + def get_inspected_key(self): + return 'deletion_protection' + + def get_expected_value(self): + return True + + +check = BigTableInstanceDeletionProtection() diff --git a/tests/terraform/checks/resource/gcp/example_BigQueryTableDeletionProtection/main.tf b/tests/terraform/checks/resource/gcp/example_BigQueryTableDeletionProtection/main.tf new file mode 100644 index 00000000000..f17cade3f8d --- /dev/null +++ b/tests/terraform/checks/resource/gcp/example_BigQueryTableDeletionProtection/main.tf @@ -0,0 +1,93 @@ +resource "google_bigquery_table" "fail" { + dataset_id = google_bigquery_dataset.default.dataset_id + table_id = "bar" + + time_partitioning { + type = "DAY" + } + + labels = { + env = "default" + } + + schema = <