CKV2_GCP_10 - false positive

[pfilourenco]

Description

CKV2_GCP_10 - Ensure GCP Cloud Function HTTP trigger is secured

This should only alert if the cloud function is HTTP triggered. You should check the trigger type to see if is HTTP or not(trigger_http = true), example bellow of a not HTTP triggered function.

Examples

resource "google_cloudfunctions_function" "this" {
  name        = var.function_name
  description = "Function"
  runtime     = "python310"
  region      = var.location

  available_memory_mb   = 256
  source_archive_bucket = var.bucket_name
  source_archive_object = google_storage_bucket_object.this.name
  entry_point           = "main"
  service_account_email = google_service_account.this.email
  timeout               = 500

  event_trigger {
    event_type = "google.pubsub.topic.publish"
    resource   = var.pubsub_topic
    failure_policy {
      retry = false
    }
  }
}

Version :

• Checkov Version v2.3.120

[JamesWoolfenden]

In your case you can't specify trigger_http as the attributes are not compatible with an event trigger block, and so you should be specifying https_trigger_security_level on which the check is based.

[pfilourenco]

In your case you can't specify trigger_http as the attributes are not compatible with an event trigger block, and so you should be specifying https_trigger_security_level on which the check is based.

If the Cloud Function is not HTTP trigger we should use https_trigger_security_level anyway ? is that you are saying?

[stale[bot]]

Thanks for contributing to Checkov! We've automatically marked this issue as stale to keep our issues list tidy, because it has not had any activity for 6 months. It will be closed in 14 days if no further activity occurs. Commenting on this issue will remove the stale tag. If you want to talk through the issue or help us understand the priority and context, feel free to add a comment or join us in the Checkov slack channel at https://slack.bridgecrew.io Thanks!

[stale[bot]]

Closing issue due to inactivity. If you feel this is in error, please re-open, or reach out to the community via slack: https://slack.bridgecrew.io Thanks!