Some problems with rule AVD-GCP-0012

[nikpivkin]

1. Incorrect good and bad examples.

The examples set the zone_signing_keys attribute for google_dns_keys of the data source, but this is a read-only attribute.

Code:

 resource "google_dns_managed_zone" "this" {
 	name     = "foobar"
 	dns_name = "foo.bar."
 	
 	dnssec_config {
 		state         = "on"
 		non_existence = "nsec3"
 	}
 }
 	
 data "google_dns_keys" "this" {
 	managed_zone = google_dns_managed_zone.this.id
 	zone_signing_keys {
 		algorithm = "rsasha1"
 	}
 }

I get the following error during validation:

terraform validate
╷
│ Error: Invalid Configuration for Read-Only Attribute
│ 
│   with data.google_dns_keys.keys,
│   on main.tf line 16, in data "google_dns_keys" "this":
│   16: data "google_dns_keys" "this" {
│ 
│ Cannot set value for this attribute as the provider has marked it as read-only. Remove the configuration line setting the value.
│ 
│ Refer to the provider documentation or contact the provider developers for additional information about configurable and read-only attributes that are
│ supported.

Ref:

• https://avd.aquasec.com/misconfig/google/dns/avd-gcp-0012/
• https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/dns_keys#attributes-reference

---

2. Trivy does not detect the key algorithm set in the google_dns_managed_zone resource when the google_dns_keys data source is used.

Code:

resource "google_dns_managed_zone" "this" {

  name     = "foobar"
  dns_name = "foo.bar."

  dnssec_config {
    state         = "on"
    non_existence = "nsec3"

    default_key_specs {
      algorithm = "rsasha1"
      key_type = "keySigning"
    }
  }
}

data "google_dns_keys" "this" {
  managed_zone = google_dns_managed_zone.this.id
}

Output:

trivy conf .
2023-10-26T17:34:22.546+0700    INFO    Misconfiguration scanning is enabled
2023-10-26T17:34:22.945+0700    INFO    Detected config files: 2

But if I delete the data source, I will get a warning:

trivy conf .
2023-10-26T17:35:24.779+0700    INFO    Misconfiguration scanning is enabled
2023-10-26T17:35:25.170+0700    INFO    Detected config files: 2

main.tf (terraform)

Tests: 2 (SUCCESSES: 1, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

MEDIUM: Zone KSK uses RSA SHA1 for signing.
═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
RSA SHA1 is a weaker algorithm than SHA2-based algorithms such as RSA SHA256/512

See https://avd.aquasec.com/misconfig/avd-gcp-0012
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 main.tf:11
   via main.tf:10-13 (default_key_specs)
    via main.tf:6-14 (dnssec_config)
     via main.tf:1-15 (google_dns_managed_zone.this)
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   1   resource "google_dns_managed_zone" "this" {
   .   
  11 [       algorithm = "rsasha1"
  ..   
  15   }
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────