Increase the default complexity of Cloud SQL DB passwords (#2886)
* Increase the default complexity of DB passwords in order to meet password_validation_policy.default_complexity * Use password_validation_policy.min_length if provided * Explicitly generate a root_password if not provided * Use object (password, random_password) for root_password config * Make root_password non-nullable, and add validation against specifying both a password and `random_password`. Fix test for stronger password generation. * Add example for root_password and password_validation_policy * Rerun tfdoc.py --------- Co-authored-by: Julio Castillo <jccb@google.com>
This commit is contained in:
Simon Roberts
@@ -17,6 +17,7 @@ Note that this module assumes that some options are the same for both the primar
|
||||
- [Query Insights](#query-insights)
|
||||
- [Maintenance Config](#maintenance-config)
|
||||
- [SSL Config](#ssl-config)
|
||||
- [Password Validation Policy and Root Password Config](#password-validation-policy-and-root-password-config)
|
||||
- [Variables](#variables)
|
||||
- [Outputs](#outputs)
|
||||
- [Fixtures](#fixtures)
|
||||
@@ -361,6 +362,46 @@ module "db" {
|
||||
}
|
||||
# tftest modules=1 resources=1 e2e
|
||||
```
|
||||
|
||||
### Password Validation Policy and Root Password Config
|
||||
|
||||
Provide parameters to configure `password_validation_policy` if required. The `root_password` can also be provided: either an explicit password OR a flag to enable a randomly-generated password.
|
||||
|
||||
```hcl
|
||||
module "db" {
|
||||
source = "./fabric/modules/cloudsql-instance"
|
||||
project_id = var.project_id
|
||||
network_config = {
|
||||
connectivity = {
|
||||
psa_config = {
|
||||
private_network = var.vpc.self_link
|
||||
}
|
||||
}
|
||||
}
|
||||
name = "db"
|
||||
region = var.region
|
||||
database_version = "MYSQL_8_0"
|
||||
tier = "db-g1-small"
|
||||
|
||||
gcp_deletion_protection = false
|
||||
terraform_deletion_protection = false
|
||||
|
||||
root_password = {
|
||||
# password = "ExplitPassword123!"
|
||||
random_password = true
|
||||
}
|
||||
|
||||
password_validation_policy = {
|
||||
enabled = true
|
||||
default_complexity = true
|
||||
disallow_username_substring = true
|
||||
min_length = 20
|
||||
reuse_interval = 5
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=2 e2e
|
||||
```
|
||||
|
||||
<!-- BEGIN TFDOC -->
|
||||
## Variables
|
||||
|
||||
@@ -371,7 +412,7 @@ module "db" {
|
||||
| [network_config](variables.tf#L184) | Network configuration for the instance. Only one between private_network and psc_config can be used. | <code title="object({ authorized_networks = optional(map(string)) connectivity = object({ public_ipv4 = optional(bool, false) psa_config = optional(object({ private_network = string allocated_ip_ranges = optional(object({ primary = optional(string) replica = optional(string) })) })) psc_allowed_consumer_projects = optional(list(string)) enable_private_path_for_services = optional(bool, false) }) })">object({…})</code> | ✓ | |
|
||||
| [project_id](variables.tf#L231) | The ID of the project where this instances will be created. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L236) | Region of the primary instance. | <code>string</code> | ✓ | |
|
||||
| [tier](variables.tf#L279) | The machine type to use for the instances. | <code>string</code> | ✓ | |
|
||||
| [tier](variables.tf#L287) | The machine type to use for the instances. | <code>string</code> | ✓ | |
|
||||
| [activation_policy](variables.tf#L16) | This variable specifies when the instance should be active. Can be either ALWAYS, NEVER or ON_DEMAND. Default is ALWAYS. | <code>string</code> | | <code>"ALWAYS"</code> |
|
||||
| [availability_type](variables.tf#L27) | Availability type for the primary replica. Either `ZONAL` or `REGIONAL`. | <code>string</code> | | <code>"ZONAL"</code> |
|
||||
| [backup_configuration](variables.tf#L33) | Backup settings for primary instance. Will be automatically enabled if using MySQL with one or more replicas. | <code title="object({ enabled = optional(bool, false) binary_log_enabled = optional(bool, false) start_time = optional(string, "23:00") location = optional(string) log_retention_days = optional(number, 7) point_in_time_recovery_enabled = optional(bool) retention_count = optional(number, 7) })">object({…})</code> | | <code title="{ enabled = false binary_log_enabled = false start_time = "23:00" location = null log_retention_days = 7 point_in_time_recovery_enabled = null retention_count = 7 }">{…}</code> |
|
||||
@@ -392,11 +433,11 @@ module "db" {
|
||||
| [password_validation_policy](variables.tf#L207) | Password validation policy configuration for instances. | <code title="object({ enabled = optional(bool, true) change_interval = optional(number) default_complexity = optional(bool) disallow_username_substring = optional(bool) min_length = optional(number) reuse_interval = optional(number) })">object({…})</code> | | <code>null</code> |
|
||||
| [prefix](variables.tf#L221) | Optional prefix used to generate instance names. | <code>string</code> | | <code>null</code> |
|
||||
| [replicas](variables.tf#L241) | Map of NAME=> {REGION, KMS_KEY} for additional read replicas. Set to null to disable replica creation. | <code title="map(object({ region = string encryption_key_name = optional(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [root_password](variables.tf#L251) | Root password of the Cloud SQL instance. Required for MS SQL Server. | <code>string</code> | | <code>null</code> |
|
||||
| [ssl](variables.tf#L257) | Setting to enable SSL, set config and certificates. | <code title="object({ client_certificates = optional(list(string)) ssl_mode = optional(string) })">object({…})</code> | | <code>{}</code> |
|
||||
| [terraform_deletion_protection](variables.tf#L272) | Prevent terraform from deleting instances. | <code>bool</code> | | <code>true</code> |
|
||||
| [time_zone](variables.tf#L284) | The time_zone to be used by the database engine (supported only for SQL Server), in SQL Server timezone format. | <code>string</code> | | <code>null</code> |
|
||||
| [users](variables.tf#L290) | Map of users to create in the primary instance (and replicated to other replicas). For MySQL, anything after the first `@` (if present) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. The user types available are: 'BUILT_IN', 'CLOUD_IAM_USER' or 'CLOUD_IAM_SERVICE_ACCOUNT'. | <code title="map(object({ password = optional(string) type = optional(string) }))">map(object({…}))</code> | | <code>null</code> |
|
||||
| [root_password](variables.tf#L251) | Root password of the Cloud SQL instance, or flag to create a random password. Required for MS SQL Server. | <code title="object({ password = optional(string) random_password = optional(bool, false) })">object({…})</code> | | <code>{}</code> |
|
||||
| [ssl](variables.tf#L265) | Setting to enable SSL, set config and certificates. | <code title="object({ client_certificates = optional(list(string)) ssl_mode = optional(string) })">object({…})</code> | | <code>{}</code> |
|
||||
| [terraform_deletion_protection](variables.tf#L280) | Prevent terraform from deleting instances. | <code>bool</code> | | <code>true</code> |
|
||||
| [time_zone](variables.tf#L292) | The time_zone to be used by the database engine (supported only for SQL Server), in SQL Server timezone format. | <code>string</code> | | <code>null</code> |
|
||||
| [users](variables.tf#L298) | Map of users to create in the primary instance (and replicated to other replicas). For MySQL, anything after the first `@` (if present) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. The user types available are: 'BUILT_IN', 'CLOUD_IAM_USER' or 'CLOUD_IAM_SERVICE_ACCOUNT'. | <code title="map(object({ password = optional(string) type = optional(string) }))">map(object({…}))</code> | | <code>null</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
||||
@@ -52,7 +52,7 @@ resource "google_sql_database_instance" "primary" {
|
||||
region = var.region
|
||||
database_version = var.database_version
|
||||
encryption_key_name = var.encryption_key_name
|
||||
root_password = var.root_password
|
||||
root_password = var.root_password.random_password ? random_password.root_password[0].result : var.root_password.password
|
||||
|
||||
settings {
|
||||
tier = var.tier
|
||||
@@ -289,8 +289,22 @@ resource "random_password" "passwords" {
|
||||
k
|
||||
if v.password == null
|
||||
])
|
||||
length = 16
|
||||
special = true
|
||||
length = try(var.password_validation_policy.min_length, 16)
|
||||
special = true
|
||||
min_lower = 1
|
||||
min_numeric = 1
|
||||
min_special = 1
|
||||
min_upper = 1
|
||||
}
|
||||
|
||||
resource "random_password" "root_password" {
|
||||
count = var.root_password.random_password ? 1 : 0
|
||||
length = try(var.password_validation_policy.min_length, 16)
|
||||
special = true
|
||||
min_lower = 1
|
||||
min_numeric = 1
|
||||
min_special = 1
|
||||
min_upper = 1
|
||||
}
|
||||
|
||||
resource "google_sql_user" "users" {
|
||||
|
||||
@@ -249,9 +249,17 @@ variable "replicas" {
|
||||
}
|
||||
|
||||
variable "root_password" {
|
||||
description = "Root password of the Cloud SQL instance. Required for MS SQL Server."
|
||||
type = string
|
||||
default = null
|
||||
description = "Root password of the Cloud SQL instance, or flag to create a random password. Required for MS SQL Server."
|
||||
type = object({
|
||||
password = optional(string)
|
||||
random_password = optional(bool, false)
|
||||
})
|
||||
default = {}
|
||||
nullable = false
|
||||
validation {
|
||||
condition = !(var.root_password.password != null && var.root_password.random_password)
|
||||
error_message = "Cannot provide root_password.password and root_password.random_password at the same time"
|
||||
}
|
||||
}
|
||||
|
||||
variable "ssl" {
|
||||
|
||||
Reference in New Issue
Block a user