Repository: bridgecrewio/checkov

Issue:
CKV_GCP_13 - Modify certificate authentication method by OAuth method
Hello,

ID=CKV_GCP_13
Description=Ensure a client certificate is used by clients to authenticate to Kubernetes Engine Clusters.

This check should be modified to check if the authentication method used is the OAuth method and not the client certificate anymore.




Discussion:
Thanks for reporting @hg-orng !
We'd appreciate a contribution here!
The relevant check:
https://github.com/bridgecrewio/checkov/blob/b77412b5b1dfeb9adedb47e1062a281dc786f973/checkov/terraform/checks/resource/gcp/GKEClientCertificateEnabled.py

Resolving patch:
diff --git a/checkov/terraform/checks/resource/gcp/GKEClientCertificateEnabled.py b/checkov/terraform/checks/resource/gcp/GKEClientCertificateDisabled.py
similarity index 77%
rename from checkov/terraform/checks/resource/gcp/GKEClientCertificateEnabled.py
rename to checkov/terraform/checks/resource/gcp/GKEClientCertificateDisabled.py
--- a/checkov/terraform/checks/resource/gcp/GKEClientCertificateEnabled.py
+++ b/checkov/terraform/checks/resource/gcp/GKEClientCertificateDisabled.py
@@ -2,9 +2,9 @@
 from checkov.common.models.enums import CheckCategories
 
 
-class GKEClientCertificateEnabled(BaseResourceValueCheck):
+class GKEClientCertificateDisabled(BaseResourceValueCheck):
     def __init__(self):
-        name = "Ensure a client certificate is used by clients to authenticate to Kubernetes Engine Clusters"
+        name = "Ensure client certificate authentication to Kubernetes Engine Clusters is disabled"
         id = "CKV_GCP_13"
         supported_resources = ['google_container_cluster']
         categories = [CheckCategories.KUBERNETES]
@@ -19,5 +19,9 @@ def get_inspected_key(self):
         """
         return 'master_auth/[0]/client_certificate_config/[0]/issue_client_certificate/[0]'
 
+    def get_expected_value(self):
+        return False
+
+
+check = GKEClientCertificateDisabled()
 
-check = GKEClientCertificateEnabled()


Test patch:
diff --git a/tests/terraform/checks/resource/gcp/test_GKEClientCertificateEnabled.py b/tests/terraform/checks/resource/gcp/test_GKEClientCertificateDisabled.py
similarity index 83%
rename from tests/terraform/checks/resource/gcp/test_GKEClientCertificateEnabled.py
rename to tests/terraform/checks/resource/gcp/test_GKEClientCertificateDisabled.py
--- a/tests/terraform/checks/resource/gcp/test_GKEClientCertificateEnabled.py
+++ b/tests/terraform/checks/resource/gcp/test_GKEClientCertificateDisabled.py
@@ -1,21 +1,21 @@
 import unittest
 
-from checkov.terraform.checks.resource.gcp.GKEClientCertificateEnabled import check
+from checkov.terraform.checks.resource.gcp.GKEClientCertificateDisabled import check
 from checkov.common.models.enums import CheckResult
 
 
-class GKEClientCertificateEnabled(unittest.TestCase):
+class GKEClientCertificateDisabled(unittest.TestCase):
 
-    def test_failure(self):
+    def test_success(self):
         resource_conf = {'name': ['google_cluster'], 'master_auth': [{'client_certificate_config': [{'issue_client_certificate': [False]}]}]}
 
         scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.FAILED, scan_result)
+        self.assertEqual(CheckResult.PASSED, scan_result)
 
-    def test_success(self):
+    def test_failure(self):
         resource_conf = {'name': ['google_cluster'], 'master_auth': [{'client_certificate_config': [{'issue_client_certificate': [True]}]}]}
         scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.PASSED, scan_result)
+        self.assertEqual(CheckResult.FAILED, scan_result)
 
 
 if __name__ == '__main__':