Google Cloud Memorystore for Redis inventory

Description

A Memorystore for Redis inventory records cache purpose, connected networks, and owning teams. A resource’s presence is not itself a vulnerability, and Memorystore uses internal IP addresses.

Potential impact

Incomplete ownership and configuration records can make unwanted client access or missing recovery settings harder to identify.

Remediation

Record each instance’s purpose and owner, then review authorized_network, connection paths, authentication, in-transit encryption, and recovery settings.

Examples

These excerpts show an existing configuration and a separate private services access configuration; network definitions are omitted. Narrowing the included VPC ingress rule alone does not establish complete access control for Memorystore.

Before

hcl

resource "google_redis_instance" "cache" {
  name           = "memory-cache"
  memory_size_gb = 1
}

resource "google_compute_global_address" "service_range" {
  name          = "address"
  purpose       = "VPC_PEERING"
  address_type  = "INTERNAL"
  prefix_length = 16
  network       = data.google_compute_network.redis-network.id
}

resource "google_service_networking_connection" "private_service_connection" {
  network                 = data.google_compute_network.redis-network.id
  service                 = "servicenetworking.googleapis.com"
  reserved_peering_ranges = [google_compute_global_address.service_range.name]
}

resource "google_redis_instance" "cache2" {
  name           = "private-cache"
  tier           = "STANDARD_HA"
  memory_size_gb = 1

  location_id             = "us-central1-a"
  alternative_location_id = "us-central1-f"

  authorized_network = data.google_compute_network.redis-network.id
  connect_mode       = "PRIVATE_SERVICE_ACCESS"
  redis_version      = "REDIS_4_0"
  display_name       = "Terraform Test Instance"

  depends_on = [google_service_networking_connection.private_service_connection]
}

resource "google_compute_firewall" "redis_ingress_open" {
  name          = "test-firewall"
  network       = data.google_compute_network.redis-network.name
  direction     = "INGRESS"
  source_ranges = ["0.0.0.0/0"]

  allow {
    protocol = "tcp"
    ports    = ["6379"]
  }
}

After

hcl

resource "google_compute_global_address" "service_range" {
  name          = "redis-private-range"
  purpose       = "VPC_PEERING"
  address_type  = "INTERNAL"
  prefix_length = 16
  network       = google_compute_network.redis_network.id
}

resource "google_service_networking_connection" "private_service_connection" {
  network                 = google_compute_network.redis_network.id
  service                 = "servicenetworking.googleapis.com"
  reserved_peering_ranges = [google_compute_global_address.service_range.name]
}

resource "google_redis_instance" "cache" {
  name               = "team-cache-prod"
  tier               = "STANDARD_HA"
  memory_size_gb     = 1
  authorized_network = google_compute_network.redis_network.id
  connect_mode       = "PRIVATE_SERVICE_ACCESS"
  redis_version      = "REDIS_7_0"
  display_name       = "prod-cache"

  depends_on = [google_service_networking_connection.private_service_connection]
}

resource "google_compute_firewall" "redis_ingress_internal" {
  name          = "redis-ingress-internal"
  network       = google_compute_network.redis_network.name
  direction     = "INGRESS"
  source_ranges = ["10.10.0.0/16"]

  allow {
    protocol = "tcp"
    ports    = ["6379"]
  }
}