説明
Memorystore for Redisのインベントリは、キャッシュの用途、接続ネットワーク、所有チームを管理する資料です。リソースの存在自体は脆弱性ではなく、Memorystoreは内部IPアドレスを使用します。
想定される影響
管理情報が不足すると、意図しないクライアントからのアクセスや復旧設定の漏れを見つけにくくなるおそれがあります。
対処方法
各インスタンスの用途と責任者を記録し、authorized_network、接続経路、認証、転送時の暗号化、復旧設定を確認してください。
例
以下は既存構成と、別のプライベートサービスアクセス構成の抜粋です。ネットワーク定義は省略しています。記載したVPCの上りルールを狭めるだけで、Memorystoreのアクセス制御が完了するわけではありません。
変更前
hcl
resource "google_redis_instance" "cache" {
name = "memory-cache"
memory_size_gb = 1
}
resource "google_compute_global_address" "service_range" {
name = "address"
purpose = "VPC_PEERING"
address_type = "INTERNAL"
prefix_length = 16
network = data.google_compute_network.redis-network.id
}
resource "google_service_networking_connection" "private_service_connection" {
network = data.google_compute_network.redis-network.id
service = "servicenetworking.googleapis.com"
reserved_peering_ranges = [google_compute_global_address.service_range.name]
}
resource "google_redis_instance" "cache2" {
name = "private-cache"
tier = "STANDARD_HA"
memory_size_gb = 1
location_id = "us-central1-a"
alternative_location_id = "us-central1-f"
authorized_network = data.google_compute_network.redis-network.id
connect_mode = "PRIVATE_SERVICE_ACCESS"
redis_version = "REDIS_4_0"
display_name = "Terraform Test Instance"
depends_on = [google_service_networking_connection.private_service_connection]
}
resource "google_compute_firewall" "redis_ingress_open" {
name = "test-firewall"
network = data.google_compute_network.redis-network.name
direction = "INGRESS"
source_ranges = ["0.0.0.0/0"]
allow {
protocol = "tcp"
ports = ["6379"]
}
}
変更後
hcl
resource "google_compute_global_address" "service_range" {
name = "redis-private-range"
purpose = "VPC_PEERING"
address_type = "INTERNAL"
prefix_length = 16
network = google_compute_network.redis_network.id
}
resource "google_service_networking_connection" "private_service_connection" {
network = google_compute_network.redis_network.id
service = "servicenetworking.googleapis.com"
reserved_peering_ranges = [google_compute_global_address.service_range.name]
}
resource "google_redis_instance" "cache" {
name = "team-cache-prod"
tier = "STANDARD_HA"
memory_size_gb = 1
authorized_network = google_compute_network.redis_network.id
connect_mode = "PRIVATE_SERVICE_ACCESS"
redis_version = "REDIS_7_0"
display_name = "prod-cache"
depends_on = [google_service_networking_connection.private_service_connection]
}
resource "google_compute_firewall" "redis_ingress_internal" {
name = "redis-ingress-internal"
network = google_compute_network.redis_network.name
direction = "INGRESS"
source_ranges = ["10.10.0.0/16"]
allow {
protocol = "tcp"
ports = ["6379"]
}
}