Best practices for GCP

Usage

This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.

mod run . --recipe org.openrewrite.terraform.gcp.GCPBestPractices

If the recipe isn’t available locally, install it with:

mod config recipes jar install org.openrewrite.recipe:rewrite-terraform:3.14.6

Definition

This recipe runs the following recipes in order.

• Ensure GCP Kubernetes cluster node auto-repair configuration is enabledorg.openrewrite.terraform.gcp.EnsureGCPKubernetesClusterNodeAutoRepairConfigurationIsEnabled
• Enable PodSecurityPolicy controller on Google Kubernetes Engine (GKE) clustersorg.openrewrite.terraform.gcp.EnablePodSecurityPolicyControllerOnGKEClusters
• Ensure private cluster is enabled when creating Kubernetes clustersorg.openrewrite.terraform.gcp.EnsurePrivateClusterIsEnabledWhenCreatingKubernetesClusters
• Enable VPC Flow Logs for subnetworksorg.openrewrite.terraform.gcp.EnableVPCFlowLogsForSubnetworks
• Ensure GCP cloud storage bucket with uniform bucket-level access are enabledorg.openrewrite.terraform.gcp.EnsureGCPCloudStorageBucketWithUniformBucketLevelAccessAreEnabled
• Ensure GCP VM instances have block project-wide SSH keys feature enabledorg.openrewrite.terraform.gcp.EnsureGCPVMInstancesHaveBlockProjectWideSSHKeysFeatureEnabled
• Ensure IP forwarding on instances is disabledorg.openrewrite.terraform.gcp.EnsureIPForwardingOnInstancesIsDisabled
• Ensure compute instances launch with shielded VM enabledorg.openrewrite.terraform.gcp.EnsureComputeInstancesLaunchWithShieldedVMEnabled
• Enable VPC flow logs and intranode visibilityorg.openrewrite.terraform.gcp.EnableVPCFlowLogsAndIntranodeVisibility
• Ensure binary authorization is usedorg.openrewrite.terraform.gcp.EnsureBinaryAuthorizationIsUsed
• Ensure GCP Kubernetes engine clusters have legacy compute engine metadata endpoints disabledorg.openrewrite.terraform.gcp.EnsureGCPKubernetesEngineClustersHaveLegacyComputeEngineMetadataEndpointsDisabled
• Ensure secure boot for shielded GKE nodes is enabledorg.openrewrite.terraform.gcp.EnsureSecureBootForShieldedGKENodesIsEnabled
• Ensure the GKE metadata server is enabledorg.openrewrite.terraform.gcp.EnsureTheGKEMetadataServerIsEnabled
• Ensure shielded GKE nodes are enabledorg.openrewrite.terraform.gcp.EnsureShieldedGKENodesAreEnabled

Data tables

Structured output this recipe can produce.

• Source files that had resultsSource files that were modified by the recipe run.org.openrewrite.table.SourcesFileResults
• Source files that had search resultsSearch results that were found during the recipe run.org.openrewrite.table.SearchResults
• Source files that errored on a recipeThe details of all errors produced by a recipe run.org.openrewrite.table.SourcesFileErrors
• Recipe performanceStatistics used in analyzing the performance of recipes.org.openrewrite.table.RecipeRunStats