GCP SQL MySQL DB instance point-in-time recovery backup (Binary logs) is not enabled misconfiguratio

Rule Details

Cortex AppSec Rule ID	APPSEC2_GCP_20
Category - Subcategory	Storage - Backups
Provider	GCP
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	8bdd1d25-660d-4a3d-be5a-c9a96e4b2bb6

Impact

This rule is checking to ensure that a MySQL DB instance has a point-in-time recovery backup configured. Point-in-time recovery allows you to restore your database to any second during your retention period, up to the last five minutes. Not having this setup can be risky as it might result in data loss if there is an issue or outage. By not using point-in-time recovery backup, you are potentially putting your data at risk in the event of a disaster or data corruption issue. Therefore, it's crucial to have this backup configuration in place to safeguard your data.

How to Fix

Resource: google_sql_database_instance

• Arguments: database_version, settings.backup_configuration.binary_log_enabled

To fix this, you need to enable Point-In-Time Recovery (PITR) in your MySQL DB instance. Please ensure the backup_window and backup_retention_period attributes are configured optimally. Here's some example code:

In the above example, we've enabled backups by setting enabled to true under backup_configuration. binary_log_enabled is also set to true to ensure binary logging (necessary for point-in-time recovery) is enabled. The start_time attribute is set to schedule the backup at a specific time. Also, backup_retention_period has been set to 30 days to hold backups. [source,go]

resource "google_sql_database_instance" "default" { name = "mysql-instance" region = "us-central1" database_version = "MYSQL_5_6"

settings { tier = "db-f1-micro"

backup_configuration { enabled = true

• binary_log_enabled = true start_time = "05:00" // specify a convenient time } }

backup_window { start_time = "05:00" }

backup_retention_period = 30 }