Documentation
¶
Overview ¶
Package sql implements the gcp.sql source plugin: lists Cloud SQL instances in a project and emits one managed_database_instance evidence record per instance so SOC 2 database-hardening policies can flag missing SSL enforcement, public IPv4, automated backups off, etc.
Per the KISS-no-DRY axiom (docs/architecture/04-source-plugins.md §The plugin contract), the plugin caches nothing across Collect calls. N policies bound to this plugin → N invocations of Collect.
Test injection: the API interface mirrors the pattern used by internal/sources/aws/iam — the real Cloud SQL adapter satisfies it, and unit tests inject an in-memory fake.
Index ¶
Constants ¶
const EvidenceTypeID = "managed_database_instance"
EvidenceTypeID is the cross-vendor evidence type this plugin emits.
const SourceID = "gcp.sql"
SourceID is the registered ID for the gcp.sql plugin instance.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type API ¶
type API interface {
ListInstances(ctx context.Context, project string) ([]*sqladmin.DatabaseInstance, error)
}
API is the subset of the Cloud SQL Admin client this plugin uses. Defining it as an interface lets tests inject a fake without hitting GCP; the real adapter wraps *sqladmin.Service.
type Options ¶
type Options struct {
API API
ProjectID string
// Now is injected so tests can produce deterministic CollectedAt
// values. Production callers leave it nil → time.Now().UTC().
Now func() time.Time
}
Options is the constructor input.
type Plugin ¶
type Plugin struct {
// contains filtered or unexported fields
}
Plugin is the in-process gcp.sql source.
func New ¶
New constructs a Plugin around an explicit API implementation. Callers using the real GCP SDK should use NewFromGCP.
func NewFromGCP ¶
NewFromGCP constructs a Plugin backed by the real Cloud SQL Admin API using Application Default Credentials. M6 does not exercise this path under integration tests.
func (*Plugin) Collect ¶
func (p *Plugin) Collect(ctx context.Context, req core.SlotRequest) ([]core.EvidenceRecord, error)
Collect lists Cloud SQL instances in the configured project and emits one managed_database_instance record per instance, sorted by ID (instance name) before return so envelope bytes are stable across runs against stable project state.
Source Files