AC_GCP_0014 (dnsStateIsNotOn) false positive

[PurpleBooth]

• terrascan version: v1.10.0
• Operating System: macOS big sur

Description

AC_GCP_0014 (dnsStateIsNotOn) false positive

What I Did

terrascan init
terrascan scan

on

module "dns_zones" {
  source    = "./modules/dns_zones"
  dns_zones = var.dns_zones

  providers = {
    google-beta = google-beta
  }
}

where the module contains

resource "google_dns_managed_zone" "dns_zones" {
  provider   = google-beta
  count      = length(var.dns_zones)
  name       = replace(var.dns_zones[count.index], ".", "-")
  dns_name   = "${element(var.dns_zones, count.index)}."
  visibility = "public"

  dnssec_config {
    kind          = "dns#managedZoneDnsSecConfig"
    non_existence = "nsec3"
    state         = "on"

    default_key_specs {
      algorithm  = "rsasha256"
      key_length = 2048
      key_type   = "keySigning"
      kind       = "dns#dnsKeySpec"
    }

    default_key_specs {
      algorithm  = "rsasha256"
      key_length = 1024
      key_type   = "zoneSigning"
      kind       = "dns#dnsKeySpec"
    }
  }

  lifecycle {
    prevent_destroy = true

    ignore_changes = [
      visibility,
    ]
  }
}

output "zone_names" {
  value = zipmap(google_dns_managed_zone.dns_zones.*.dns_name, google_dns_managed_zone.dns_zones.*.name)
}

variable "dns_zones" {
  type = list(string)
}

terraform {
  required_providers {
    google-beta = {
      source = "hashicorp/google-beta"
    }
  }
  required_version = ">= 0.13"
}

outputs

Violation Details -
    
	Description    :	Ensure that DNSSEC is enabled for Cloud DNS.
	File           :	modules/dns_zones/main.tf
	Module Name    :	dns_zones
	Plan Root      :	./
	Line           :	1
	Severity       :	LOW
	Rule Name      :	dnsStateIsNotOn
	Rule ID        :	AC_GCP_0014
	Resource Name  :	dns_zones
	Resource Type  :	google_dns_managed_zone
	Category       :	Infrastructure Security
	
	-----------------------------------------------------------------------
	
	Description    :	Ensure that DNSSEC is enabled for Cloud DNS.
	File           :	modules/dns_zones/main.tf
	Module Name    :	root
	Plan Root      :	modules/dns_zones
	Line           :	1
	Severity       :	LOW
	Rule Name      :	dnsStateIsNotOn
	Rule ID        :	AC_GCP_0014
	Resource Name  :	dns_zones
	Resource Type  :	google_dns_managed_zone
	Category       :	Infrastructure Security
	
	-----------------------------------------------------------------------
	

Scan Summary -

	File/Folder         :	/Users/billie/Code/infrastructure-netlify
	IaC Type            :	all
	Scanned At          :	2021-09-23 20:05:51.659743 +0000 UTC
	Policies Validated  :	2
	Violated Policies   :	2
	Low                 :	2
	Medium              :	0
	High                :	0
	

[hoexter]

@cesar-rodriguez I did not close this issue correctly in #1107 but it's fixed and part of the last release (1.13.1). Maybe you can close this one by hand?