feat(terraform/gcp): Add GKE Shielded Nodes is Disabled query for Terraform.

[bbergstrom]

Add Terraform query for "GKE Shielded Nodes is Disabled".

Closes #6243

I submit this contribution under the Apache-2.0 license.

[cxMiguelSilva]

Hi @bbergstrom,
Thank you for this amazing contribution!
Regarding the proposed changes. The query logic LGTM.
I will just ask our Application Security to validate the metadata and should be good to go!

[github-advanced-security]

You have successfully added a new gosec configuration .github/workflows/go-ci.yml:security-scan. As part of the setup process, we have scanned this repository and found 19 existing alerts. Please check the repository Security tab to see all alerts.

[cxMiguelSilva]

Upon further inspection, I noticed that the terraform docs suggest that by default the value is set to true. I believe the first policy that detects the default value should be removed.

Let me know what you think.

[bbergstrom]

@cxMiguelSilva The first query detects for the implicit default, which should be a positive because the value could drift if it is changed outside of Terraform. The best practice for these is to explicitly set the default value in Terraform to ensure it catches and corrects drift to the secure value.

[cxMiguelSilva]

Hi @bbergstrom,
In KICS we do not create policies to cover default values that are not deemed as vulnerable or misconfiguration. We have come across bug reports and issues handling from the community to improve our Security Queries in order to remove those False Positive results from incorrect checks on default values.
I kindly ask you to remove the policy that checks the default value since the Terraform documentation is indicative that it is set to the correct value. If at any time the guidelines change feel free to update the Security Query and add that policy.

[kaplanlior]

Hi @bbergstrom ,

Would you have time in the near future to do the changes Miguel asked for?

[bbergstrom]

@kaplanlior Pushed suggested changes. Awaiting approval for test suite.

[bbergstrom]

@kaplanlior @cxMiguelSilva Could I please get approval on the latest commit to run the test suite?

[bbergstrom]

@gabriel-cx Tests all passed. 🎉 Would you finish the review or should I wait for @cxMiguelSilva ?