mcp-server-semgrep/semgrep-rules/terraform/gcp/best-practice/gcp-gke-metadata-server-enabled.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: gcp-gke-metadata-server-enabled
  patterns:
    - pattern: resource
    - pattern-inside: |
          resource "google_container_cluster" "..." {
          ...
          }
    - pattern-not-inside: |
          resource "google_container_cluster" "..." {
          ...
          node_config {
            ...
            workload_metadata_config {
              ...
              node_metadata = "GKE_METADATA_SERVER"
              ...
            }
            ...
          }
          ...
          }
    - pattern-not-inside: |
          resource "google_container_cluster" "..." {
          ...
          node_config {
            ...
            workload_metadata_config {
              ...
              mode = "GKE_METADATA"
              ...
            }
            ...
          }
          ...
          }
    - pattern-not-inside: |
          resource "google_container_cluster" "..." {
          ...
          node_config {
            ...
            workload_metadata_config = ...
            ...
          }
          ...
          }
  message: >-
    Ensure the GKE Metadata Server is Enabled	
  metadata:
    category: best-practice
    technology:
      - terraform
      - gcp
  languages: [hcl]
  severity: WARNING