Skip vpc flow log checks for internal HTTPS LB subnets (#65)

controls/3.08-networking.rb

@@ -50,11 +50,17 @@
   google_compute_regions(project: gcp_project_id).region_names.each do |region|
     google_compute_subnetworks(project: gcp_project_id, region: region).subnetwork_names.each do |subnet|
       subnet_obj = google_compute_subnetwork(project: gcp_project_id, region: region, name: subnet)
-      describe "[#{gcp_project_id}] #{region}/#{subnet}" do
-        subject { subnet_obj }
-        if subnet_obj.methods.include?(:log_config) == true
-          it 'should have logging enabled' do
-            expect(subnet_obj.log_config.enable).to be true
+      if subnet_obj.purpose == 'INTERNAL_HTTPS_LOAD_BALANCER' # filter subnets for internal HTTPs Load Balancing
+        describe "[#{gcp_project_id} #{region}/#{subnet}] does not support VPC Flow Logs. This test is Not Applicable." do
+          skip "[#{gcp_project_id} #{region}/#{subnet}] does not support VPC Flow Logs."
+        end
+      else
+        describe "[#{gcp_project_id}] #{region}/#{subnet}" do
+          subject { subnet_obj }
+          if subnet_obj.methods.include?(:log_config) == true
+            it 'should have logging enabled' do
+              expect(subnet_obj.log_config.enable).to be true
+            end
           end
         end
       end

inspec.yml

@@ -19,7 +19,7 @@ copyright: Google
 copyright_email: [email protected]
 license: Apache-2.0
 summary: "Inspec Google Cloud Platform Center for Internet Security Benchmark v1.1 Profile"
-version: "1.1.0-18"
+version: "1.1.0-19"
 supports:
   - platform: gcp
 depends: