[TT-17611] IAM authentication for Google Cloud - #2766
Merged
probelabs / Visor: security
succeeded
Aug 21, 2026 in 52s
✅ Check Passed (Warnings Found)
security check passed. Found 2 warnings, but fail_if condition was not met.
Details
📊 Summary
- Total Issues: 2
- Warning Issues: 2
🔍 Failure Condition Results
Passed Conditions
- global_fail_if: Condition passed
Issues by Category
Security (2)
⚠️ tyk-configuration-reference/redis-cluster-sentinel.mdx:408 - The documentation indicates that IAM authentication can be enabled without enforcing TLS. This configuration is highly insecure as it transmits bearer tokens in cleartext, exposing them to interception and replay attacks. While a warning is logged by the application, allowing this configuration presents a significant security risk. The documentation should more strongly advise against this practice.⚠️ tyk-identity-broker/standalone-tib.mdx:205 - The documentation for TIB IAM authentication is overly broad, stating it works with 'a cloud-managed Redis or Valkey instance'. This is misleading as the feature is specific to certain Google Cloud services. This ambiguity could lead users to attempt unsupported configurations with other cloud providers, resulting in failed or insecure deployments.
Powered by Visor from Probelabs
💡 TIP: You can chat with Visor using /visor ask <your question>
Annotations
Check warning on line 410 in tyk-configuration-reference/redis-cluster-sentinel.mdx
probelabs / Visor: security
security Issue
The documentation indicates that IAM authentication can be enabled without enforcing TLS. This configuration is highly insecure as it transmits bearer tokens in cleartext, exposing them to interception and replay attacks. While a warning is logged by the application, allowing this configuration presents a significant security risk. The documentation should more strongly advise against this practice.
Raw output
Strengthen the warning to be more emphatic about the risks. Advise that enabling IAM authentication without TLS is a critical security vulnerability and must not be used in any environment. For example: 'CRITICAL: Enabling IAM authentication without also enabling TLS (`use_ssl`) creates a severe security vulnerability by sending authentication tokens in cleartext. This configuration MUST NOT be used. Always enable in-transit encryption on your cloud instance and set `use_ssl` to `true`.'
Check warning on line 205 in tyk-identity-broker/standalone-tib.mdx
probelabs / Visor: security
security Issue
The documentation for TIB IAM authentication is overly broad, stating it works with 'a cloud-managed Redis or Valkey instance'. This is misleading as the feature is specific to certain Google Cloud services. This ambiguity could lead users to attempt unsupported configurations with other cloud providers, resulting in failed or insecure deployments.
Raw output
Update the text to be specific about the supported services to prevent misconfiguration. For example: 'As an alternative to `Password`, TIB can authenticate to Google Cloud Memorystore for Valkey and Memorystore for Redis Cluster using short-lived IAM tokens. Note that legacy (non-cluster) Memorystore for Redis does not support IAM authentication.'
Loading