[TT-17611] IAM authentication for Google Cloud - #2766
Merged
probelabs / Visor: security
succeeded
Aug 27, 2026 in 23s
✅ Check Passed (Warnings Found)
security check passed. Found 1 warning, but fail_if condition was not met.
Details
📊 Summary
- Total Issues: 1
- Warning Issues: 1
🔍 Failure Condition Results
Passed Conditions
- global_fail_if: Condition passed
Issues by Category
Security (1)
⚠️ tyk-configuration-reference/redis-cluster-sentinel.mdx:398 - The documentation states that enabling IAM authentication without TLS is permitted and only generates a warning. This configuration is insecure as it transmits authentication tokens in cleartext. While the documentation correctly flags this, the warning's language could be more forceful to prevent users from deploying an insecure configuration.
Powered by Visor from Probelabs
💡 TIP: You can chat with Visor using /visor ask <your question>
Annotations
Check warning on line 400 in tyk-configuration-reference/redis-cluster-sentinel.mdx
probelabs / Visor: security
security Issue
The documentation states that enabling IAM authentication without TLS is permitted and only generates a warning. This configuration is insecure as it transmits authentication tokens in cleartext. While the documentation correctly flags this, the warning's language could be more forceful to prevent users from deploying an insecure configuration.
Raw output
Revise the warning to be more direct about the security risks. Instead of "Google strongly recommends", Tyk should explicitly state that this configuration is insecure and must be avoided, especially in production, because it exposes credentials on the network. For example: "Security Warning: Enabling IAM authentication without TLS is a major security risk as it sends authentication tokens in cleartext. This configuration must not be used in production. Always ensure `use_ssl` is `true` when IAM authentication is enabled."
Loading