Skip to content

Commit 08d60b3

Browse files
cx-ricardo-jesuscx-vasco-oliveira
cx-ricardo-jesus
and
cx-vasco-oliveira
authored
feat(query): implemented 'ensure critical contacts is configured for organization' query for terraform/gcp (#7841)
* feat(query): implemented 'ensure critical contacts is configured for organization' query for terraform/gcp * fixed issueType * added query to similiryID_transition yaml file for terraform/gcp * Added tests for complete QA Accuracy Validation for this query (#7891) * Fixed negative7 test (#7892) --------- Co-authored-by: Vasco Oliveira <200926503+cx-vasco-oliveira@users.noreply.github.com>
1 parent 8604bee commit 08d60b3

File tree

15 files changed

+221
-0
lines changed

15 files changed

+221
-0
lines changed

‎assets/queries/terraform/gcp/ensure_essential_contacts_is_configured_for_organization/metadata.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"id": "7bd9c6a8-3b1f-495c-9752-a4a9c4e1b29f",
3+
"queryName": "Beta - Ensure Essential Contacts Is Configured For Organization",
4+
"severity": "LOW",
5+
"category": "Access Control",
6+
"descriptionText": "It is advisable to set up Essential Contacts to specify email addresses that Google Cloud can use to send important technical or security notifications.",
7+
"descriptionUrl": "https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/essential_contacts_contact",
8+
"platform": "Terraform",
9+
"descriptionID": "7bd9c6a8",
10+
"cloudProvider": "gcp",
11+
"cwe": "862",
12+
"riskScore": "1.0",
13+
"experimental": "true"
14+
}

‎assets/queries/terraform/gcp/ensure_essential_contacts_is_configured_for_organization/query.rego‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
package Cx
2+
3+
import data.generic.common as common_lib
4+
import data.generic.terraform as tf_lib
5+
6+
CxPolicy[result] {
7+
doc := input.document[i]
8+
contact := doc.resource.google_essential_contacts_contact[name]
9+
10+
contacts_not_configured_for_org(contact, i, doc)
11+
12+
result := {
13+
"documentId": input.document[i].id,
14+
"resourceType": "google_essential_contacts_contact",
15+
"resourceName": tf_lib.get_resource_name(contact, name),
16+
"searchKey": sprintf("google_essential_contacts_contact[%s].notification_category_subscription_field", [name]),
17+
"issueType": "IncorrectValue",
18+
"keyExpectedValue": "'notification_category_subscription_field' should have 'ALL' value or all 'LEGAL', 'SUSPENSION', 'TECHNICAL' and 'SECURITY' values defined",
19+
"keyActualValue": "'notification_category_subscription_field' does not have 'ALL' value or all 'LEGAL', 'SUSPENSION', 'TECHNICAL' and 'SECURITY' values defined",
20+
"searchLine": common_lib.build_search_line(["resource", "google_essential_contacts_contact", name, "notification_category_subscriptions"], [])
21+
}
22+
}
23+
24+
contacts_not_configured_for_org(resource, document_index, document) {
25+
is_at_organization_level(resource, document_index, document)
26+
not all_in_list(resource.notification_category_subscriptions)
27+
}
28+
29+
all_in_list(list) {
30+
common_lib.inArray(list, "LEGAL")
31+
common_lib.inArray(list, "SECURITY")
32+
common_lib.inArray(list, "SUSPENSION")
33+
common_lib.inArray(list, "TECHNICAL")
34+
} else {
35+
common_lib.inArray(list, "ALL")
36+
}
37+
38+
# check if the contact is at organization level through the parent field
39+
is_at_organization_level(resource, document_index, document) {
40+
resource_type := split(resource.parent, "/")[0]
41+
resource_type == "organizations"
42+
} else { # case when the parent field references the cases when a data source of type google_organization
43+
resource_type := split(resource.parent, ".")[1]
44+
resource_type == "google_organization"
45+
data_source_name := split(resource.parent, ".")[2]
46+
data_source := document.data.google_organization[ds_name]
47+
data_source_name == ds_name
48+
}

‎assets/queries/terraform/gcp/ensure_essential_contacts_is_configured_for_organization/test/negative1.tf‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
data "google_organization" "org" {
2+
organization = "123456789012"
3+
}
4+
5+
resource "google_essential_contacts_contact" "negative1" {
6+
parent = data.google_organization.org.name
7+
email = "foo@bar.com"
8+
language_tag = "en-GB"
9+
10+
notification_category_subscriptions = [
11+
"LEGAL",
12+
"SECURITY",
13+
"SUSPENSION",
14+
"TECHNICAL"
15+
]
16+
}

‎assets/queries/terraform/gcp/ensure_essential_contacts_is_configured_for_organization/test/negative2.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
data "google_organization" "org" {
2+
organization = "123456789012"
3+
}
4+
5+
resource "google_essential_contacts_contact" "negative2" {
6+
parent = data.google_organization.org.name
7+
email = "foo@bar.com"
8+
language_tag = "en-GB"
9+
10+
notification_category_subscriptions = ["ALL"]
11+
}

‎assets/queries/terraform/gcp/ensure_essential_contacts_is_configured_for_organization/test/negative3.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
resource "google_essential_contacts_contact" "negative3" {
2+
parent = "organizations/123456789012"
3+
email = "foo@bar.com"
4+
language_tag = "en-GB"
5+
notification_category_subscriptions = [
6+
"LEGAL",
7+
"SECURITY",
8+
"SUSPENSION",
9+
"TECHNICAL"
10+
]
11+
}

‎assets/queries/terraform/gcp/ensure_essential_contacts_is_configured_for_organization/test/negative4.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
resource "google_essential_contacts_contact" "negative4" {
2+
parent = "organizations/123456789012"
3+
email = "foo@bar.com"
4+
language_tag = "en-GB"
5+
notification_category_subscriptions = ["ALL"]
6+
}

‎assets/queries/terraform/gcp/ensure_essential_contacts_is_configured_for_organization/test/negative5.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
resource "google_essential_contacts_contact" "negative5" {
2+
parent = "folders/987654321" # Not organization-level
3+
email = "foo@bar.com"
4+
language_tag = "en-GB"
5+
6+
notification_category_subscriptions = ["ALL"]
7+
}

‎assets/queries/terraform/gcp/ensure_essential_contacts_is_configured_for_organization/test/negative6.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
resource "google_essential_contacts_contact" "negative6" {
2+
parent = "organizations/123456789012"
3+
email = "foo@bar.com"
4+
language_tag = "en-GB"
5+
notification_category_subscriptions = [
6+
"LEGAL",
7+
"SECURITY",
8+
"SUSPENSION",
9+
"BILLING",
10+
"TECHNICAL"
11+
]
12+
}

‎assets/queries/terraform/gcp/ensure_essential_contacts_is_configured_for_organization/test/negative7.tf‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
data "google_organization" "org" {
2+
organization = "123456789012"
3+
}
4+
5+
resource "google_essential_contacts_contact" "negative7" {
6+
parent = data.google_organization.org.name
7+
email = "foo@bar.com"
8+
language_tag = "en-GB"
9+
10+
notification_category_subscriptions = [
11+
"LEGAL",
12+
"SECURITY",
13+
"SUSPENSION",
14+
"ALL"
15+
]
16+
}

‎assets/queries/terraform/gcp/ensure_essential_contacts_is_configured_for_organization/test/positive1.tf‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
data "google_organization" "org" {
2+
organization = "123456789012"
3+
}
4+
5+
resource "google_essential_contacts_contact" "positive1" {
6+
parent = data.google_organization.org.name
7+
email = "foo@bar.com"
8+
language_tag = "en-GB"
9+
10+
notification_category_subscriptions = [
11+
"LEGAL",
12+
"SECURITY",
13+
"SUSPENSION",
14+
]
15+
}

0 commit comments

Comments
 (0)