Skip to content

Commit 84880b7

Browse files
cx-andre-pereiracx-andre-pereira
authored
Merge branch 'master' into AST-120855_Fixes_for_azure_instance_using_basic_authentication-terraform/azure
2 parents 914a438 + e8860ac commit 84880b7

File tree

65 files changed

+2091
-39
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

65 files changed

+2091
-39
lines changed

‎.github/workflows/kics-gh-action.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
steps:
1212
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1313
- name: Run KICS Scan
14-
uses: checkmarx/kics-github-action@71454548efb714daa457caae25c01d64cc0be9d2 # v2.1.13
14+
uses: checkmarx/kics-github-action@e01759d524f8abd5bd650d3d5bd4b96d46ebbc1d # v2.1.17
1515
with:
1616
token: ${{ secrets.GITHUB_TOKEN }}
1717
path: "./Dockerfile"

‎Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM checkmarx/go:1.25.4-r0-0f666a5fd03ad6@sha256:0f666a5fd03ad60c4cb5309df02ff11e4aa8f42908a876fde287a4f97abb2c8f AS build_env
1+
FROM checkmarx/go:1.25.4-r0-fbc7b9b7b7ba53@sha256:fbc7b9b7b7ba53794faa91d4dcaacb4d584209b8c08e74513d5cc14042b77e5b AS build_env
22

33
# Copy the source from the current directory to the Working Directory inside the container
44
WORKDIR /app
@@ -29,7 +29,7 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build \
2929
# Runtime image
3030
# Ignore no User Cmd since KICS container is stopped afer scan
3131
# kics-scan ignore-line
32-
FROM checkmarx/git:2.52.0-r0-8ea14bbb4ce02c@sha256:8ea14bbb4ce02c67ba4a3d941c88f592301e3f6e70a5dd3ae0d690d58dddd820
32+
FROM checkmarx/git:2.52.0-r0-4740f99b4432a5@sha256:4740f99b4432a55073272b69d3a4fdc9cee2085e9be58089effbb8354bce923d
3333

3434
ENV TERM xterm-256color
3535

‎assets/queries/terraform/azure/activity_log_alert_for_create_policy_assignment_not_configured/metadata.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"id": "d0514e4b-9e95-4a7a-9bc5-0adb32514122",
3+
"queryName": "Beta - Activity Log Alert For Create Policy Assignment Not Configured",
4+
"severity": "MEDIUM",
5+
"category": "Observability",
6+
"descriptionText": "There should be a 'azurerm_monitor_activity_log_alert' resource configured to capture create policy assignment events",
7+
"descriptionUrl": "https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_activity_log_alert",
8+
"platform": "Terraform",
9+
"descriptionID": "d0514e4b",
10+
"cloudProvider": "azure",
11+
"cwe": "778",
12+
"riskScore": "3.0",
13+
"experimental": "true"
14+
}

‎assets/queries/terraform/azure/activity_log_alert_for_create_policy_assignment_not_configured/query.rego‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
package Cx
2+
3+
import data.generic.common as common_lib
4+
import data.generic.terraform as tf_lib
5+
6+
filter_fields := ["caller", "level", "levels", "status", "statuses", "sub_status", "sub_statuses"]
7+
8+
CxPolicy[result] {
9+
resources := {input.document[index].id : log_alerts |
10+
log_alerts := input.document[index].resource.azurerm_monitor_activity_log_alert
11+
}
12+
13+
value := at_least_one_valid_log_alert(resources)
14+
value.result != "has_valid_log"
15+
16+
results := get_results(value)[_]
17+
18+
result := {
19+
"documentId": results.doc_id,
20+
"resourceType": "azurerm_monitor_activity_log_alert",
21+
"resourceName": tf_lib.get_resource_name(results.resource, results.name),
22+
"searchKey": sprintf("azurerm_monitor_activity_log_alert[%s].criteria", [results.name]),
23+
"issueType": results.issueType,
24+
"keyExpectedValue": "A 'azurerm_monitor_activity_log_alert' resource that monitors 'create policy assignment' events should be defined",
25+
"keyActualValue": results.keyActualValue,
26+
"searchLine": common_lib.build_search_line(["resource", "azurerm_monitor_activity_log_alert", results.name, "criteria"], [])
27+
}
28+
}
29+
30+
at_least_one_valid_log_alert(resources) = {"result" : "has_valid_log"} {
31+
resources[doc_index][x].criteria.category == "Administrative"
32+
resources[doc_index][x].criteria.operation_name == "Microsoft.Authorization/policyAssignments/write"
33+
not has_filter(resources[doc_index][x].criteria)
34+
common_lib.valid_key(resources[doc_index][x].action, "action_group_id")
35+
36+
} else = {"result" : "has_log_without_action", "logs": logs} {
37+
logs := {doc_index: filtered |
38+
resources[doc_index]
39+
filtered := {key: resource |
40+
resource := resources[doc_index][key]
41+
resource.criteria.category == "Administrative"
42+
resource.criteria.operation_name == "Microsoft.Authorization/policyAssignments/write"
43+
not has_filter(resource.criteria)}
44+
}
45+
logs[_] != {}
46+
47+
} else = {"result" : "has_log_with_filter", "logs": logs} {
48+
logs := {doc_index: filtered |
49+
resources[doc_index]
50+
filtered := {key: resource |
51+
resource := resources[doc_index][key]
52+
resource.criteria.category == "Administrative"
53+
resource.criteria.operation_name == "Microsoft.Authorization/policyAssignments/write"}
54+
}
55+
logs[_] != {}
56+
57+
}
58+
59+
get_results(value) = results { # Case of one or more resources failing due to not setting an "action.action_group_id" field
60+
value.result == "has_log_without_action"
61+
62+
results := [z |
63+
log := value.logs[doc_id][name]
64+
z := {
65+
"doc_id" : doc_id,
66+
"resource" : log,
67+
"issueType": "MissingAttribute",
68+
"name" : name,
69+
"keyActualValue" : sprintf("The 'azurerm_monitor_activity_log_alert[%s]' resource monitors 'create policy assignment' events but is missing an 'action.action_group_id' field", [name])
70+
}]
71+
72+
} else = results { # Case of one or more resources failing due to setting filter(s)
73+
value.result == "has_log_with_filter"
74+
75+
results := [z |
76+
filters = get_filters(value.logs[doc_id][name].criteria)
77+
z := {
78+
"doc_id" : doc_id,
79+
"resource" : value.logs[doc_id][name],
80+
"issueType": "IncorrectValue",
81+
"name" : name,
82+
"keyActualValue" : sprintf("The 'azurerm_monitor_activity_log_alert[%s]' resource monitors 'create policy assignment' events but sets %d filter(s): %s", [name, count(filters),concat(", ",filters)])
83+
}]
84+
85+
}
86+
87+
has_filter(criteria) {
88+
common_lib.valid_key(criteria, filter_fields[_])
89+
}
90+
91+
get_filters(criteria) = [x |
92+
y := filter_fields[_]
93+
common_lib.valid_key(criteria, y)
94+
x := y
95+
]

‎assets/queries/terraform/azure/activity_log_alert_for_create_policy_assignment_not_configured/test/negative1.tf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
resource "azurerm_monitor_activity_log_alert" "negative1" {
2+
name = "example-activitylogalert"
3+
resource_group_name = azurerm_resource_group.example.name
4+
location = azurerm_resource_group.example.location
5+
scopes = [azurerm_resource_group.example.id]
6+
description = "Negative sample"
7+
8+
criteria {
9+
resource_id = azurerm_storage_account.to_monitor.id
10+
operation_name = "Microsoft.Authorization/policyAssignments/write"
11+
category = "Administrative"
12+
}
13+
14+
action {
15+
action_group_id = azurerm_monitor_action_group.main.id
16+
17+
webhook_properties = {
18+
from = "terraform"
19+
}
20+
}
21+
}

‎assets/queries/terraform/azure/activity_log_alert_for_create_policy_assignment_not_configured/test/positive1.tf‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# In the future this should flag the project (currently impossible) and request for a valid "log_alert" to be defined
2+
resource "azurerm_monitor_activity_log_alert" "positive1_1" {
3+
name = "example-activitylogalert"
4+
resource_group_name = azurerm_resource_group.example.name
5+
location = azurerm_resource_group.example.location
6+
scopes = [azurerm_resource_group.example.id]
7+
description = "Positive sample"
8+
9+
criteria {
10+
resource_id = azurerm_storage_account.to_monitor.id
11+
operation_name = "Microsoft.Storage/storageAccounts/write" # wrong operation name
12+
category = "Administrative"
13+
}
14+
15+
action {
16+
action_group_id = azurerm_monitor_action_group.main.id
17+
}
18+
}
19+
20+
resource "azurerm_monitor_activity_log_alert" "positive1_2" {
21+
name = "example-activitylogalert"
22+
resource_group_name = azurerm_resource_group.example.name
23+
location = azurerm_resource_group.example.location
24+
scopes = [azurerm_resource_group.example.id]
25+
description = "Positive sample"
26+
27+
criteria {
28+
resource_id = azurerm_storage_account.to_monitor.id
29+
operation_name = "Microsoft.Authorization/policyAssignments/write"
30+
category = "Policy" # wrong category
31+
}
32+
33+
action {
34+
action_group_id = azurerm_monitor_action_group.main.id
35+
}
36+
}
37+
38+
resource "azurerm_monitor_activity_log_alert" "positive1_3" {
39+
name = "example-activitylogalert"
40+
resource_group_name = azurerm_resource_group.example.name
41+
location = azurerm_resource_group.example.location
42+
scopes = [azurerm_resource_group.example.id]
43+
description = "Positive sample"
44+
45+
criteria {
46+
resource_id = azurerm_storage_account.to_monitor.id
47+
operation_name = "Microsoft.Storage/storageAccounts/write" # wrong operation name
48+
category = "Policy" # wrong category
49+
}
50+
51+
action {
52+
action_group_id = azurerm_monitor_action_group.main.id
53+
}
54+
}

‎assets/queries/terraform/azure/activity_log_alert_for_create_policy_assignment_not_configured/test/positive2/positive2_1.tf‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# Case of correct "operation_name" and "category" but a type of filter is set
2+
resource "azurerm_monitor_activity_log_alert" "positive2_1" {
3+
name = "example-activitylogalert"
4+
resource_group_name = azurerm_resource_group.example.name
5+
location = azurerm_resource_group.example.location
6+
scopes = [azurerm_resource_group.example.id]
7+
description = "Positive sample"
8+
9+
criteria {
10+
resource_id = azurerm_storage_account.to_monitor.id
11+
operation_name = "Microsoft.Authorization/policyAssignments/write"
12+
category = "Administrative"
13+
caller = "admin@contoso.com" # filters by caller
14+
}
15+
16+
action {
17+
action_group_id = azurerm_monitor_action_group.main.id
18+
}
19+
}
20+
21+
resource "azurerm_monitor_activity_log_alert" "positive2_2" {
22+
name = "example-activitylogalert"
23+
resource_group_name = azurerm_resource_group.example.name
24+
location = azurerm_resource_group.example.location
25+
scopes = [azurerm_resource_group.example.id]
26+
description = "Positive sample"
27+
28+
criteria {
29+
resource_id = azurerm_storage_account.to_monitor.id
30+
operation_name = "Microsoft.Authorization/policyAssignments/write"
31+
category = "Administrative"
32+
level = "Informational" # filters by level
33+
}
34+
35+
action {
36+
action_group_id = azurerm_monitor_action_group.main.id
37+
}
38+
}
39+
40+
resource "azurerm_monitor_activity_log_alert" "positive2_3" {
41+
name = "example-activitylogalert"
42+
resource_group_name = azurerm_resource_group.example.name
43+
location = azurerm_resource_group.example.location
44+
scopes = [azurerm_resource_group.example.id]
45+
description = "Positive sample"
46+
47+
criteria {
48+
resource_id = azurerm_storage_account.to_monitor.id
49+
operation_name = "Microsoft.Authorization/policyAssignments/write"
50+
category = "Administrative"
51+
levels = ["Informational", "Warning"] # filters by levels
52+
}
53+
54+
action {
55+
action_group_id = azurerm_monitor_action_group.main.id
56+
}
57+
}
58+
59+
resource "azurerm_monitor_activity_log_alert" "positive2_4" {
60+
name = "example-activitylogalert"
61+
resource_group_name = azurerm_resource_group.example.name
62+
location = azurerm_resource_group.example.location
63+
scopes = [azurerm_resource_group.example.id]
64+
description = "Positive sample"
65+
66+
criteria {
67+
resource_id = azurerm_storage_account.to_monitor.id
68+
operation_name = "Microsoft.Authorization/policyAssignments/write"
69+
category = "Administrative"
70+
status = "Succeeded" # filters by status
71+
}
72+
73+
action {
74+
action_group_id = azurerm_monitor_action_group.main.id
75+
}
76+
}

‎assets/queries/terraform/azure/activity_log_alert_for_create_policy_assignment_not_configured/test/positive2/positive2_2.tf‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
resource "azurerm_monitor_activity_log_alert" "positive2_5" {
2+
name = "example-activitylogalert"
3+
resource_group_name = azurerm_resource_group.example.name
4+
location = azurerm_resource_group.example.location
5+
scopes = [azurerm_resource_group.example.id]
6+
description = "Positive sample"
7+
8+
criteria {
9+
resource_id = azurerm_storage_account.to_monitor.id
10+
operation_name = "Microsoft.Authorization/policyAssignments/write"
11+
category = "Administrative"
12+
statuses = ["Succeeded", "Failed"] # filters by statuses
13+
}
14+
15+
action {
16+
action_group_id = azurerm_monitor_action_group.main.id
17+
}
18+
}
19+
20+
resource "azurerm_monitor_activity_log_alert" "positive2_6" {
21+
name = "example-activitylogalert"
22+
resource_group_name = azurerm_resource_group.example.name
23+
location = azurerm_resource_group.example.location
24+
scopes = [azurerm_resource_group.example.id]
25+
description = "Positive sample"
26+
27+
criteria {
28+
resource_id = azurerm_storage_account.to_monitor.id
29+
operation_name = "Microsoft.Authorization/policyAssignments/write"
30+
category = "Administrative"
31+
sub_status = "Accepted" # filters by sub_status
32+
}
33+
34+
action {
35+
action_group_id = azurerm_monitor_action_group.main.id
36+
}
37+
}
38+
39+
resource "azurerm_monitor_activity_log_alert" "positive2_7" {
40+
name = "example-activitylogalert"
41+
resource_group_name = azurerm_resource_group.example.name
42+
location = azurerm_resource_group.example.location
43+
scopes = [azurerm_resource_group.example.id]
44+
description = "Positive sample"
45+
46+
criteria {
47+
resource_id = azurerm_storage_account.to_monitor.id
48+
operation_name = "Microsoft.Authorization/policyAssignments/write"
49+
category = "Administrative"
50+
sub_statuses = ["Accepted", "Conflict"] # filters by sub_statuses
51+
}
52+
53+
action {
54+
action_group_id = azurerm_monitor_action_group.main.id
55+
}
56+
}

‎assets/queries/terraform/azure/activity_log_alert_for_create_policy_assignment_not_configured/test/positive2/positive_expected_result.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
[
2+
{
3+
"queryName": "Beta - Activity Log Alert For Create Policy Assignment Not Configured",
4+
"severity": "MEDIUM",
5+
"line": 9,
6+
"fileName": "positive2_1.tf"
7+
},
8+
{
9+
"queryName": "Beta - Activity Log Alert For Create Policy Assignment Not Configured",
10+
"severity": "MEDIUM",
11+
"line": 28,
12+
"fileName": "positive2_1.tf"
13+
},
14+
{
15+
"queryName": "Beta - Activity Log Alert For Create Policy Assignment Not Configured",
16+
"severity": "MEDIUM",
17+
"line": 47,
18+
"fileName": "positive2_1.tf"
19+
},
20+
{
21+
"queryName": "Beta - Activity Log Alert For Create Policy Assignment Not Configured",
22+
"severity": "MEDIUM",
23+
"line": 66,
24+
"fileName": "positive2_1.tf"
25+
},
26+
{
27+
"queryName": "Beta - Activity Log Alert For Create Policy Assignment Not Configured",
28+
"severity": "MEDIUM",
29+
"line": 8,
30+
"fileName": "positive2_2.tf"
31+
},
32+
{
33+
"queryName": "Beta - Activity Log Alert For Create Policy Assignment Not Configured",
34+
"severity": "MEDIUM",
35+
"line": 27,
36+
"fileName": "positive2_2.tf"
37+
},
38+
{
39+
"queryName": "Beta - Activity Log Alert For Create Policy Assignment Not Configured",
40+
"severity": "MEDIUM",
41+
"line": 46,
42+
"fileName": "positive2_2.tf"
43+
}
44+
]

0 commit comments

Comments
 (0)