Skip to content

Commit a3d61c3

Browse files
cx-ricardo-jesuscx-ricardo-jesus
authored
feat(queries): implemented queries that checks if the tls encryption version is set to '1.2' or higher for terrraform/azure (#7852)
* implemented queries that checks if the tls encryption version is set to 1.2 or higher * added all the queries to the similarityID_transition yaml files for terraform/azure * fixed positive expected results * fix remediation
1 parent 2711a25 commit a3d61c3

File tree

30 files changed

+403
-0
lines changed

30 files changed

+403
-0
lines changed

‎assets/queries/terraform/azure/function_app_deployment_slot_not_using_latest_tls_encryption_version/metadata.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"id": "03928f0d-bff0-4feb-a31a-615d093e6026",
3+
"queryName": "Beta - Function App Deployment Slot Not Using Latest TLS Encryption Version",
4+
"severity": "MEDIUM",
5+
"category": "Encryption",
6+
"descriptionText": "Ensure Function App Deployment Slot is using the latest version of TLS encryption",
7+
"descriptionUrl": "https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/windows_function_app_slot",
8+
"platform": "Terraform",
9+
"descriptionID": "03928f0d",
10+
"cloudProvider": "azure",
11+
"cwe": "326",
12+
"riskScore": "3.0",
13+
"experimental": "true"
14+
}

‎assets/queries/terraform/azure/function_app_deployment_slot_not_using_latest_tls_encryption_version/query.rego‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
package Cx
2+
3+
import data.generic.common as common_lib
4+
import data.generic.terraform as tf_lib
5+
6+
CxPolicy[result] {
7+
supported_resources := {"azurerm_linux_function_app_slot", "azurerm_windows_function_app_slot"}
8+
resource := input.document[i].resource[supported_resources[resource_index]][name]
9+
10+
common_lib.valid_key(resource.site_config, "minimum_tls_version")
11+
resource.site_config.minimum_tls_version != "1.2"
12+
resource.site_config.minimum_tls_version != "1.3"
13+
tls_version_val := resource.site_config.minimum_tls_version
14+
15+
result := {
16+
"documentId": input.document[i].id,
17+
"resourceType": supported_resources[resource_index],
18+
"resourceName": tf_lib.get_resource_name(resource,name),
19+
"searchKey": sprintf("%s[%s].site_config.minimum_tls_version", [supported_resources[resource_index], name]),
20+
"issueType": "IncorrectValue",
21+
"keyExpectedValue": "'site_config.minimum_tls_version' should be defined to '1.2' or higher",
22+
"keyActualValue": sprintf("'site_config.minimum_tls_version' is defined to '%s'", [tls_version_val]),
23+
"searchLine": common_lib.build_search_line(["resource", supported_resources[resource_index], name, "site_config", "minimum_tls_version"], []),
24+
"remediation": json.marshal({
25+
"before": tls_version_val,
26+
"after": "1.3",
27+
}),
28+
"remediationType": "replacement",
29+
}
30+
}

‎assets/queries/terraform/azure/function_app_deployment_slot_not_using_latest_tls_encryption_version/test/negative1.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
resource "azurerm_linux_function_app_slot" "negative1" {
2+
name = "example-linux-function-app-slot"
3+
function_app_id = azurerm_linux_function_app.example.id
4+
storage_account_name = azurerm_storage_account.example.name
5+
6+
site_config {}
7+
}

‎assets/queries/terraform/azure/function_app_deployment_slot_not_using_latest_tls_encryption_version/test/negative2.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
resource "azurerm_linux_function_app_slot" "negative2" {
2+
name = "example-linux-function-app-slot"
3+
function_app_id = azurerm_linux_function_app.example.id
4+
storage_account_name = azurerm_storage_account.example.name
5+
6+
site_config {
7+
minimum_tls_version = "1.2"
8+
}
9+
}

‎assets/queries/terraform/azure/function_app_deployment_slot_not_using_latest_tls_encryption_version/test/negative3.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
resource "azurerm_linux_function_app_slot" "negative3" {
2+
name = "example-linux-function-app-slot"
3+
function_app_id = azurerm_linux_function_app.example.id
4+
storage_account_name = azurerm_storage_account.example.name
5+
6+
site_config {
7+
minimum_tls_version = "1.3"
8+
}
9+
}

‎assets/queries/terraform/azure/function_app_deployment_slot_not_using_latest_tls_encryption_version/test/negative4.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
resource "azurerm_windows_function_app_slot" "negative4" {
2+
name = "example-slot"
3+
function_app_id = azurerm_windows_function_app.example.id
4+
storage_account_name = azurerm_storage_account.example.name
5+
6+
site_config {}
7+
}

‎assets/queries/terraform/azure/function_app_deployment_slot_not_using_latest_tls_encryption_version/test/negative5.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
resource "azurerm_windows_function_app_slot" "negative5" {
2+
name = "example-slot"
3+
function_app_id = azurerm_windows_function_app.example.id
4+
storage_account_name = azurerm_storage_account.example.name
5+
6+
site_config {
7+
minimum_tls_version = "1.2"
8+
}
9+
}

‎assets/queries/terraform/azure/function_app_deployment_slot_not_using_latest_tls_encryption_version/test/negative6.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
resource "azurerm_windows_function_app_slot" "negative6" {
2+
name = "example-slot"
3+
function_app_id = azurerm_windows_function_app.example.id
4+
storage_account_name = azurerm_storage_account.example.name
5+
6+
site_config {
7+
minimum_tls_version = "1.3"
8+
}
9+
}

‎assets/queries/terraform/azure/function_app_deployment_slot_not_using_latest_tls_encryption_version/test/positive1.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
resource "azurerm_linux_function_app_slot" "positive1" {
2+
name = "example-linux-function-app-slot"
3+
function_app_id = azurerm_linux_function_app.example.id
4+
storage_account_name = azurerm_storage_account.example.name
5+
6+
site_config {
7+
minimum_tls_version = "1.1"
8+
}
9+
}

‎assets/queries/terraform/azure/function_app_deployment_slot_not_using_latest_tls_encryption_version/test/positive2.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
resource "azurerm_windows_function_app_slot" "positive2" {
2+
name = "example-slot"
3+
function_app_id = azurerm_windows_function_app.example.id
4+
storage_account_name = azurerm_storage_account.example.name
5+
6+
site_config {
7+
minimum_tls_version = "1.1"
8+
}
9+
}

0 commit comments

Comments
 (0)