Skip to content

Commit ef69e02

Browse files
cx-artur-ribeirocx-artur-ribeiro
authored
Merge branch 'master' into AST-124907-Passwords_And_Secrets-Generic_Secret_Generic_password
2 parents e10b5d1 + dcf7740 commit ef69e02

File tree

7 files changed

+190
-54
lines changed

7 files changed

+190
-54
lines changed

‎assets/queries/terraform/azure/encryption_on_managed_disk_disabled/metadata.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,4 @@
1010
"cloudProvider": "azure",
1111
"cwe": "311",
1212
"riskScore": "5.5"
13-
}
13+
}

‎assets/queries/terraform/azure/encryption_on_managed_disk_disabled/query.rego‎

Lines changed: 40 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -4,42 +4,55 @@ import data.generic.common as common_lib
44
import data.generic.terraform as tf_lib
55

66
CxPolicy[result] {
7-
resource := input.document[i].resource
8-
encryption := resource.azurerm_managed_disk[name]
9-
not common_lib.valid_key(encryption, "encryption_settings")
7+
resource := input.document[i].resource.azurerm_managed_disk[name]
8+
9+
results := undefined_or_empty(resource, name)
1010

1111
result := {
1212
"documentId": input.document[i].id,
1313
"resourceType": "azurerm_managed_disk",
1414
"resourceName": tf_lib.get_resource_name(resource, name),
15-
"searchKey": sprintf("azurerm_managed_disk[%s]", [name]),
16-
"issueType": "MissingAttribute",
17-
"keyExpectedValue": sprintf("azurerm_managed_disk[%s].encryption_settings should be defined and not null", [name]),
18-
"keyActualValue": sprintf("azurerm_managed_disk[%s].encryption_settings is undefined or null", [name]),
19-
"searchLine": common_lib.build_search_line(["resource","azurerm_managed_disk" ,name], []),
20-
"remediation": "encryption_settings = {\n\t\t enabled= true\n\t}\n",
21-
"remediationType": "addition",
15+
"searchKey": results.searchKey,
16+
"issueType": results.issueType,
17+
"keyExpectedValue": results.keyExpectedValue,
18+
"keyActualValue": results.keyActualValue,
19+
"searchLine": results.searchLine,
20+
"remediation": results.remediation,
21+
"remediationType": results.remediationType
2222
}
2323
}
2424

25-
CxPolicy[result] {
26-
resource := input.document[i].resource
27-
encryption := resource.azurerm_managed_disk[name]
28-
encryption.encryption_settings.enabled == false
29-
30-
result := {
31-
"documentId": input.document[i].id,
32-
"resourceType": "azurerm_managed_disk",
33-
"resourceName": tf_lib.get_resource_name(resource, name),
25+
undefined_or_empty(resource, name) = results {
26+
not common_lib.valid_key(resource, "encryption_settings")
27+
results := {
28+
"searchKey": sprintf("azurerm_managed_disk[%s]", [name]),
29+
"issueType": "MissingAttribute",
30+
"keyExpectedValue": sprintf("'azurerm_managed_disk[%s].encryption_settings' should be defined and not null", [name]),
31+
"keyActualValue": sprintf("'azurerm_managed_disk[%s].encryption_settings' is undefined or null", [name]),
32+
"searchLine": common_lib.build_search_line(["resource", "azurerm_managed_disk", name], []),
33+
"remediation": null,
34+
"remediationType": null
35+
}
36+
} else = results {
37+
resource.encryption_settings == [[],{}][_] # [] for tfplan support
38+
results := {
39+
"searchKey": sprintf("azurerm_managed_disk[%s].encryption_settings", [name]),
40+
"issueType": "IncorrectValue",
41+
"keyExpectedValue": sprintf("'azurerm_managed_disk[%s].encryption_settings' should be defined and not null", [name]),
42+
"keyActualValue": sprintf("'azurerm_managed_disk[%s].encryption_settings' is set to '%v", [name, resource.encryption_settings]),
43+
"searchLine": common_lib.build_search_line(["resource", "azurerm_managed_disk", name, "encryption_settings"], []),
44+
"remediation": null,
45+
"remediationType": null
46+
}
47+
} else = results {
48+
resource.encryption_settings.enabled == false
49+
results := {
3450
"searchKey": sprintf("azurerm_managed_disk[%s].encryption_settings.enabled", [name]),
3551
"issueType": "IncorrectValue",
36-
"keyExpectedValue": sprintf("azurerm_managed_disk[%s].encryption_settings.enabled should be true ", [name]),
37-
"keyActualValue": sprintf("azurerm_managed_disk[%s].encryption_settings.enabled is false", [name]),
38-
"searchLine": common_lib.build_search_line(["resource","azurerm_managed_disk" ,name ,"encryption_settings", "enabled"], []),
39-
"remediation": json.marshal({
40-
"before": "false",
41-
"after": "true"
42-
}),
43-
"remediationType": "replacement",
52+
"keyExpectedValue": sprintf("'azurerm_managed_disk[%s].encryption_settings.enabled' should be set to true", [name]),
53+
"keyActualValue": sprintf("'azurerm_managed_disk[%s].encryption_settings.enabled' is set to false", [name]),
54+
"searchLine": common_lib.build_search_line(["resource", "azurerm_managed_disk", name, "encryption_settings", "enabled"], []),
55+
"remediation": json.marshal({"before": "false", "after": "true"}),
56+
"remediationType": "replacement"
4457
}
4558
}

‎assets/queries/terraform/azure/encryption_on_managed_disk_disabled/test/negative.tf‎

Lines changed: 58 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,63 @@ resource "azurerm_managed_disk" "negative1" {
66
storage_account_type = "Standard_LRS"
77
create_option = "Empty"
88
disk_size_gb = "1"
9-
10-
encryption_settings = {
11-
enabled = true
9+
10+
encryption_settings {
11+
enabled = true # legacy
12+
}
13+
}
14+
15+
resource "azurerm_managed_disk" "negative2" {
16+
name = "acctestmd"
17+
location = "West US 2"
18+
resource_group_name = azurerm_resource_group.example.name
19+
storage_account_type = "Standard_LRS"
20+
create_option = "Empty"
21+
disk_size_gb = "1"
22+
23+
encryption_settings {
24+
25+
disk_encryption_key {
26+
secret_url = "sample_url"
27+
source_vault_id = "sample_id"
28+
}
29+
30+
key_encryption_key {
31+
secret_url = "sample_url"
32+
source_vault_id = "sample_id"
33+
}
34+
35+
}
36+
}
37+
38+
resource "azurerm_managed_disk" "negative3" {
39+
name = "acctestmd"
40+
location = "West US 2"
41+
resource_group_name = azurerm_resource_group.example.name
42+
storage_account_type = "Standard_LRS"
43+
create_option = "Empty"
44+
disk_size_gb = "1"
45+
46+
encryption_settings {
47+
disk_encryption_key {
48+
secret_url = "sample_url"
49+
source_vault_id = "sample_id"
50+
}
1251
}
13-
tags = {
14-
environment = "staging"
52+
}
53+
54+
resource "azurerm_managed_disk" "negative4" {
55+
name = "acctestmd"
56+
location = "West US 2"
57+
resource_group_name = azurerm_resource_group.example.name
58+
storage_account_type = "Standard_LRS"
59+
create_option = "Empty"
60+
disk_size_gb = "1"
61+
62+
encryption_settings {
63+
key_encryption_key {
64+
secret_url = "sample_url"
65+
source_vault_id = "sample_id"
66+
}
1567
}
16-
}
68+
}

‎assets/queries/terraform/azure/encryption_on_managed_disk_disabled/test/positive.tf‎

Lines changed: 26 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,8 @@ resource "azurerm_managed_disk" "positive1" {
66
create_option = "Empty"
77
disk_size_gb = "1"
88

9-
encryption_settings = {
10-
enabled = false
11-
}
12-
13-
tags = {
14-
environment = "staging"
9+
encryption_settings {
10+
enabled = false # legacy
1511
}
1612
}
1713

@@ -22,9 +18,28 @@ resource "azurerm_managed_disk" "positive2" {
2218
storage_account_type = "Standard_LRS"
2319
create_option = "Empty"
2420
disk_size_gb = "1"
25-
2621

27-
tags = {
28-
environment = "staging"
29-
}
30-
}
22+
# missing "encryption_settings"
23+
}
24+
25+
resource "azurerm_managed_disk" "positive3" {
26+
name = "acctestmd"
27+
location = "West US 2"
28+
resource_group_name = azurerm_resource_group.example.name
29+
storage_account_type = "Standard_LRS"
30+
create_option = "Empty"
31+
disk_size_gb = "1"
32+
33+
encryption_settings {}
34+
}
35+
36+
resource "azurerm_managed_disk" "positive4" {
37+
name = "acctestmd"
38+
location = "West US 2"
39+
resource_group_name = azurerm_resource_group.example.name
40+
storage_account_type = "Standard_LRS"
41+
create_option = "Empty"
42+
disk_size_gb = "1"
43+
44+
encryption_settings = [] # simulates "tfplan"
45+
}

‎assets/queries/terraform/azure/encryption_on_managed_disk_disabled/test/positive_expected_result.json‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,16 @@
77
{
88
"queryName": "Encryption On Managed Disk Disabled",
99
"severity": "MEDIUM",
10-
"line": 18
10+
"line": 14
11+
},
12+
{
13+
"queryName": "Encryption On Managed Disk Disabled",
14+
"severity": "MEDIUM",
15+
"line": 33
16+
},
17+
{
18+
"queryName": "Encryption On Managed Disk Disabled",
19+
"severity": "MEDIUM",
20+
"line": 44
1121
}
1222
]

‎pkg/parser/json/tfplan.go‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -62,14 +62,12 @@ func readPlan(plan *hcl_plan.Plan) model.Document {
6262

6363
// readModule will iterate over all planned_value getting the information required
6464
func (kp *KicsPlan) readModule(module *hcl_plan.StateModule) {
65-
// initialize all the types interfaces
65+
// initialize all the types interfaces and fill in all the types interfaces
6666
for _, resource := range module.Resources {
67-
convNamedRes := make(map[string]KicsPlanNamedResource)
68-
kp.Resource[resource.Type] = convNamedRes
69-
}
70-
// fill in all the types interfaces
71-
for _, resource := range module.Resources {
72-
kp.Resource[resource.Type][resource.Name] = resource.AttributeValues
67+
if _, type_map := kp.Resource[resource.Type]; !type_map {
68+
kp.Resource[resource.Type] = make(map[string]KicsPlanNamedResource)
69+
}
70+
kp.Resource[resource.Type][resource.Address] = resource.AttributeValues
7371
}
7472

7573
for _, childModule := range module.ChildModules {

‎pkg/parser/json/tfplan_test.go‎

Lines changed: 49 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ func TestJson_parseTFPlan(t *testing.T) {
5151
want: model.Document{
5252
"resource": map[string]interface{}{
5353
"fakewebservices_database": map[string]interface{}{
54-
"prod_db": map[string]interface{}{
54+
"fakewebservices_database.prod_db": map[string]interface{}{
5555
"name": "Production DB",
5656
"size": (float64)(256),
5757
},
@@ -72,6 +72,54 @@ func TestJson_parseTFPlan(t *testing.T) {
7272
want: model.Document{},
7373
wantErr: true,
7474
},
75+
{
76+
name: "test - parse tfplan with duplicate resource names (different addresses)",
77+
args: args{
78+
doc: model.Document{
79+
"format_version": "0.2",
80+
"terraform_version": "1.0.5",
81+
"planned_values": map[string]interface{}{
82+
"root_module": map[string]interface{}{
83+
"resources": []map[string]interface{}{
84+
{
85+
"address": "fakewebservices_database.prod_db[0]",
86+
"type": "fakewebservices_database",
87+
"name": "prod_db",
88+
"values": map[string]interface{}{
89+
"name": "Production DB A",
90+
"size": 256,
91+
},
92+
},
93+
{
94+
"address": "fakewebservices_database.prod_db[1]",
95+
"type": "fakewebservices_database",
96+
"name": "prod_db",
97+
"values": map[string]interface{}{
98+
"name": "Production DB B",
99+
"size": 512,
100+
},
101+
},
102+
},
103+
},
104+
},
105+
},
106+
},
107+
want: model.Document{
108+
"resource": map[string]interface{}{
109+
"fakewebservices_database": map[string]interface{}{
110+
"fakewebservices_database.prod_db[0]": map[string]interface{}{
111+
"name": "Production DB A",
112+
"size": (float64)(256),
113+
},
114+
"fakewebservices_database.prod_db[1]": map[string]interface{}{
115+
"name": "Production DB B",
116+
"size": (float64)(512),
117+
},
118+
},
119+
},
120+
},
121+
wantErr: false,
122+
},
75123
}
76124

77125
for _, tt := range tests {

0 commit comments

Comments
 (0)