Skip to content

Commit bc12abb

Browse files
cx-andre-pereiracx-andre-pereira
committed
terraform equivilant query rename + extra case for cloudformation
1 parent 67d326e commit bc12abb

File tree

14 files changed

+172
-27
lines changed

14 files changed

+172
-27
lines changed

‎assets/queries/cloudFormation/aws/efs_volume_with_disabled_transit_encryption/query.rego‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ CxPolicy[result] {
2828
elem := resource[key]
2929
elem.Type == "AWS::ECS::TaskDefinition"
3030
efs := elem.Properties.Volumes[index].EFSVolumeConfiguration
31-
not efs.TransitEncryption
31+
not common_lib.valid_key(efs, "TransitEncryption")
3232

3333
result := {
3434
"documentId": input.document[i].id,
@@ -40,4 +40,23 @@ CxPolicy[result] {
4040
"keyActualValue": sprintf("'Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration.TransitEncryption' is not set", [key, index]),
4141
"searchLine": common_lib.build_search_line(["Resources",key,"Properties","Volumes", index,"EFSVolumeConfiguration"], []),
4242
}
43+
}
44+
45+
CxPolicy[result] {
46+
resource := input.document[i].Resources
47+
elem := resource[key]
48+
elem.Type == "AWS::ECS::TaskDefinition"
49+
efs := elem.Properties.Volumes[index]
50+
not common_lib.valid_key(efs, "EFSVolumeConfiguration")
51+
52+
result := {
53+
"documentId": input.document[i].id,
54+
"resourceType": elem.Type,
55+
"resourceName": cf_lib.get_resource_name(elem, key),
56+
"searchKey": sprintf("Resources.%s.Properties.Volumes", [key]),
57+
"issueType": "MissingAttribute",
58+
"keyExpectedValue": sprintf("'Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration' should be defined", [key, index]),
59+
"keyActualValue": sprintf("'Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration' is not defined", [key, index]),
60+
"searchLine": common_lib.build_search_line(["Resources",key,"Properties","Volumes", index], []),
61+
}
4362
}

‎assets/queries/cloudFormation/aws/efs_volume_with_disabled_transit_encryption/test/positive3.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"AWSTemplateFormatVersion": "2010-09-09",
3+
"Description": "A sample template",
4+
"Resources": {
5+
"ECSService": {
6+
"Properties": {
7+
"LoadBalancers": [
8+
{
9+
"TargetGroupArn": {
10+
"Ref": "TargetGroup"
11+
},
12+
"ContainerPort": 80,
13+
"ContainerName": "sample-app"
14+
}
15+
],
16+
"Cluster": {
17+
"Ref": "ECSCluster"
18+
},
19+
"LaunchType": "FARGATE",
20+
"Role": {
21+
"Ref": "ECSServiceRole"
22+
},
23+
"TaskDefinition": {
24+
"Ref": "ECSTaskDefinition"
25+
},
26+
"DesiredCount": 1
27+
},
28+
"Type": "AWS::ECS::Service",
29+
"DependsOn": [
30+
"Listener"
31+
]
32+
},
33+
"taskdefinition": {
34+
"Type": "AWS::ECS::TaskDefinition",
35+
"Properties": {
36+
"ContainerDefinitions": [
37+
{
38+
"Name": "container-using-efs",
39+
"Image": "amazonlinux:2",
40+
"EntryPoint": [
41+
"sh",
42+
"-c"
43+
],
44+
"Command": [
45+
"ls -la /mount/efs"
46+
],
47+
"MountPoints": [
48+
{
49+
"SourceVolume": "myEfsVolume",
50+
"ContainerPath": "/mount/efs",
51+
"ReadOnly": true
52+
}
53+
]
54+
}
55+
],
56+
"Volumes": [
57+
{
58+
"Name": "myEfsVolume"
59+
}
60+
]
61+
}
62+
}
63+
}
64+
}

‎assets/queries/cloudFormation/aws/efs_volume_with_disabled_transit_encryption/test/positive4.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,4 +47,5 @@ Resources:
4747
Host:
4848
SourcePath: "/var/lib/docker/vfs/dir/"
4949
EFSVolumeConfiguration:
50+
TransitEncryption: DISABLED
5051
Name: "my-vol"

‎assets/queries/cloudFormation/aws/efs_volume_with_disabled_transit_encryption/test/positive3.yaml‎ renamed to ‎assets/queries/cloudFormation/aws/efs_volume_with_disabled_transit_encryption/test/positive5.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,5 +47,4 @@ Resources:
4747
Host:
4848
SourcePath: "/var/lib/docker/vfs/dir/"
4949
EFSVolumeConfiguration:
50-
TransitEncryption: DISABLED
5150
Name: "my-vol"

‎assets/queries/cloudFormation/aws/efs_volume_with_disabled_transit_encryption/test/positive6.yaml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
Resources:
2+
taskdefinition:
3+
Type: AWS::ECS::TaskDefinition
4+
Properties:
5+
ContainerDefinitions:
6+
-
7+
Name:
8+
Ref: "AppName"
9+
MountPoints:
10+
-
11+
SourceVolume: "my-vol"
12+
ContainerPath: "/var/www/my-vol"
13+
Image: "amazon/amazon-ecs-sample"
14+
Cpu: 256
15+
PortMappings:
16+
-
17+
ContainerPort:
18+
Ref: "AppContainerPort"
19+
HostPort:
20+
Ref: "AppHostPort"
21+
EntryPoint:
22+
- "/usr/sbin/apache2"
23+
- "-D"
24+
- "FOREGROUND"
25+
Memory: 512
26+
Essential: true
27+
Environment:
28+
-
29+
Name: PASSWORD
30+
-
31+
Name: "busybox"
32+
Image: "busybox"
33+
Cpu: 256
34+
EntryPoint:
35+
- "sh"
36+
- "-c"
37+
Memory: 512
38+
Command:
39+
- "/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\""
40+
Essential: false
41+
VolumesFrom:
42+
-
43+
SourceContainer:
44+
Ref: "AppName"
45+
Volumes:
46+
-
47+
Host:
48+
SourcePath: "/var/lib/docker/vfs/dir/"
49+
Name: "my-vol"

‎assets/queries/cloudFormation/aws/efs_volume_with_disabled_transit_encryption/test/positive_expected_result.json‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,16 +11,28 @@
1111
"line": 59,
1212
"fileName": "positive2.json"
1313
},
14+
{
15+
"queryName": "EFS Volume With Disabled Transit Encryption",
16+
"severity": "MEDIUM",
17+
"line": 53,
18+
"fileName": "positive3.json"
19+
},
1420
{
1521
"queryName": "EFS Volume With Disabled Transit Encryption",
1622
"severity": "MEDIUM",
1723
"line": 50,
18-
"fileName": "positive3.yaml"
24+
"fileName": "positive4.yaml"
1925
},
2026
{
2127
"queryName": "EFS Volume With Disabled Transit Encryption",
2228
"severity": "MEDIUM",
2329
"line": 49,
24-
"fileName": "positive4.yaml"
30+
"fileName": "positive5.yaml"
31+
},
32+
{
33+
"queryName": "EFS Volume With Disabled Transit Encryption",
34+
"severity": "MEDIUM",
35+
"line": 45,
36+
"fileName": "positive6.yaml"
2537
}
2638
]

‎assets/queries/terraform/aws/ecs_task_definition_volume_not_encrypted/test/positive_expected_result.json‎

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎assets/queries/terraform/aws/ecs_task_definition_volume_not_encrypted/metadata.json‎ renamed to ‎assets/queries/terraform/aws/efs_volume_with_disabled_transit_encryption/metadata.json‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
{
22
"id": "4d46ff3b-7160-41d1-a310-71d6d370b08f",
3-
"queryName": "ECS Task Definition Volume Not Encrypted",
4-
"severity": "HIGH",
3+
"queryName": "EFS Volume With Disabled Transit Encryption",
4+
"severity": "MEDIUM",
55
"category": "Encryption",
66
"descriptionText": "AWS ECS Task Definition EFS data in transit between AWS ECS host and AWS EFS server should be encrypted",
77
"descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_task_definition#transit_encryption",
88
"platform": "Terraform",
99
"descriptionID": "b01e131b",
1010
"cloudProvider": "aws",
11-
"cwe": "311"
11+
"cwe": "312",
12+
"oldSeverity": "HIGH"
1213
}

‎assets/queries/terraform/aws/ecs_task_definition_volume_not_encrypted/query.rego‎ renamed to ‎assets/queries/terraform/aws/efs_volume_with_disabled_transit_encryption/query.rego‎

File renamed without changes.

‎assets/queries/terraform/aws/ecs_task_definition_volume_not_encrypted/test/negative1.tf‎ renamed to ‎assets/queries/terraform/aws/efs_volume_with_disabled_transit_encryption/test/negative1.tf‎

File renamed without changes.

0 commit comments

Comments
 (0)