Skip to content

Commit cf1a5e6

Browse files
cx-andre-pereiracx-artur-ribeiro
cx-andre-pereira
and
cx-artur-ribeiro
authored
fix(query): fn for EFS volume with disabled transit encryption--cloudformation/aws (#7586)
* fix(query): fn for EFS volume with disabled transit encryption--cloudformation/aws --------- Co-authored-by: Artur Ribeiro <[email protected]>
1 parent 522a9a2 commit cf1a5e6

40 files changed

+965
-1058
lines changed

‎assets/queries/cloudFormation/aws/ecs_cluster_not_encrypted_at_rest/query.rego‎

Lines changed: 9 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ package Cx
33
import data.generic.common as common_lib
44
import data.generic.cloudformation as cf_lib
55

6-
CxPolicy[result] {
6+
CxPolicy[result] {
77
resource := input.document[i].Resources
88
elem := resource[key]
99
elem.Type == "AWS::ECS::Service"
@@ -12,16 +12,16 @@ CxPolicy[result] {
1212
taskDefinition := resource[taskdefinitionkey]
1313

1414
count(taskDefinition.Properties.ContainerDefinitions) > 0
15-
res := is_transit_encryption_disabled(taskDefinition, taskdefinitionkey)
16-
15+
taskDefinition.Properties.Volumes[j].EFSVolumeConfiguration.TransitEncryption == "DISABLED"
16+
1717
result := {
1818
"documentId": input.document[i].id,
1919
"resourceType": elem.Type,
20-
"resourceName": cf_lib.get_resource_name(resource, key),
21-
"searchKey": res["sk"],
22-
"issueType": res["issueT"],
23-
"keyExpectedValue": res["kev"],
24-
"keyActualValue": res["kav"],
20+
"resourceName": cf_lib.get_resource_name(resource, key),
21+
"searchKey": sprintf("Resources.%s.Properties.Volumes", [taskdefinitionkey]),
22+
"issueType": "IncorrectValue",
23+
"keyExpectedValue": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration.TransitEncryption should be enabled", [taskdefinitionkey, j]),
24+
"keyActualValue": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration.TransitEncryption is disabled", [taskdefinitionkey, j]),
2525
}
2626
}
2727

@@ -44,48 +44,9 @@ CxPolicy[result] {
4444
}
4545
}
4646

47-
is_transit_encryption_disabled(taskDefinition, taskdefinitionkey) = res {
48-
volume := taskDefinition.Properties.Volumes[j]
49-
common_lib.valid_key(volume.EFSVolumeConfiguration, "TransitEncryption")
50-
volume.EFSVolumeConfiguration.TransitEncryption == "DISABLED"
51-
res := {
52-
"sk": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration.TransitEncryption", [taskdefinitionkey, j]),
53-
"issueT": "IncorrectValue",
54-
"kev": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration.TransitEncryption should be enabled", [taskdefinitionkey, j]),
55-
"kav": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration.TransitEncryption is disabled", [taskdefinitionkey, j]),
56-
}
57-
} else = res {
58-
volume := taskDefinition.Properties.Volumes[j]
59-
efsVolumeConfiguration := volume.EFSVolumeConfiguration
60-
not common_lib.valid_key(efsVolumeConfiguration, "TransitEncryption")
61-
res := {
62-
"sk": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration", [taskdefinitionkey, j]),
63-
"issueT": "MissingAttribute",
64-
"kev": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration.TransitEncryption should be defined", [taskdefinitionkey, j]),
65-
"kav": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration.TransitEncryption is not defined (set to DISABLED by default)", [taskdefinitionkey, j]),
66-
}
67-
} else = res {
68-
volume := taskDefinition.Properties.Volumes[j]
69-
not common_lib.valid_key(volume, "EFSVolumeConfiguration")
70-
res := {
71-
"sk": sprintf("Resources.%s.Properties.Volumes[%d]", [taskdefinitionkey, j]),
72-
"issueT": "MissingAttribute",
73-
"kev": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration should be defined", [taskdefinitionkey, j]),
74-
"kav": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration is not defined", [taskdefinitionkey, j]),
75-
}
76-
} else = res {
77-
not common_lib.valid_key(taskDefinition.Properties, "Volumes")
78-
res := {
79-
"sk": sprintf("Resources.%s.Properties", [taskdefinitionkey]),
80-
"issueT": "MissingAttribute",
81-
"kev": sprintf("Resources.%s.Properties.Volumes should be defined", [taskdefinitionkey]),
82-
"kav": sprintf("Resources.%s.Properties.Volumes is not defined", [taskdefinitionkey]),
83-
}
84-
}
85-
8647
getTaskDefinitionName(resource) := name {
8748
name := resource.Properties.TaskDefinition
8849
not common_lib.valid_key(name, "Ref")
8950
} else := name {
9051
name := resource.Properties.TaskDefinition.Ref
91-
}
52+
}

‎assets/queries/cloudFormation/aws/ecs_cluster_not_encrypted_at_rest/test/negative1.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,33 @@ Resources:
8888
TaskDefinition: !Ref taskdefinition
8989
ServiceName: !Ref ServiceName
9090
Role: !Ref Role
91+
elb:
92+
Type: AWS::ElasticLoadBalancing::LoadBalancer
93+
Properties:
94+
LoadBalancerName: !Ref LoadBalancerName
95+
Listeners:
96+
- InstancePort: !Ref AppHostPort
97+
LoadBalancerPort: '80'
98+
Protocol: HTTP
99+
Subnets:
100+
- !Ref Subnet1
101+
DependsOn: GatewayAttachment
102+
VPC:
103+
Type: AWS::EC2::VPC
104+
Properties:
105+
CidrBlock: 10.0.0.0/24
106+
Subnet1:
107+
Type: AWS::EC2::Subnet
108+
Properties:
109+
VpcId: !Ref VPC
110+
CidrBlock: 10.0.0.0/25
111+
InternetGateway:
112+
Type: AWS::EC2::InternetGateway
113+
GatewayAttachment:
114+
Type: AWS::EC2::VPCGatewayAttachment
115+
Properties:
116+
InternetGatewayId: !Ref InternetGateway
117+
VpcId: !Ref VPC
91118
Role:
92119
Type: AWS::IAM::Role
93120
Properties:

‎assets/queries/cloudFormation/aws/ecs_cluster_not_encrypted_at_rest/test/negative2.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
12
{
23
"AWSTemplateFormatVersion": "2010-09-09T00:00:00Z",
34
"Description": "Creating ECS service",
@@ -28,6 +29,16 @@
2829
}
2930
},
3031
"Resources": {
32+
"InternetGateway": {
33+
"Type": "AWS::EC2::InternetGateway"
34+
},
35+
"GatewayAttachment": {
36+
"Type": "AWS::EC2::VPCGatewayAttachment",
37+
"Properties": {
38+
"InternetGatewayId": "InternetGateway",
39+
"VpcId": "VPC"
40+
}
41+
},
3142
"Role": {
3243
"Type": "AWS::IAM::Role",
3344
"Properties": {
@@ -68,12 +79,61 @@
6879
"LoadBalancerName": "elb"
6980
}
7081
],
82+
"PlacementStrategies": [
83+
{
84+
"Type": "binpack",
85+
"Field": "memory"
86+
},
87+
{
88+
"Type": "spread",
89+
"Field": "host"
90+
}
91+
],
92+
"PlacementConstraints": [
93+
{
94+
"Type": "memberOf",
95+
"Expression": "attribute:ecs.availability-zone != us-east-1d"
96+
},
97+
{
98+
"Type": "distinctInstance"
99+
}
100+
],
71101
"ServiceName": "ServiceName",
72102
"Cluster": "cluster",
73103
"DesiredCount": 0,
74104
"HealthCheckGracePeriodSeconds": "HealthCheckGracePeriodSeconds"
75105
}
76106
},
107+
"elb": {
108+
"Type": "AWS::ElasticLoadBalancing::LoadBalancer",
109+
"Properties": {
110+
"Subnets": [
111+
"Subnet1"
112+
],
113+
"LoadBalancerName": "LoadBalancerName",
114+
"Listeners": [
115+
{
116+
"LoadBalancerPort": "80",
117+
"Protocol": "HTTP",
118+
"InstancePort": "AppHostPort"
119+
}
120+
]
121+
},
122+
"DependsOn": "GatewayAttachment"
123+
},
124+
"VPC": {
125+
"Type": "AWS::EC2::VPC",
126+
"Properties": {
127+
"CidrBlock": "10.0.0.0/24"
128+
}
129+
},
130+
"Subnet1": {
131+
"Type": "AWS::EC2::Subnet",
132+
"Properties": {
133+
"CidrBlock": "10.0.0.0/25",
134+
"VpcId": "VPC"
135+
}
136+
},
77137
"taskdefinition": {
78138
"Type": "AWS::ECS::TaskDefinition",
79139
"Properties": {

‎assets/queries/cloudFormation/aws/ecs_cluster_not_encrypted_at_rest/test/negative3.yaml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
Resources:
2+
TaskDef54694570:
3+
Type: AWS::ECS::TaskDefinition
4+
Properties:
5+
ContainerDefinitions:
6+
- Environment:
7+
- Name: DEPLOYMENT_TIMESTAMP
8+
Value: "2024-08-20T00:41:57.620Z"
9+
Essential: true
10+
HealthCheck:
11+
Command:
12+
- CMD-SHELL
13+
- curl -f http://localhost:3000/health || exit
14+
Interval: 30
15+
Retries: 3
16+
StartPeriod: 30
17+
Timeout: 5
18+
Image:
19+
Fn::Join:
20+
- ""
21+
- - 123456789012.dkr.ecr.us-west-2.
22+
- Ref: AWS::URLSuffix
23+
- /example-nms:latest
24+
ExecutionRoleArn:
25+
Fn::GetAtt:
26+
- TaskDefExecutionRoleB4775C97
27+
- Arn
28+
RequiresCompatibilities:
29+
- EC2
30+
Tags:
31+
- Key: classification
32+
Value: internal
33+
- Key: component
34+
Value: example-nms
35+
- Key: env
36+
Value: development
37+
- Key: owner
38+
Value: [email protected]
39+
- Key: product
40+
Value: internal_tools
41+
TaskRoleArn:
42+
Fn::GetAtt:
43+
- EcsTaskRole8DFA0181
44+
- Arn
45+
ExampleNameMatchService0992A2E7:
46+
Type: AWS::ECS::Service
47+
Properties:
48+
Cluster: example-ecs
49+
SchedulingStrategy: REPLICA
50+
Tags:
51+
- Key: classification
52+
Value: internal
53+
- Key: component
54+
Value: example-nms
55+
- Key: env
56+
Value: development
57+
- Key: owner
58+
Value: [email protected]
59+
- Key: product
60+
Value: internal_tools
61+
TaskDefinition:
62+
Ref: TaskDef54694570

‎assets/queries/cloudFormation/aws/ecs_cluster_not_encrypted_at_rest/test/positive1.json‎

Lines changed: 0 additions & 131 deletions
This file was deleted.

0 commit comments

Comments
 (0)