fix(secrets regex): added "Avoiding Secrets Manager arn" (Checkmarx#5048

)
Dipesh-Reen · Mar 28, 2022 · daeae25 · daeae25
1 parent 042f2d7
commit daeae25
Show file tree

Hide file tree

Showing 2 changed files with 29 additions and 0 deletions.
diff --git a/assets/queries/common/passwords_and_secrets/regex_rules.json b/assets/queries/common/passwords_and_secrets/regex_rules.json
@@ -34,6 +34,10 @@
         {
           "description": "Avoiding TF resource access",
           "regex": "(?i)['\"]?secret[_]?(key)?['\"]?\\s*=\\s*([a-zA-z_]+(.))?[a-zA-z_]+(.)[a-zA-z_]+(.)[a-zA-z_]+"
+        },
+        {
+          "description": "Avoiding Secrets Manager arn",
+          "regex": ":secretsmanager:[a-z0-9-]+:[0-9]+:(?i)['\"]?secret[_]?(key)?['\"]?\\s*(:|=)\\s*['\"]?([A-Za-z0-9\/~^_!@&%()=?*+-]{10,})['\"]?"
         }
       ]
     },

diff --git a/assets/queries/common/passwords_and_secrets/test/negative48.yaml b/assets/queries/common/passwords_and_secrets/test/negative48.yaml
@@ -0,0 +1,25 @@
+Type: AWS::Glue::Connection
+Properties:
+    CatalogId: "1111111111111"
+    ConnectionInput:
+      ConnectionProperties:
+          CONNECTION_URL:
+            Fn::Join:
+              - ""
+              - - "mongodb://{{resolve:secretsmanager:arn:"
+                - Ref: AWS::Partition
+                - :secretsmanager:eu-west-1:1111111111111:secret:/test/resources/docdb-test:SecretString:endpoint::}}/test
+          USERNAME:
+            Fn::Join:
+              - ""
+              - - "{{resolve:secretsmanager:arn:"
+                - Ref: AWS::Partition
+                - :secretsmanager:eu-west-1:1111111111111:secret:/test/resources/docdb-test:SecretString:username::}}
+          PASSWORD:
+            Fn::Join:
+              - ""
+              - - "{{resolve:secretsmanager:arn:"
+                - Ref: AWS::Partition
+                - :secretsmanager:eu-west-1:1111111111111:secret:/test/resources/docdb-test:SecretString:password::}}
+          JDBC_ENFORCE_SSL: true
+      ConnectionType: MONGODB