feat(query): added support to tf modules for S3 Bucket Allows Public …

…Policy (Checkmarx#4268) Signed-off-by: João Reigota <[email protected]>
noamd-legit · Sep 24, 2021 · 352f574 · 352f574
1 parent be18968
commit 352f574
Show file tree

Hide file tree

Showing 7 changed files with 143 additions and 2 deletions.
diff --git a/assets/queries/terraform/aws/s3_bucket_with_public_policy/query.rego b/assets/queries/terraform/aws/s3_bucket_with_public_policy/query.rego
@@ -13,6 +13,7 @@ CxPolicy[result] {
 		"issueType": "MissingAttribute",
 		"keyExpectedValue": "'block_public_policy' is equal 'true'",
 		"keyActualValue": "'block_public_policy' is missing",
+		"searchLine": common_lib.build_search_line(["resource", "aws_s3_bucket_public_access_block", name], []),
 	}
 }
 
@@ -26,5 +27,36 @@ CxPolicy[result] {
 		"issueType": "IncorrectValue",
 		"keyExpectedValue": "'block_public_policy' is equal 'true'",
 		"keyActualValue": "'block_public_policy' is equal 'false'",
+		"searchLine": common_lib.build_search_line(["resource", "aws_s3_bucket_public_access_block", name, "block_public_policy"], []),
+	}
+}
+
+CxPolicy[result] {
+	module := input.document[i].module[name]
+	keyToCheck := common_lib.get_module_equivalent_key("aws", module.source, "aws_s3_bucket", "block_public_policy")
+	not common_lib.valid_key(module, keyToCheck)
+
+	result := {
+		"documentId": input.document[i].id,
+		"searchKey": sprintf("module[%s]", [name]),
+		"issueType": "MissingAttribute",
+		"keyExpectedValue": "'block_public_policy' is equal 'true'",
+		"keyActualValue": "'block_public_policy' is missing",
+		"searchLine": common_lib.build_search_line(["module", name], []),
+	}
+}
+
+CxPolicy[result] {
+	module := input.document[i].module[name]
+	keyToCheck := common_lib.get_module_equivalent_key("aws", module.source, "aws_s3_bucket", "block_public_policy")
+	module[keyToCheck] == false
+
+	result := {
+		"documentId": input.document[i].id,
+		"searchKey": sprintf("module[%s].%s", [name, keyToCheck]),
+		"issueType": "IncorrectValue",
+		"keyExpectedValue": "'block_public_policy' is equal 'true'",
+		"keyActualValue": "'block_public_policy' is equal 'false'",
+		"searchLine": common_lib.build_search_line(["module", name, keyToCheck], []),
 	}
 }
diff --git a/...ucket_with_public_policy/test/negative.tf → ...cket_with_public_policy/test/negative1.tf b/...ucket_with_public_policy/test/negative.tf → ...cket_with_public_policy/test/negative1.tf
diff --git a/assets/queries/terraform/aws/s3_bucket_with_public_policy/test/negative2.tf b/assets/queries/terraform/aws/s3_bucket_with_public_policy/test/negative2.tf
@@ -0,0 +1,32 @@
+module "s3_bucket" {
+  source = "terraform-aws-modules/s3-bucket/aws"
+  version = "3.7.0"
+
+  bucket = "my-s3-bucket"
+  acl    = "private"
+  restrict_public_buckets = true
+  block_public_acls = true
+  block_public_policy = true
+
+  versioning = {
+    enabled = true
+  }
+
+  policy = <<POLICY
+{
+  "Version": "2012-10-17",
+  "Id": "MYBUCKETPOLICY",
+  "Statement": [
+    {
+      "Sid": "IPAllow",
+      "Effect": "Deny",
+      "Action": "s3:*",
+      "Resource": "arn:aws:s3:::my_tf_test_bucket/*",
+      "Condition": {
+         "IpAddress": {"aws:SourceIp": "8.8.8.8/32"}
+      }
+    }
+  ]
+}
+POLICY
+}
diff --git a/...ucket_with_public_policy/test/positive.tf → ...cket_with_public_policy/test/positive1.tf b/...ucket_with_public_policy/test/positive.tf → ...cket_with_public_policy/test/positive1.tf
diff --git a/assets/queries/terraform/aws/s3_bucket_with_public_policy/test/positive2.tf b/assets/queries/terraform/aws/s3_bucket_with_public_policy/test/positive2.tf
@@ -0,0 +1,32 @@
+module "s3_bucket" {
+  source = "terraform-aws-modules/s3-bucket/aws"
+  version = "3.7.0"
+
+  bucket = "my-s3-bucket"
+  acl    = "private"
+  restrict_public_buckets = true
+  block_public_acls = true
+  block_public_policy = false
+
+  versioning = {
+    enabled = true
+  }
+
+  policy = <<POLICY
+{
+  "Version": "2012-10-17",
+  "Id": "MYBUCKETPOLICY",
+  "Statement": [
+    {
+      "Sid": "IPAllow",
+      "Effect": "Deny",
+      "Action": "s3:*",
+      "Resource": "arn:aws:s3:::my_tf_test_bucket/*",
+      "Condition": {
+         "IpAddress": {"aws:SourceIp": "8.8.8.8/32"}
+      }
+    }
+  ]
+}
+POLICY
+}
diff --git a/assets/queries/terraform/aws/s3_bucket_with_public_policy/test/positive3.tf b/assets/queries/terraform/aws/s3_bucket_with_public_policy/test/positive3.tf
@@ -0,0 +1,31 @@
+module "s3_bucket" {
+  source = "terraform-aws-modules/s3-bucket/aws"
+  version = "3.7.0"
+
+  bucket = "my-s3-bucket"
+  acl    = "private"
+  restrict_public_buckets = true
+  block_public_acls = true
+
+  versioning = {
+    enabled = true
+  }
+
+  policy = <<POLICY
+{
+  "Version": "2012-10-17",
+  "Id": "MYBUCKETPOLICY",
+  "Statement": [
+    {
+      "Sid": "IPAllow",
+      "Effect": "Deny",
+      "Action": "s3:*",
+      "Resource": "arn:aws:s3:::my_tf_test_bucket/*",
+      "Condition": {
+         "IpAddress": {"aws:SourceIp": "8.8.8.8/32"}
+      }
+    }
+  ]
+}
+POLICY
+}
diff --git a/assets/queries/terraform/aws/s3_bucket_with_public_policy/test/positive_expected_result.json b/assets/queries/terraform/aws/s3_bucket_with_public_policy/test/positive_expected_result.json
@@ -2,11 +2,25 @@
   {
     "queryName": "S3 Bucket Allows Public Policy",
     "severity": "HIGH",
-    "line": 18
+    "line": 18,
+    "filename": "positive1.tf"
   },
   {
     "queryName": "S3 Bucket Allows Public Policy",
     "severity": "HIGH",
-    "line": 9
+    "line": 9,
+    "filename": "positive1.tf"
+  },
+  {
+    "queryName": "S3 Bucket Allows Public Policy",
+    "severity": "HIGH",
+    "line": 1,
+    "filename": "positive3.tf"
+  },
+  {
+    "queryName": "S3 Bucket Allows Public Policy",
+    "severity": "HIGH",
+    "line": 9,
+    "filename": "positive2.tf"
   }
 ]