added "Cloud Storage Bucket Versioning Disabled" (Checkmarx#4593)

patrickjburke245 · Dec 16, 2021 · d5ae6a7 · d5ae6a7
1 parent 867e231
commit d5ae6a7
Show file tree

Hide file tree

Showing 18 changed files with 109 additions and 26 deletions.
diff --git a/...ject_versioning_not_enabled/metadata.json → ..._bucket_versioning_disabled/metadata.json b/...ject_versioning_not_enabled/metadata.json → ..._bucket_versioning_disabled/metadata.json
@@ -1,6 +1,6 @@
 {
   "id": "7814ddda-e758-4a56-8be3-289a81ded929",
-  "queryName": "Object Versioning Not Enabled",
+  "queryName": "Cloud Storage Bucket Versioning Disabled",
   "severity": "HIGH",
   "category": "Observability",
   "descriptionText": "Object Versioning not fully enabled on Cloud Storage Bucket",

diff --git a/.../object_versioning_not_enabled/query.rego → ...age_bucket_versioning_disabled/query.rego b/.../object_versioning_not_enabled/query.rego → ...age_bucket_versioning_disabled/query.rego
diff --git a/...versioning_not_enabled/test/negative.yaml → ...et_versioning_disabled/test/negative.yaml b/...versioning_not_enabled/test/negative.yaml → ...et_versioning_disabled/test/negative.yaml
diff --git a/...versioning_not_enabled/test/positive.yaml → ...et_versioning_disabled/test/positive.yaml b/...versioning_not_enabled/test/positive.yaml → ...et_versioning_disabled/test/positive.yaml
diff --git a/...s/ansible/gcp/cloud_storage_bucket_versioning_disabled/test/positive_expected_result.json b/...s/ansible/gcp/cloud_storage_bucket_versioning_disabled/test/positive_expected_result.json
@@ -0,0 +1,12 @@
+[
+	{
+		"queryName": "Cloud Storage Bucket Versioning Disabled",
+		"severity": "HIGH",
+		"line": 3
+	},
+	{
+		"queryName": "Cloud Storage Bucket Versioning Disabled",
+		"severity": "HIGH",
+		"line": 17
+	}
+]
diff --git a/assets/queries/ansible/gcp/object_versioning_not_enabled/test/positive_expected_result.json b/assets/queries/ansible/gcp/object_versioning_not_enabled/test/positive_expected_result.json
diff --git a/...ts/queries/googleDeploymentManager/cloud_storage_bucket_versioning_disabled/metadata.json b/...ts/queries/googleDeploymentManager/cloud_storage_bucket_versioning_disabled/metadata.json
@@ -0,0 +1,11 @@
+{
+  "id": "ad0875c1-0b39-4890-9149-173158ba3bba",
+  "queryName": "Cloud Storage Bucket Versioning Disabled",
+  "severity": "HIGH",
+  "category": "Observability",
+  "descriptionText": "Cloud Storage Bucket should be enabled",
+  "descriptionUrl": "https://cloud.google.com/storage/docs/json_api/v1/buckets",
+  "platform": "GoogleDeploymentManager",
+  "descriptionID": "9b7ba7de",
+  "cloudProvider": "gcp"
+}
diff --git a/assets/queries/googleDeploymentManager/cloud_storage_bucket_versioning_disabled/query.rego b/assets/queries/googleDeploymentManager/cloud_storage_bucket_versioning_disabled/query.rego
@@ -0,0 +1,36 @@
+package Cx
+
+import data.generic.common as common_lib
+
+CxPolicy[result] {
+	resource := input.document[i].resources[idx]
+	resource.type == "storage.v1.bucket"
+
+	not common_lib.valid_key(resource.properties, "versioning")
+
+	result := {
+		"documentId": input.document[i].id,
+		"searchKey": sprintf("resources.name={{%s}}.properties", [resource.name]),
+		"issueType": "MissingAttribute",
+		"keyExpectedValue": "'versioning' is defined and not null",
+		"keyActualValue": "'versioning' is undefined or null", 
+		"searchLine": common_lib.build_search_line(["resources", idx, "properties"], []),
+	}
+}
+
+CxPolicy[result] {
+	resource := input.document[i].resources[idx]
+	resource.type == "storage.v1.bucket"
+
+	resource.properties.versioning.enabled == false
+
+	result := {
+		"documentId": input.document[i].id,
+		"searchKey": sprintf("resources.name={{%s}}.properties.versioning.enabled", [resource.name]),
+		"issueType": "IncorrectValue",
+		"keyExpectedValue": "'enabled' is set to true",
+		"keyActualValue": "'enabled' is set to false", 
+		"searchLine": common_lib.build_search_line(["resources", idx, "properties", "versioning", "enabled"], []),
+	}
+}
+
diff --git a/...ries/googleDeploymentManager/cloud_storage_bucket_versioning_disabled/test/negative1.yaml b/...ries/googleDeploymentManager/cloud_storage_bucket_versioning_disabled/test/negative1.yaml
@@ -0,0 +1,8 @@
+resources:
+- name: a-new-pubsub-topic3
+  type: storage.v1.bucket
+  properties:
+      storageClass: STANDARD
+      location: EUROPE-WEST3
+      versioning:
+        enabled: true
diff --git a/...ries/googleDeploymentManager/cloud_storage_bucket_versioning_disabled/test/positive1.yaml b/...ries/googleDeploymentManager/cloud_storage_bucket_versioning_disabled/test/positive1.yaml
@@ -0,0 +1,6 @@
+resources:
+- name: a-new-pubsub-topic
+  type: storage.v1.bucket
+  properties:
+      storageClass: STANDARD
+      location: EUROPE-WEST3
diff --git a/...ries/googleDeploymentManager/cloud_storage_bucket_versioning_disabled/test/positive2.yaml b/...ries/googleDeploymentManager/cloud_storage_bucket_versioning_disabled/test/positive2.yaml
@@ -0,0 +1,8 @@
+resources:
+- name: a-new-pubsub-topic2
+  type: storage.v1.bucket
+  properties:
+      storageClass: STANDARD
+      location: EUROPE-WEST3
+      versioning:
+        enabled: false
diff --git a/...oymentManager/cloud_storage_bucket_versioning_disabled/test/positive_expected_result.json b/...oymentManager/cloud_storage_bucket_versioning_disabled/test/positive_expected_result.json
@@ -0,0 +1,14 @@
+[
+  {
+    "queryName": "Cloud Storage Bucket Versioning Disabled",
+    "severity": "HIGH",
+    "line": 4,
+    "filename": "positive1.yaml"
+  },
+  {
+    "queryName": "Cloud Storage Bucket Versioning Disabled",
+    "severity": "HIGH",
+    "line": 8,
+    "filename": "positive2.yaml"
+  }
+]
diff --git a/...ject_versioning_not_enabled/metadata.json → ..._bucket_versioning_disabled/metadata.json b/...ject_versioning_not_enabled/metadata.json → ..._bucket_versioning_disabled/metadata.json
@@ -1,6 +1,6 @@
 {
   "id": "e7e961ac-d17e-4413-84bc-8a1fbe242944",
-  "queryName": "Object Versioning Not Enabled",
+  "queryName": "Cloud Storage Bucket Versioning Disabled",
   "severity": "HIGH",
   "category": "Observability",
   "descriptionText": "Object Versioning Not Enabled on Cloud Storage Bucket",

diff --git a/.../object_versioning_not_enabled/query.rego → ...age_bucket_versioning_disabled/query.rego b/.../object_versioning_not_enabled/query.rego → ...age_bucket_versioning_disabled/query.rego
diff --git a/...t_versioning_not_enabled/test/negative.tf → ...cket_versioning_disabled/test/negative.tf b/...t_versioning_not_enabled/test/negative.tf → ...cket_versioning_disabled/test/negative.tf
diff --git a/...t_versioning_not_enabled/test/positive.tf → ...cket_versioning_disabled/test/positive.tf b/...t_versioning_not_enabled/test/positive.tf → ...cket_versioning_disabled/test/positive.tf
diff --git a/...terraform/gcp/cloud_storage_bucket_versioning_disabled/test/positive_expected_result.json b/...terraform/gcp/cloud_storage_bucket_versioning_disabled/test/positive_expected_result.json
@@ -0,0 +1,12 @@
+[
+	{
+		"queryName": "Cloud Storage Bucket Versioning Disabled",
+		"severity": "HIGH",
+		"line": 6
+	},
+	{
+		"queryName": "Cloud Storage Bucket Versioning Disabled",
+		"severity": "HIGH",
+		"line": 10
+	}
+]
diff --git a/...ts/queries/terraform/gcp/object_versioning_not_enabled/test/positive_expected_result.json b/...ts/queries/terraform/gcp/object_versioning_not_enabled/test/positive_expected_result.json