From bf68486f6a17e992da7319b59efeb37d85f43793 Mon Sep 17 00:00:00 2001 From: cxMiguelSilva Date: Mon, 2 May 2022 10:41:02 +0100 Subject: [PATCH 01/12] Queries severity and category change --- .../metadata.json | 4 ++-- .../test/positive_expected_result.json | 4 ++-- .../metadata.json | 2 +- .../metadata.json | 2 +- .../test/positive_expected_result.json | 2 +- .../aws/sqs_with_sse_disabled/metadata.json | 2 +- .../test/positive_expected_result.json | 8 ++++---- .../metadata.json | 2 +- .../gcp/bigquery_dataset_is_public/metadata.json | 2 +- .../metadata.json | 4 ++-- .../test/positive_expected_result.json | 6 +++--- .../metadata.json | 2 +- .../test/positive_expected_result.json | 8 ++++---- .../metadata.json | 4 ++-- .../test/positive_expected_result.json | 4 ++-- .../metadata.json | 2 +- .../test/positive_expected_result.json | 8 ++++---- .../aws/sqs_with_sse_disabled/metadata.json | 2 +- .../metadata.json | 2 +- .../test/positive_expected_result.json | 8 ++++---- .../shared_host_network_namespace/metadata.json | 2 +- .../bigquery_database_is_public/metadata.json | 2 +- .../metadata.json | 4 ++-- .../test/positive_expected_result.json | 12 ++++++------ .../liveness_probe_is_not_defined/metadata.json | 2 +- .../test/positive_expected_result.json | 2 +- .../metadata.json | 4 ++-- .../test/positive_expected_result.json | 2 +- .../k8s/shared_host_ipc_namespace/metadata.json | 4 ++-- .../test/positive_expected_result.json | 2 +- .../shared_host_network_namespace/metadata.json | 4 ++-- .../test/positive_expected_result.json | 2 +- .../metadata.json | 4 ++-- .../test/positive_expected_result.json | 4 ++-- .../metadata.json | 2 +- .../metadata.json | 2 +- .../metadata.json | 2 +- .../test/positive_expected_result.json | 4 ++-- .../public_lambda_via_api_gateway/metadata.json | 2 +- .../aws/sqs_with_sse_disabled/metadata.json | 4 ++-- .../test/positive_expected_result.json | 14 +++++++------- .../aws/vpc_flowlogs_disabled/metadata.json | 2 +- .../test/positive_expected_result.json | 8 ++++---- .../metadata.json | 2 +- .../metadata.json | 2 +- .../test/positive_expected_result.json | 6 +++--- .../metadata.json | 2 +- .../container_host_ipc_is_true/metadata.json | 4 ++-- .../test/positive_expected_result.json | 2 +- .../liveness_probe_is_not_defined/metadata.json | 2 +- .../test/positive_expected_result.json | 4 ++-- .../metadata.json | 2 +- .../test/positive_expected_result.json | 16 ++++++++-------- .../shared_host_network_namespace/metadata.json | 4 ++-- .../test/positive_expected_result.json | 2 +- 55 files changed, 108 insertions(+), 108 deletions(-) diff --git a/assets/queries/ansible/aws/automatic_minor_upgrades_disabled/metadata.json b/assets/queries/ansible/aws/automatic_minor_upgrades_disabled/metadata.json index 5afdff5250e..a9874aab632 100644 --- a/assets/queries/ansible/aws/automatic_minor_upgrades_disabled/metadata.json +++ b/assets/queries/ansible/aws/automatic_minor_upgrades_disabled/metadata.json @@ -1,8 +1,8 @@ { "id": "857f8808-e96a-4ba8-a9b7-f2d4ec6cad94", "queryName": "Automatic Minor Upgrades Disabled", - "severity": "HIGH", - "category": "Encryption", + "severity": "LOW", + "category": "Best Practices", "descriptionText": "RDS instance auto minor version upgrade feature must be true", "descriptionUrl": "https://docs.ansible.com/ansible/latest/collections/community/aws/rds_instance_module.html#parameter-auto_minor_version_upgrade", "platform": "Ansible", diff --git a/assets/queries/ansible/aws/automatic_minor_upgrades_disabled/test/positive_expected_result.json b/assets/queries/ansible/aws/automatic_minor_upgrades_disabled/test/positive_expected_result.json index adfcd9bacb8..2cff287eee5 100644 --- a/assets/queries/ansible/aws/automatic_minor_upgrades_disabled/test/positive_expected_result.json +++ b/assets/queries/ansible/aws/automatic_minor_upgrades_disabled/test/positive_expected_result.json @@ -1,12 +1,12 @@ [ { "queryName": "Automatic Minor Upgrades Disabled", - "severity": "HIGH", + "severity": "LOW", "line": 10 }, { "queryName": "Automatic Minor Upgrades Disabled", - "severity": "HIGH", + "severity": "LOW", "line": 12 } ] diff --git a/assets/queries/ansible/aws/iam_password_without_uppercase_letter/metadata.json b/assets/queries/ansible/aws/iam_password_without_uppercase_letter/metadata.json index 682cab2b5d4..ccec590b3ee 100644 --- a/assets/queries/ansible/aws/iam_password_without_uppercase_letter/metadata.json +++ b/assets/queries/ansible/aws/iam_password_without_uppercase_letter/metadata.json @@ -2,7 +2,7 @@ "id": "83957b81-39c1-4191-8e12-671d2ce14354", "queryName": "IAM Password Without Uppercase Letter", "severity": "MEDIUM", - "category": "Insecure Configurations", + "category": "Best Practices", "descriptionText": "Check if IAM account password has at least one uppercase letter", "descriptionUrl": "https://docs.ansible.com/ansible/latest/collections/community/aws/iam_password_policy_module.html", "platform": "Ansible", diff --git a/assets/queries/ansible/aws/iam_policy_grants_full_permissions/metadata.json b/assets/queries/ansible/aws/iam_policy_grants_full_permissions/metadata.json index 553a741e719..154394c965a 100644 --- a/assets/queries/ansible/aws/iam_policy_grants_full_permissions/metadata.json +++ b/assets/queries/ansible/aws/iam_policy_grants_full_permissions/metadata.json @@ -1,7 +1,7 @@ { "id": "b5ed026d-a772-4f07-97f9-664ba0b116f8", "queryName": "IAM Policy Grants Full Permissions", - "severity": "MEDIUM", + "severity": "HIGH", "category": "Access Control", "descriptionText": "IAM policies allow all ('*') in a statement action", "descriptionUrl": "https://docs.ansible.com/ansible/latest/collections/community/aws/iam_managed_policy_module.html", diff --git a/assets/queries/ansible/aws/iam_policy_grants_full_permissions/test/positive_expected_result.json b/assets/queries/ansible/aws/iam_policy_grants_full_permissions/test/positive_expected_result.json index 79bb8b5a451..6b957568732 100644 --- a/assets/queries/ansible/aws/iam_policy_grants_full_permissions/test/positive_expected_result.json +++ b/assets/queries/ansible/aws/iam_policy_grants_full_permissions/test/positive_expected_result.json @@ -1,7 +1,7 @@ [ { "queryName": "IAM Policy Grants Full Permissions", - "severity": "MEDIUM", + "severity": "HIGH", "line": 4, "fileName": "positive.yaml" } diff --git a/assets/queries/ansible/aws/sqs_with_sse_disabled/metadata.json b/assets/queries/ansible/aws/sqs_with_sse_disabled/metadata.json index bb45244cf25..050c166f447 100644 --- a/assets/queries/ansible/aws/sqs_with_sse_disabled/metadata.json +++ b/assets/queries/ansible/aws/sqs_with_sse_disabled/metadata.json @@ -1,7 +1,7 @@ { "id": "e1e7b278-2a8b-49bd-a26e-66a7f70b17eb", "queryName": "SQS with SSE disabled", - "severity": "LOW", + "severity": "MEDIUM", "category": "Encryption", "descriptionText": " SQS Queue should be protected with CMK encryption", "descriptionUrl": "https://docs.ansible.com/ansible/latest/collections/community/aws/sqs_queue_module.html#ansible-collections-community-aws-sqs-queue-module", diff --git a/assets/queries/ansible/aws/sqs_with_sse_disabled/test/positive_expected_result.json b/assets/queries/ansible/aws/sqs_with_sse_disabled/test/positive_expected_result.json index 57d614f2f66..824d600f4dc 100644 --- a/assets/queries/ansible/aws/sqs_with_sse_disabled/test/positive_expected_result.json +++ b/assets/queries/ansible/aws/sqs_with_sse_disabled/test/positive_expected_result.json @@ -1,22 +1,22 @@ [ { "queryName": "SQS with SSE disabled", - "severity": "LOW", + "severity": "MEDIUM", "line": 2 }, { "queryName": "SQS with SSE disabled", - "severity": "LOW", + "severity": "MEDIUM", "line": 16 }, { "queryName": "SQS with SSE disabled", - "severity": "LOW", + "severity": "MEDIUM", "line": 22 }, { "queryName": "SQS with SSE disabled", - "severity": "LOW", + "severity": "MEDIUM", "line": 29 } ] diff --git a/assets/queries/ansible/azure/trusted_microsoft_services_not_enabled/metadata.json b/assets/queries/ansible/azure/trusted_microsoft_services_not_enabled/metadata.json index 630185dbff3..362374011ec 100644 --- a/assets/queries/ansible/azure/trusted_microsoft_services_not_enabled/metadata.json +++ b/assets/queries/ansible/azure/trusted_microsoft_services_not_enabled/metadata.json @@ -2,7 +2,7 @@ "id": "1bc398a8-d274-47de-a4c8-6ac867b353de", "queryName": "Trusted Microsoft Services Not Enabled", "severity": "HIGH", - "category": "Access Control", + "category": "Networking and Firewall", "descriptionText": "Ensure Trusted Microsoft Services have Storage Account access.", "descriptionUrl": "https://docs.ansible.com/ansible/latest/collections/azure/azcollection/azure_rm_storageaccount_module.html#parameter-network_acls/bypass", "platform": "Ansible", diff --git a/assets/queries/ansible/gcp/bigquery_dataset_is_public/metadata.json b/assets/queries/ansible/gcp/bigquery_dataset_is_public/metadata.json index 339efbb4320..193bf23956c 100644 --- a/assets/queries/ansible/gcp/bigquery_dataset_is_public/metadata.json +++ b/assets/queries/ansible/gcp/bigquery_dataset_is_public/metadata.json @@ -2,7 +2,7 @@ "id": "2263b286-2fe9-4747-a0ae-8b4768a2bbd2", "queryName": "BigQuery Dataset Is Public", "severity": "HIGH", - "category": "Insecure Configurations", + "category": "Access Control", "descriptionText": "BigQuery dataset is anonymously or publicly accessible", "descriptionUrl": "https://docs.ansible.com/ansible/latest/collections/google/cloud/gcp_bigquery_dataset_module.html#parameter-access/special_group", "platform": "Ansible", diff --git a/assets/queries/ansible/gcp/cloud_storage_anonymous_or_publicly_accessible/metadata.json b/assets/queries/ansible/gcp/cloud_storage_anonymous_or_publicly_accessible/metadata.json index 2b983f5136b..3badc55532d 100644 --- a/assets/queries/ansible/gcp/cloud_storage_anonymous_or_publicly_accessible/metadata.json +++ b/assets/queries/ansible/gcp/cloud_storage_anonymous_or_publicly_accessible/metadata.json @@ -1,8 +1,8 @@ { "id": "086031e1-9d4a-4249-acb3-5bfe4c363db2", "queryName": "Cloud Storage Anonymous or Publicly Accessible", - "severity": "MEDIUM", - "category": "Insecure Configurations", + "severity": "HIGH", + "category": "Access Control", "descriptionText": "Cloud Storage Buckets must not be anonymously or publicly accessible, which means the attribute 'entity' must not be 'allUsers' or 'allAuthenticatedUsers'", "descriptionUrl": "https://docs.ansible.com/ansible/latest/collections/google/cloud/gcp_storage_bucket_module.html", "platform": "Ansible", diff --git a/assets/queries/ansible/gcp/cloud_storage_anonymous_or_publicly_accessible/test/positive_expected_result.json b/assets/queries/ansible/gcp/cloud_storage_anonymous_or_publicly_accessible/test/positive_expected_result.json index c0a7ee92cdd..5f83e4313c4 100644 --- a/assets/queries/ansible/gcp/cloud_storage_anonymous_or_publicly_accessible/test/positive_expected_result.json +++ b/assets/queries/ansible/gcp/cloud_storage_anonymous_or_publicly_accessible/test/positive_expected_result.json @@ -1,17 +1,17 @@ [ { "queryName": "Cloud Storage Anonymous or Publicly Accessible", - "severity": "MEDIUM", + "severity": "HIGH", "line": 11 }, { "queryName": "Cloud Storage Anonymous or Publicly Accessible", - "severity": "MEDIUM", + "severity": "HIGH", "line": 22 }, { "queryName": "Cloud Storage Anonymous or Publicly Accessible", - "severity": "MEDIUM", + "severity": "HIGH", "line": 28 } ] diff --git a/assets/queries/cloudFormation/aws/automatic_minor_upgrades_disabled/metadata.json b/assets/queries/cloudFormation/aws/automatic_minor_upgrades_disabled/metadata.json index 98aebe7e9a7..5900be918cb 100644 --- a/assets/queries/cloudFormation/aws/automatic_minor_upgrades_disabled/metadata.json +++ b/assets/queries/cloudFormation/aws/automatic_minor_upgrades_disabled/metadata.json @@ -1,7 +1,7 @@ { "id": "f0104061-8bfc-4b45-8a7d-630eb502f281", "queryName": "Automatic Minor Upgrades Disabled", - "severity": "MEDIUM", + "severity": "LOW", "category": "Best Practices", "descriptionText": "AWS RDS should have automatic minor upgrades enabled, which means the attribute 'AutoMinorVersionUpgrade' must be set to true.", "descriptionUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-database-instance.html", diff --git a/assets/queries/cloudFormation/aws/automatic_minor_upgrades_disabled/test/positive_expected_result.json b/assets/queries/cloudFormation/aws/automatic_minor_upgrades_disabled/test/positive_expected_result.json index fda325244ea..213647b0431 100644 --- a/assets/queries/cloudFormation/aws/automatic_minor_upgrades_disabled/test/positive_expected_result.json +++ b/assets/queries/cloudFormation/aws/automatic_minor_upgrades_disabled/test/positive_expected_result.json @@ -1,19 +1,19 @@ [ { "queryName": "Automatic Minor Upgrades Disabled", - "severity": "MEDIUM", + "severity": "LOW", "line": 58, "fileName": "positive1.yaml" }, { "queryName": "Automatic Minor Upgrades Disabled", - "severity": "MEDIUM", + "severity": "LOW", "line": 82, "fileName": "positive1.yaml" }, { "queryName": "Automatic Minor Upgrades Disabled", - "severity": "MEDIUM", + "severity": "LOW", "line": 58, "fileName": "positive2.json" }, @@ -21,6 +21,6 @@ "line": 85, "fileName": "positive2.json", "queryName": "Automatic Minor Upgrades Disabled", - "severity": "MEDIUM" + "severity": "LOW" } ] diff --git a/assets/queries/cloudFormation/aws/ec2_subnet_mapping_public_ip_on_launch/metadata.json b/assets/queries/cloudFormation/aws/ec2_subnet_mapping_public_ip_on_launch/metadata.json index 12620f6536d..c15ea4e4409 100644 --- a/assets/queries/cloudFormation/aws/ec2_subnet_mapping_public_ip_on_launch/metadata.json +++ b/assets/queries/cloudFormation/aws/ec2_subnet_mapping_public_ip_on_launch/metadata.json @@ -1,8 +1,8 @@ { "id": "b3de4e4c-14be-4159-b99d-9ad194365e4c", "queryName": "EC2 Instance Has Public IP", - "severity": "MEDIUM", - "category": "Insecure Configurations", + "severity": "HIGH", + "category": "Networking and Firewall", "descriptionText": "EC2 Subnet should not have MapPublicIpOnLaunch set to true", "descriptionUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-subnet.html#cfn-ec2-subnet-mappubliciponlaunch", "platform": "CloudFormation", diff --git a/assets/queries/cloudFormation/aws/ec2_subnet_mapping_public_ip_on_launch/test/positive_expected_result.json b/assets/queries/cloudFormation/aws/ec2_subnet_mapping_public_ip_on_launch/test/positive_expected_result.json index da08f1fbd18..f24025f4a97 100644 --- a/assets/queries/cloudFormation/aws/ec2_subnet_mapping_public_ip_on_launch/test/positive_expected_result.json +++ b/assets/queries/cloudFormation/aws/ec2_subnet_mapping_public_ip_on_launch/test/positive_expected_result.json @@ -1,13 +1,13 @@ [ { "queryName": "EC2 Instance Has Public IP", - "severity": "MEDIUM", + "severity": "HIGH", "line": 7, "fileName": "positive1.yaml" }, { "queryName": "EC2 Instance Has Public IP", - "severity": "MEDIUM", + "severity": "HIGH", "line": 8, "fileName": "positive2.json" } diff --git a/assets/queries/cloudFormation/aws/iam_policy_grants_full_permissions/metadata.json b/assets/queries/cloudFormation/aws/iam_policy_grants_full_permissions/metadata.json index 4ba7fb72d93..2160d46fe37 100644 --- a/assets/queries/cloudFormation/aws/iam_policy_grants_full_permissions/metadata.json +++ b/assets/queries/cloudFormation/aws/iam_policy_grants_full_permissions/metadata.json @@ -1,7 +1,7 @@ { "id": "f62aa827-4ade-4dc4-89e4-1433d384a368", "queryName": "IAM Policy Grants Full Permissions", - "severity": "LOW", + "severity": "HIGH", "category": "Access Control", "descriptionText": "Check if an IAM policy is granting full permissions to resources from the get-go, instead of granting permissions gradually as necessary.", "descriptionUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html", diff --git a/assets/queries/cloudFormation/aws/iam_policy_grants_full_permissions/test/positive_expected_result.json b/assets/queries/cloudFormation/aws/iam_policy_grants_full_permissions/test/positive_expected_result.json index 61416a2d500..6a9932378db 100644 --- a/assets/queries/cloudFormation/aws/iam_policy_grants_full_permissions/test/positive_expected_result.json +++ b/assets/queries/cloudFormation/aws/iam_policy_grants_full_permissions/test/positive_expected_result.json @@ -1,25 +1,25 @@ [ { "queryName": "IAM Policy Grants Full Permissions", - "severity": "LOW", + "severity": "HIGH", "line": 8, "fileName": "positive1.yaml" }, { "queryName": "IAM Policy Grants Full Permissions", - "severity": "LOW", + "severity": "HIGH", "line": 21, "fileName": "positive1.yaml" }, { "queryName": "IAM Policy Grants Full Permissions", - "severity": "LOW", + "severity": "HIGH", "line": 29, "fileName": "positive2.json" }, { "queryName": "IAM Policy Grants Full Permissions", - "severity": "LOW", + "severity": "HIGH", "line": 9, "fileName": "positive2.json" } diff --git a/assets/queries/cloudFormation/aws/sqs_with_sse_disabled/metadata.json b/assets/queries/cloudFormation/aws/sqs_with_sse_disabled/metadata.json index 775ee0262aa..da6063d38eb 100644 --- a/assets/queries/cloudFormation/aws/sqs_with_sse_disabled/metadata.json +++ b/assets/queries/cloudFormation/aws/sqs_with_sse_disabled/metadata.json @@ -2,7 +2,7 @@ "id": "12726829-93ed-4d51-9cbe-13423f4299e1", "queryName": "SQS with SSE disabled", "severity": "MEDIUM", - "category": "Secret Management", + "category": "Encryption", "descriptionText": "AWS SQS Queue should have a KMS Master Key defined", "descriptionUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sqs-queues.html#aws-sqs-queue-kmsmasterkeyid", "platform": "CloudFormation", diff --git a/assets/queries/cloudFormation/aws/unrestricted_security_group_ingress/metadata.json b/assets/queries/cloudFormation/aws/unrestricted_security_group_ingress/metadata.json index 76279352165..ceea247899c 100644 --- a/assets/queries/cloudFormation/aws/unrestricted_security_group_ingress/metadata.json +++ b/assets/queries/cloudFormation/aws/unrestricted_security_group_ingress/metadata.json @@ -1,7 +1,7 @@ { "id": "4a1e6b34-1008-4e61-a5f2-1f7c276f8d14", "queryName": "Unrestricted Security Group Ingress", - "severity": "MEDIUM", + "severity": "HIGH", "category": "Networking and Firewall", "descriptionText": "AWS Security Group Ingress CIDR should not be open to the world", "descriptionUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group-ingress.html", diff --git a/assets/queries/cloudFormation/aws/unrestricted_security_group_ingress/test/positive_expected_result.json b/assets/queries/cloudFormation/aws/unrestricted_security_group_ingress/test/positive_expected_result.json index dbb65cfb40d..21ab80d3e15 100644 --- a/assets/queries/cloudFormation/aws/unrestricted_security_group_ingress/test/positive_expected_result.json +++ b/assets/queries/cloudFormation/aws/unrestricted_security_group_ingress/test/positive_expected_result.json @@ -1,25 +1,25 @@ [ { "queryName": "Unrestricted Security Group Ingress", - "severity": "MEDIUM", + "severity": "HIGH", "line": 8, "fileName": "positive1.yaml" }, { "queryName": "Unrestricted Security Group Ingress", - "severity": "MEDIUM", + "severity": "HIGH", "line": 43, "fileName": "positive1.yaml" }, { "queryName": "Unrestricted Security Group Ingress", - "severity": "MEDIUM", + "severity": "HIGH", "line": 30, "fileName": "positive2.json" }, { "queryName": "Unrestricted Security Group Ingress", - "severity": "MEDIUM", + "severity": "HIGH", "line": 53, "fileName": "positive2.json" } diff --git a/assets/queries/dockerCompose/shared_host_network_namespace/metadata.json b/assets/queries/dockerCompose/shared_host_network_namespace/metadata.json index 6af198029f8..ba01b9c9ed6 100644 --- a/assets/queries/dockerCompose/shared_host_network_namespace/metadata.json +++ b/assets/queries/dockerCompose/shared_host_network_namespace/metadata.json @@ -2,7 +2,7 @@ "id": "071a71ff-f868-47a4-ac0b-3c59e4ab5443", "queryName": "Shared Host Network Namespace", "severity": "MEDIUM", - "category": "Networking and Firewall", + "category": "Resource Management", "descriptionText": "Container should not share the host network namespace", "descriptionUrl": "https://docs.docker.com/compose/compose-file/compose-file-v3/#network_mode", "platform": "DockerCompose", diff --git a/assets/queries/googleDeploymentManager/bigquery_database_is_public/metadata.json b/assets/queries/googleDeploymentManager/bigquery_database_is_public/metadata.json index 797018a47d6..7a7f00c5541 100644 --- a/assets/queries/googleDeploymentManager/bigquery_database_is_public/metadata.json +++ b/assets/queries/googleDeploymentManager/bigquery_database_is_public/metadata.json @@ -2,7 +2,7 @@ "id": "83103dff-d57f-42a8-bd81-40abab64c1a7", "queryName": "BigQuery Dataset Is Public", "severity": "HIGH", - "category": "Insecure Configurations", + "category": "Access Control", "descriptionText": "BigQuery dataset is anonymously or publicly accessible. Attribute access.specialGroup should not contain 'allAuthenticatedUsers'", "descriptionUrl": "https://cloud.google.com/bigquery/docs/reference/rest/v2/datasets", "platform": "GoogleDeploymentManager", diff --git a/assets/queries/googleDeploymentManager/cloud_storage_anonymous_or_publicly_accessible/metadata.json b/assets/queries/googleDeploymentManager/cloud_storage_anonymous_or_publicly_accessible/metadata.json index 9775197a7c7..b7b5d4f3795 100644 --- a/assets/queries/googleDeploymentManager/cloud_storage_anonymous_or_publicly_accessible/metadata.json +++ b/assets/queries/googleDeploymentManager/cloud_storage_anonymous_or_publicly_accessible/metadata.json @@ -1,8 +1,8 @@ { "id": "63ae3638-a38c-4ff4-b616-6e1f72a31a6a", "queryName": "Cloud Storage Anonymous or Publicly Accessible", - "severity": "MEDIUM", - "category": "Insecure Configurations", + "severity": "HIGH", + "category": "Access Control", "descriptionText": "Cloud Storage Buckets must not be anonymously or publicly accessible, which means the subattribute 'entity' from attributes 'acl' and 'defaultObjectAcl' must not be 'allUsers' or 'allAuthenticatedUsers'", "descriptionUrl": "https://cloud.google.com/storage/docs/json_api/v1/buckets", "platform": "GoogleDeploymentManager", diff --git a/assets/queries/googleDeploymentManager/cloud_storage_anonymous_or_publicly_accessible/test/positive_expected_result.json b/assets/queries/googleDeploymentManager/cloud_storage_anonymous_or_publicly_accessible/test/positive_expected_result.json index 0bd4a750ac9..d19507f14cb 100644 --- a/assets/queries/googleDeploymentManager/cloud_storage_anonymous_or_publicly_accessible/test/positive_expected_result.json +++ b/assets/queries/googleDeploymentManager/cloud_storage_anonymous_or_publicly_accessible/test/positive_expected_result.json @@ -1,37 +1,37 @@ [ { "queryName": "Cloud Storage Anonymous or Publicly Accessible", - "severity": "MEDIUM", + "severity": "HIGH", "line": 4, "filename": "positive1.yaml" }, { "queryName": "Cloud Storage Anonymous or Publicly Accessible", - "severity": "MEDIUM", + "severity": "HIGH", "line": 4, "filename": "positive1.yaml" }, { "queryName": "Cloud Storage Anonymous or Publicly Accessible", - "severity": "MEDIUM", + "severity": "HIGH", "line": 7, "filename": "positive2.yaml" }, { "queryName": "Cloud Storage Anonymous or Publicly Accessible", - "severity": "MEDIUM", + "severity": "HIGH", "line": 4, "filename": "positive2.yaml" }, { "queryName": "Cloud Storage Anonymous or Publicly Accessible", - "severity": "MEDIUM", + "severity": "HIGH", "line": 7, "filename": "positive3.yaml" }, { "queryName": "Cloud Storage Anonymous or Publicly Accessible", - "severity": "MEDIUM", + "severity": "HIGH", "line": 10, "filename": "positive3.yaml" } diff --git a/assets/queries/k8s/liveness_probe_is_not_defined/metadata.json b/assets/queries/k8s/liveness_probe_is_not_defined/metadata.json index 0265a5145da..6128452f7f6 100644 --- a/assets/queries/k8s/liveness_probe_is_not_defined/metadata.json +++ b/assets/queries/k8s/liveness_probe_is_not_defined/metadata.json @@ -1,7 +1,7 @@ { "id": "ade74944-a674-4e00-859e-c6eab5bde441", "queryName": "Liveness Probe Is Not Defined", - "severity": "INFO", + "severity": "LOW", "category": "Availability", "descriptionText": "In case of an unresponsive container, a Liveness Probe can help your application become more available since it restarts the container. However, it can lead to cascading failures. Define one if you really need it", "descriptionUrl": "https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#when-should-you-use-a-liveness-probe", diff --git a/assets/queries/k8s/liveness_probe_is_not_defined/test/positive_expected_result.json b/assets/queries/k8s/liveness_probe_is_not_defined/test/positive_expected_result.json index e8ea0253581..dfa40882289 100644 --- a/assets/queries/k8s/liveness_probe_is_not_defined/test/positive_expected_result.json +++ b/assets/queries/k8s/liveness_probe_is_not_defined/test/positive_expected_result.json @@ -1,7 +1,7 @@ [ { "queryName": "Liveness Probe Is Not Defined", - "severity": "INFO", + "severity": "LOW", "line": 9, "fileName": "positive.yaml" } diff --git a/assets/queries/k8s/not_limited_capabilities_for_pod_security_policy/metadata.json b/assets/queries/k8s/not_limited_capabilities_for_pod_security_policy/metadata.json index 285e40a9037..d315ad1396e 100644 --- a/assets/queries/k8s/not_limited_capabilities_for_pod_security_policy/metadata.json +++ b/assets/queries/k8s/not_limited_capabilities_for_pod_security_policy/metadata.json @@ -1,8 +1,8 @@ { "id": "caa93370-791f-4fc6-814b-ba6ce0cb4032", "queryName": "Not Limited Capabilities For Pod Security Policy", - "severity": "MEDIUM", - "category": "Build Process", + "severity": "HIGH", + "category": "Insecure Configurations", "descriptionText": "Limit capabilities for a Pod Security Policy", "descriptionUrl": "https://kubernetes.io/docs/concepts/policy/pod-security-policy/", "platform": "Kubernetes", diff --git a/assets/queries/k8s/not_limited_capabilities_for_pod_security_policy/test/positive_expected_result.json b/assets/queries/k8s/not_limited_capabilities_for_pod_security_policy/test/positive_expected_result.json index 06320748506..559fe8a61fd 100644 --- a/assets/queries/k8s/not_limited_capabilities_for_pod_security_policy/test/positive_expected_result.json +++ b/assets/queries/k8s/not_limited_capabilities_for_pod_security_policy/test/positive_expected_result.json @@ -1,7 +1,7 @@ [ { "queryName": "Not Limited Capabilities For Pod Security Policy", - "severity": "MEDIUM", + "severity": "HIGH", "line": 10 } ] diff --git a/assets/queries/k8s/shared_host_ipc_namespace/metadata.json b/assets/queries/k8s/shared_host_ipc_namespace/metadata.json index 7bb93a2a8b4..7bd0484d7c2 100644 --- a/assets/queries/k8s/shared_host_ipc_namespace/metadata.json +++ b/assets/queries/k8s/shared_host_ipc_namespace/metadata.json @@ -1,8 +1,8 @@ { "id": "cd290efd-6c82-4e9d-a698-be12ae31d536", "queryName": "Shared Host IPC Namespace", - "severity": "HIGH", - "category": "Insecure Configurations", + "severity": "MEDIUM", + "category": "Resource Management", "descriptionText": "Container should not share the host IPC namespace", "descriptionUrl": "https://kubernetes.io/docs/concepts/policy/pod-security-policy/", "platform": "Kubernetes", diff --git a/assets/queries/k8s/shared_host_ipc_namespace/test/positive_expected_result.json b/assets/queries/k8s/shared_host_ipc_namespace/test/positive_expected_result.json index c591fc31c93..7e90d6726e6 100644 --- a/assets/queries/k8s/shared_host_ipc_namespace/test/positive_expected_result.json +++ b/assets/queries/k8s/shared_host_ipc_namespace/test/positive_expected_result.json @@ -1,7 +1,7 @@ [ { "queryName": "Shared Host IPC Namespace", - "severity": "HIGH", + "severity": "MEDIUM", "line": 6 } ] diff --git a/assets/queries/k8s/shared_host_network_namespace/metadata.json b/assets/queries/k8s/shared_host_network_namespace/metadata.json index 9fc833176cc..ebb9c7ab72a 100644 --- a/assets/queries/k8s/shared_host_network_namespace/metadata.json +++ b/assets/queries/k8s/shared_host_network_namespace/metadata.json @@ -1,8 +1,8 @@ { "id": "6b6bdfb3-c3ae-44cb-88e4-7405c1ba2c8a", "queryName": "Shared Host Network Namespace", - "severity": "HIGH", - "category": "Insecure Configurations", + "severity": "MEDIUM", + "category": "Resource Management", "descriptionText": "Container should not share the host network namespace", "descriptionUrl": "https://kubernetes.io/docs/concepts/policy/pod-security-policy/", "platform": "Kubernetes", diff --git a/assets/queries/k8s/shared_host_network_namespace/test/positive_expected_result.json b/assets/queries/k8s/shared_host_network_namespace/test/positive_expected_result.json index ce474dcc981..3b14692026d 100644 --- a/assets/queries/k8s/shared_host_network_namespace/test/positive_expected_result.json +++ b/assets/queries/k8s/shared_host_network_namespace/test/positive_expected_result.json @@ -1,7 +1,7 @@ [ { "queryName": "Shared Host Network Namespace", - "severity": "HIGH", + "severity": "MEDIUM", "line": 6 } ] diff --git a/assets/queries/terraform/aws/automatic_minor_upgrades_disabled/metadata.json b/assets/queries/terraform/aws/automatic_minor_upgrades_disabled/metadata.json index a1de701d137..79f3cf69b76 100644 --- a/assets/queries/terraform/aws/automatic_minor_upgrades_disabled/metadata.json +++ b/assets/queries/terraform/aws/automatic_minor_upgrades_disabled/metadata.json @@ -1,8 +1,8 @@ { "id": "3b6d777b-76e3-4133-80a3-0d6f667ade7f", "queryName": "Automatic Minor Upgrades Disabled", - "severity": "HIGH", - "category": "Encryption", + "severity": "LOW", + "category": "Best Practices", "descriptionText": "RDS Instance Auto Minor Version Upgrade feature in Aws Db Instance must be true", "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#auto_minor_version_upgrade", "platform": "Terraform", diff --git a/assets/queries/terraform/aws/automatic_minor_upgrades_disabled/test/positive_expected_result.json b/assets/queries/terraform/aws/automatic_minor_upgrades_disabled/test/positive_expected_result.json index f5a8e302f31..83ba730529e 100644 --- a/assets/queries/terraform/aws/automatic_minor_upgrades_disabled/test/positive_expected_result.json +++ b/assets/queries/terraform/aws/automatic_minor_upgrades_disabled/test/positive_expected_result.json @@ -1,13 +1,13 @@ [ { "queryName": "Automatic Minor Upgrades Disabled", - "severity": "HIGH", + "severity": "LOW", "line": 13, "fileName": "positive1.tf" }, { "queryName": "Automatic Minor Upgrades Disabled", - "severity": "HIGH", + "severity": "LOW", "line": 11, "fileName": "positive2.tf" } diff --git a/assets/queries/terraform/aws/iam_password_without_lowercase_letter/metadata.json b/assets/queries/terraform/aws/iam_password_without_lowercase_letter/metadata.json index bc67a3ba160..41d997045eb 100644 --- a/assets/queries/terraform/aws/iam_password_without_lowercase_letter/metadata.json +++ b/assets/queries/terraform/aws/iam_password_without_lowercase_letter/metadata.json @@ -2,7 +2,7 @@ "id": "bbc7c137-6c7b-4fc4-984a-0c88e91fcaf9", "queryName": "IAM Password Without Lowercase Letter", "severity": "MEDIUM", - "category": "Insecure Configurations", + "category": "Best Practices", "descriptionText": "Check if IAM account password has at least one lowercase letter", "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy", "platform": "Terraform", diff --git a/assets/queries/terraform/aws/iam_password_without_uppercase_letter/metadata.json b/assets/queries/terraform/aws/iam_password_without_uppercase_letter/metadata.json index 461101009d4..42b502afbc0 100644 --- a/assets/queries/terraform/aws/iam_password_without_uppercase_letter/metadata.json +++ b/assets/queries/terraform/aws/iam_password_without_uppercase_letter/metadata.json @@ -2,7 +2,7 @@ "id": "c5ff7bc9-d8ea-46dd-81cb-8286f3222249", "queryName": "IAM Password Without Uppercase Letter", "severity": "MEDIUM", - "category": "Insecure Configurations", + "category": "Best Practices", "descriptionText": "Check if IAM account password has at least one uppercase letter", "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy", "platform": "Terraform", diff --git a/assets/queries/terraform/aws/iam_policy_grants_full_permissions/metadata.json b/assets/queries/terraform/aws/iam_policy_grants_full_permissions/metadata.json index bc901af9954..7e0cfc14261 100644 --- a/assets/queries/terraform/aws/iam_policy_grants_full_permissions/metadata.json +++ b/assets/queries/terraform/aws/iam_policy_grants_full_permissions/metadata.json @@ -1,7 +1,7 @@ { "id": "575a2155-6af1-4026-b1af-d5bc8fe2a904", "queryName": "IAM Policy Grants Full Permissions", - "severity": "MEDIUM", + "severity": "HIGH", "category": "Access Control", "descriptionText": "IAM policies allow all ('*') in a statement action", "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy", diff --git a/assets/queries/terraform/aws/iam_policy_grants_full_permissions/test/positive_expected_result.json b/assets/queries/terraform/aws/iam_policy_grants_full_permissions/test/positive_expected_result.json index cd193f338b3..f79d9d288ed 100644 --- a/assets/queries/terraform/aws/iam_policy_grants_full_permissions/test/positive_expected_result.json +++ b/assets/queries/terraform/aws/iam_policy_grants_full_permissions/test/positive_expected_result.json @@ -1,13 +1,13 @@ [ { "queryName": "IAM Policy Grants Full Permissions", - "severity": "MEDIUM", + "severity": "HIGH", "line": 20, "fileName": "positive1.tf" }, { "queryName": "IAM Policy Grants Full Permissions", - "severity": "MEDIUM", + "severity": "HIGH", "line": 3, "fileName": "positive2.tf" } diff --git a/assets/queries/terraform/aws/public_lambda_via_api_gateway/metadata.json b/assets/queries/terraform/aws/public_lambda_via_api_gateway/metadata.json index ac1b3509ad6..a6dc778cf4d 100644 --- a/assets/queries/terraform/aws/public_lambda_via_api_gateway/metadata.json +++ b/assets/queries/terraform/aws/public_lambda_via_api_gateway/metadata.json @@ -2,7 +2,7 @@ "id": "3ef8696c-e4ae-4872-92c7-520bb44dfe77", "queryName": "Public Lambda via API Gateway", "severity": "MEDIUM", - "category": "Insecure Configurations", + "category": "Access Control", "descriptionText": "Allowing to run lambda function using public API Gateway", "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission", "platform": "Terraform", diff --git a/assets/queries/terraform/aws/sqs_with_sse_disabled/metadata.json b/assets/queries/terraform/aws/sqs_with_sse_disabled/metadata.json index a72b3f40bce..f8479f348cd 100644 --- a/assets/queries/terraform/aws/sqs_with_sse_disabled/metadata.json +++ b/assets/queries/terraform/aws/sqs_with_sse_disabled/metadata.json @@ -1,8 +1,8 @@ { "id": "6e8849c1-3aa7-40e3-9063-b85ee300f29f", "queryName": "SQS With SSE Disabled", - "severity": "HIGH", - "category": "Insecure Configurations", + "severity": "MEDIUM", + "category": "Encryption", "descriptionText": "Amazon Simple Queue Service (SQS) queue is not protecting the contents of their messages using Server-Side Encryption (SSE)", "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue", "platform": "Terraform", diff --git a/assets/queries/terraform/aws/sqs_with_sse_disabled/test/positive_expected_result.json b/assets/queries/terraform/aws/sqs_with_sse_disabled/test/positive_expected_result.json index 467226fe887..b83429dea8f 100644 --- a/assets/queries/terraform/aws/sqs_with_sse_disabled/test/positive_expected_result.json +++ b/assets/queries/terraform/aws/sqs_with_sse_disabled/test/positive_expected_result.json @@ -1,43 +1,43 @@ [ { "queryName": "SQS With SSE Disabled", - "severity": "HIGH", + "severity": "MEDIUM", "line": 1, "fileName": "positive1.tf" }, { "queryName": "SQS With SSE Disabled", - "severity": "HIGH", + "severity": "MEDIUM", "line": 3, "fileName": "positive2.tf" }, { "queryName": "SQS With SSE Disabled", - "severity": "HIGH", + "severity": "MEDIUM", "line": 1, "fileName": "positive3.tf" }, { "queryName": "SQS With SSE Disabled", - "severity": "HIGH", + "severity": "MEDIUM", "line": 1, "fileName": "positive4.tf" }, { "queryName": "SQS With SSE Disabled", - "severity": "HIGH", + "severity": "MEDIUM", "line": 12, "fileName": "positive5.tf" }, { "queryName": "SQS With SSE Disabled", - "severity": "HIGH", + "severity": "MEDIUM", "line": 1, "fileName": "positive6.tf" }, { "queryName": "SQS With SSE Disabled", - "severity": "HIGH", + "severity": "MEDIUM", "line": 3, "fileName": "positive7.tf" } diff --git a/assets/queries/terraform/aws/vpc_flowlogs_disabled/metadata.json b/assets/queries/terraform/aws/vpc_flowlogs_disabled/metadata.json index d13b0bc3738..002c9ae34ee 100644 --- a/assets/queries/terraform/aws/vpc_flowlogs_disabled/metadata.json +++ b/assets/queries/terraform/aws/vpc_flowlogs_disabled/metadata.json @@ -1,7 +1,7 @@ { "id": "f83121ea-03da-434f-9277-9cd247ab3047", "queryName": "VPC FlowLogs Disabled", - "severity": "MEDIUM", + "severity": "LOW", "category": "Observability", "descriptionText": "Every VPC resource should have an associated Flow Log", "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc", diff --git a/assets/queries/terraform/aws/vpc_flowlogs_disabled/test/positive_expected_result.json b/assets/queries/terraform/aws/vpc_flowlogs_disabled/test/positive_expected_result.json index 55a09bedbfa..375c50ca046 100644 --- a/assets/queries/terraform/aws/vpc_flowlogs_disabled/test/positive_expected_result.json +++ b/assets/queries/terraform/aws/vpc_flowlogs_disabled/test/positive_expected_result.json @@ -1,25 +1,25 @@ [ { "queryName": "VPC FlowLogs Disabled", - "severity": "MEDIUM", + "severity": "LOW", "line": 5, "filename": "positive1.tf" }, { "queryName": "VPC FlowLogs Disabled", - "severity": "MEDIUM", + "severity": "LOW", "line": 1, "filename": "positive2.tf" }, { "queryName": "VPC FlowLogs Disabled", - "severity": "MEDIUM", + "severity": "LOW", "line": 14, "filename": "positive3.tf" }, { "queryName": "VPC FlowLogs Disabled", - "severity": "MEDIUM", + "severity": "LOW", "line": 1, "filename": "positive4.tf" } diff --git a/assets/queries/terraform/azure/trusted_microsoft_services_not_enabled/metadata.json b/assets/queries/terraform/azure/trusted_microsoft_services_not_enabled/metadata.json index f26d000fa8a..2e91730392f 100644 --- a/assets/queries/terraform/azure/trusted_microsoft_services_not_enabled/metadata.json +++ b/assets/queries/terraform/azure/trusted_microsoft_services_not_enabled/metadata.json @@ -2,7 +2,7 @@ "id": "5400f379-a347-4bdd-a032-446465fdcc6f", "queryName": "Trusted Microsoft Services Not Enabled", "severity": "HIGH", - "category": "Insecure Configurations", + "category": "Networking and Firewall", "descriptionText": "Trusted MIcrosoft Services are not enabled for Storage Account access", "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#bypass", "platform": "Terraform", diff --git a/assets/queries/terraform/gcp/cloud_storage_anonymous_or_publicly_accessible/metadata.json b/assets/queries/terraform/gcp/cloud_storage_anonymous_or_publicly_accessible/metadata.json index 8fa60548196..c4427df68cb 100644 --- a/assets/queries/terraform/gcp/cloud_storage_anonymous_or_publicly_accessible/metadata.json +++ b/assets/queries/terraform/gcp/cloud_storage_anonymous_or_publicly_accessible/metadata.json @@ -1,7 +1,7 @@ { "id": "a6cd52a1-3056-4910-96a5-894de9f3f3b3", "queryName": "Cloud Storage Anonymous or Publicly Accessible", - "severity": "MEDIUM", + "severity": "HIGH", "category": "Access Control", "descriptionText": "Cloud Storage Buckets must not be anonymously or publicly accessible, which means the attribute 'members' must not possess 'allUsers' or 'allAuthenticatedUsers'", "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/storage_bucket_iam#google_storage_bucket_iam_binding", diff --git a/assets/queries/terraform/gcp/cloud_storage_anonymous_or_publicly_accessible/test/positive_expected_result.json b/assets/queries/terraform/gcp/cloud_storage_anonymous_or_publicly_accessible/test/positive_expected_result.json index a7328c3f7f4..698a38fd731 100644 --- a/assets/queries/terraform/gcp/cloud_storage_anonymous_or_publicly_accessible/test/positive_expected_result.json +++ b/assets/queries/terraform/gcp/cloud_storage_anonymous_or_publicly_accessible/test/positive_expected_result.json @@ -1,17 +1,17 @@ [ { "queryName": "Cloud Storage Anonymous or Publicly Accessible", - "severity": "MEDIUM", + "severity": "HIGH", "line": 5 }, { "queryName": "Cloud Storage Anonymous or Publicly Accessible", - "severity": "MEDIUM", + "severity": "HIGH", "line": 11 }, { "queryName": "Cloud Storage Anonymous or Publicly Accessible", - "severity": "MEDIUM", + "severity": "HIGH", "line": 17 } ] diff --git a/assets/queries/terraform/gcp/project_wide_ssh_keys_are_enabled_in_vm_instances/metadata.json b/assets/queries/terraform/gcp/project_wide_ssh_keys_are_enabled_in_vm_instances/metadata.json index 72f999e2cdf..c716eb0b5d2 100644 --- a/assets/queries/terraform/gcp/project_wide_ssh_keys_are_enabled_in_vm_instances/metadata.json +++ b/assets/queries/terraform/gcp/project_wide_ssh_keys_are_enabled_in_vm_instances/metadata.json @@ -2,7 +2,7 @@ "id": "3e4d5ce6-3280-4027-8010-c26eeea1ec01", "queryName": "Project-wide SSH Keys Are Enabled In VM Instances", "severity": "MEDIUM", - "category": "Insecure Configurations", + "category": "Secret Management", "descriptionText": "VM Instance should block project-wide SSH keys", "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_instance", "platform": "Terraform", diff --git a/assets/queries/terraform/kubernetes/container_host_ipc_is_true/metadata.json b/assets/queries/terraform/kubernetes/container_host_ipc_is_true/metadata.json index 1975082b158..06a40dc1a25 100644 --- a/assets/queries/terraform/kubernetes/container_host_ipc_is_true/metadata.json +++ b/assets/queries/terraform/kubernetes/container_host_ipc_is_true/metadata.json @@ -1,8 +1,8 @@ { "id": "e94d3121-c2d1-4e34-a295-139bfeb73ea3", "queryName": "Shared Host IPC Namespace", - "severity": "HIGH", - "category": "Insecure Configurations", + "severity": "MEDIUM", + "category": "Resource Management", "descriptionText": "Container should not share the host IPC namespace", "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/pod#host_ipc", "platform": "Terraform", diff --git a/assets/queries/terraform/kubernetes/container_host_ipc_is_true/test/positive_expected_result.json b/assets/queries/terraform/kubernetes/container_host_ipc_is_true/test/positive_expected_result.json index 5e26d485662..31f178f754c 100644 --- a/assets/queries/terraform/kubernetes/container_host_ipc_is_true/test/positive_expected_result.json +++ b/assets/queries/terraform/kubernetes/container_host_ipc_is_true/test/positive_expected_result.json @@ -1,7 +1,7 @@ [ { "queryName": "Shared Host IPC Namespace", - "severity": "HIGH", + "severity": "MEDIUM", "line": 8 } ] diff --git a/assets/queries/terraform/kubernetes/liveness_probe_is_not_defined/metadata.json b/assets/queries/terraform/kubernetes/liveness_probe_is_not_defined/metadata.json index 1db8ae60f8e..106af0a2645 100644 --- a/assets/queries/terraform/kubernetes/liveness_probe_is_not_defined/metadata.json +++ b/assets/queries/terraform/kubernetes/liveness_probe_is_not_defined/metadata.json @@ -1,7 +1,7 @@ { "id": "5b6d53dd-3ba3-4269-b4d7-f82e880e43c3", "queryName": "Liveness Probe Is Not Defined", - "severity": "MEDIUM", + "severity": "LOW", "category": "Availability", "descriptionText": "Liveness Probe must be defined", "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/pod#liveness_probe", diff --git a/assets/queries/terraform/kubernetes/liveness_probe_is_not_defined/test/positive_expected_result.json b/assets/queries/terraform/kubernetes/liveness_probe_is_not_defined/test/positive_expected_result.json index 57083580bdf..077220a49a4 100644 --- a/assets/queries/terraform/kubernetes/liveness_probe_is_not_defined/test/positive_expected_result.json +++ b/assets/queries/terraform/kubernetes/liveness_probe_is_not_defined/test/positive_expected_result.json @@ -1,13 +1,13 @@ [ { "queryName": "Liveness Probe Is Not Defined", - "severity": "MEDIUM", + "severity": "LOW", "line": 7, "fileName": "positive1.tf" }, { "queryName": "Liveness Probe Is Not Defined", - "severity": "MEDIUM", + "severity": "LOW", "line": 27, "fileName": "positive2.tf" } diff --git a/assets/queries/terraform/kubernetes/permissive_access_to_create_pods/metadata.json b/assets/queries/terraform/kubernetes/permissive_access_to_create_pods/metadata.json index 58cf6e26488..691899ef68b 100644 --- a/assets/queries/terraform/kubernetes/permissive_access_to_create_pods/metadata.json +++ b/assets/queries/terraform/kubernetes/permissive_access_to_create_pods/metadata.json @@ -1,7 +1,7 @@ { "id": "522d4a64-4dc9-44bd-9240-7d8a0d5cb5ba", "queryName": "Permissive Access to Create Pods", - "severity": "LOW", + "severity": "MEDIUM", "category": "Access Control", "descriptionText": "The permission to create pods in a cluster should be restricted because it allows privilege escalation.", "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/role#rule", diff --git a/assets/queries/terraform/kubernetes/permissive_access_to_create_pods/test/positive_expected_result.json b/assets/queries/terraform/kubernetes/permissive_access_to_create_pods/test/positive_expected_result.json index 6baad6e9491..4c1936c69ac 100644 --- a/assets/queries/terraform/kubernetes/permissive_access_to_create_pods/test/positive_expected_result.json +++ b/assets/queries/terraform/kubernetes/permissive_access_to_create_pods/test/positive_expected_result.json @@ -1,49 +1,49 @@ [ { "queryName": "Permissive Access to Create Pods", - "severity": "LOW", + "severity": "MEDIUM", "line": 13, "fileName": "positive1.tf" }, { "queryName": "Permissive Access to Create Pods", - "severity": "LOW", + "severity": "MEDIUM", "line": 35, "fileName": "positive1.tf" }, { "queryName": "Permissive Access to Create Pods", - "severity": "LOW", + "severity": "MEDIUM", "line": 51, "fileName": "positive1.tf" }, { "queryName": "Permissive Access to Create Pods", - "severity": "LOW", + "severity": "MEDIUM", "line": 67, "fileName": "positive1.tf" }, { "queryName": "Permissive Access to Create Pods", - "severity": "LOW", + "severity": "MEDIUM", "line": 9, "fileName": "positive2.tf" }, { "queryName": "Permissive Access to Create Pods", - "severity": "LOW", + "severity": "MEDIUM", "line": 21, "fileName": "positive2.tf" }, { "queryName": "Permissive Access to Create Pods", - "severity": "LOW", + "severity": "MEDIUM", "line": 33, "fileName": "positive2.tf" }, { "queryName": "Permissive Access to Create Pods", - "severity": "LOW", + "severity": "MEDIUM", "line": 45, "fileName": "positive2.tf" } diff --git a/assets/queries/terraform/kubernetes/shared_host_network_namespace/metadata.json b/assets/queries/terraform/kubernetes/shared_host_network_namespace/metadata.json index 52bedc9f1c7..5b33ced16ff 100644 --- a/assets/queries/terraform/kubernetes/shared_host_network_namespace/metadata.json +++ b/assets/queries/terraform/kubernetes/shared_host_network_namespace/metadata.json @@ -1,8 +1,8 @@ { "id": "ac1564a3-c324-4747-9fa1-9dfc234dace0", "queryName": "Shared Host Network Namespace", - "severity": "HIGH", - "category": "Insecure Configurations", + "severity": "MEDIUM", + "category": "Resource Management", "descriptionText": "Container should not share the host network namespace", "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/pod#host_network", "platform": "Terraform", diff --git a/assets/queries/terraform/kubernetes/shared_host_network_namespace/test/positive_expected_result.json b/assets/queries/terraform/kubernetes/shared_host_network_namespace/test/positive_expected_result.json index 842df63aa3a..1b6b06fed37 100644 --- a/assets/queries/terraform/kubernetes/shared_host_network_namespace/test/positive_expected_result.json +++ b/assets/queries/terraform/kubernetes/shared_host_network_namespace/test/positive_expected_result.json @@ -1,7 +1,7 @@ [ { "queryName": "Shared Host Network Namespace", - "severity": "HIGH", + "severity": "MEDIUM", "line": 7 } ] From 870712680ba8be077a210cbcfadd99f72293bbcb Mon Sep 17 00:00:00 2001 From: cxMiguelSilva Date: Mon, 2 May 2022 12:17:45 +0100 Subject: [PATCH 02/12] update SNS Topic is Publicly Accessible ansible --- .../metadata.json | 6 +++--- .../query.rego | 10 +++++++--- .../test/negative.yaml | 12 ++++++++++++ .../test/positive.yaml | 12 ++++++++++++ .../test/positive_expected_result.json | 14 ++++++++++++++ .../test/positive_expected_result.json | 12 ------------ 6 files changed, 48 insertions(+), 18 deletions(-) rename assets/queries/ansible/aws/{sns_topic_is_publicly_accessible_for_subscription => sns_topic_is_publicly_accessible}/metadata.json (60%) rename assets/queries/ansible/aws/{sns_topic_is_publicly_accessible_for_subscription => sns_topic_is_publicly_accessible}/query.rego (65%) rename assets/queries/ansible/aws/{sns_topic_is_publicly_accessible_for_subscription => sns_topic_is_publicly_accessible}/test/negative.yaml (78%) rename assets/queries/ansible/aws/{sns_topic_is_publicly_accessible_for_subscription => sns_topic_is_publicly_accessible}/test/positive.yaml (83%) create mode 100644 assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json delete mode 100644 assets/queries/ansible/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive_expected_result.json diff --git a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible_for_subscription/metadata.json b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/metadata.json similarity index 60% rename from assets/queries/ansible/aws/sns_topic_is_publicly_accessible_for_subscription/metadata.json rename to assets/queries/ansible/aws/sns_topic_is_publicly_accessible/metadata.json index 31a4089d189..e6c992dd090 100644 --- a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible_for_subscription/metadata.json +++ b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/metadata.json @@ -1,9 +1,9 @@ { "id": "905f4741-f965-45c1-98db-f7a00a0e5c73", - "queryName": "SNS Topic is Publicly Accessible For Subscription", - "severity": "MEDIUM", + "queryName": "SNS Topic is Publicly Accessible", + "severity": "HIGH", "category": "Access Control", - "descriptionText": "This query checks if SNS Topic is Accessible For Subscription", + "descriptionText": "SNS Topic Policy should not allow any principal to access", "descriptionUrl": "https://docs.ansible.com/ansible/latest/collections/community/aws/sns_topic_module.html", "platform": "Ansible", "descriptionID": "956322cf", diff --git a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible_for_subscription/query.rego b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/query.rego similarity index 65% rename from assets/queries/ansible/aws/sns_topic_is_publicly_accessible_for_subscription/query.rego rename to assets/queries/ansible/aws/sns_topic_is_publicly_accessible/query.rego index 11a7b060bbf..7c02736fd5b 100644 --- a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible_for_subscription/query.rego +++ b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/query.rego @@ -3,17 +3,21 @@ package Cx import data.generic.ansible as ansLib import data.generic.common as common_lib +notValidToken := {"*", ""} + CxPolicy[result] { task := ansLib.tasks[id][t] modules := {"community.aws.sns_topic", "sns_topic"} snsTopicCommunity := task[modules[m]] ansLib.checkState(snsTopicCommunity) - - common_lib.valid_key(snsTopicCommunity, "subscriptions") + policies := snsTopicCommunity.policy + statement := policies.Statement[i] + statement.Effect == "Allow" + statement.Principal == notValidToken[_] result := { "documentId": id, - "searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]), + "searchKey": sprintf("name={{%s}}.{{%s}}.policy", [task.name, modules[m]]), "issueType": "IncorrectValue", "keyExpectedValue": "sns_topic.subscriptions should be undefined", "keyActualValue": "sns_topic.subscriptions is defined", diff --git a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible_for_subscription/test/negative.yaml b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/negative.yaml similarity index 78% rename from assets/queries/ansible/aws/sns_topic_is_publicly_accessible_for_subscription/test/negative.yaml rename to assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/negative.yaml index 45355702f70..66896d730d6 100644 --- a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible_for_subscription/test/negative.yaml +++ b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/negative.yaml @@ -14,6 +14,12 @@ disableSubscriptionOverrides: true defaultThrottlePolicy: maxReceivesPerSecond: 10 + policy: + Version: '2022-05-02' + Statement: + - Effect: Allow + Action: Publish + Principal: NotAll - name: Create alarm SNS topic sns_topic: @@ -31,3 +37,9 @@ disableSubscriptionOverrides: true defaultThrottlePolicy: maxReceivesPerSecond: 10 + policy: + Version: '2022-05-02' + Statement: + - Effect: Allow + Action: Publish + Principal: NotAll diff --git a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive.yaml b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/positive.yaml similarity index 83% rename from assets/queries/ansible/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive.yaml rename to assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/positive.yaml index 26b1d718068..f311594d06f 100644 --- a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive.yaml +++ b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/positive.yaml @@ -20,6 +20,12 @@ protocol: "email" - endpoint: "my_mobile_number" protocol: "sms" + policy: + Version: '2022-05-02' + Statement: + - Effect: Allow + Action: Publish + Principal: '' - name: Create alarm SNS topic sns_topic: @@ -42,3 +48,9 @@ protocol: "email" - endpoint: "my_mobile_number" protocol: "sms" + policy: + Version: '2022-05-02' + Statement: + - Effect: Allow + Action: Publish + Principal: '*' diff --git a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json new file mode 100644 index 00000000000..b3e70fd9b62 --- /dev/null +++ b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json @@ -0,0 +1,14 @@ +[ + { + "queryName": "SNS Topic is Publicly Accessible", + "severity": "HIGH", + "line": 23, + "fileName": "positive.yaml" + }, + { + "queryName": "SNS Topic is Publicly Accessible", + "severity": "HIGH", + "line": 51, + "fileName": "positive.yaml" + } +] diff --git a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive_expected_result.json b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive_expected_result.json deleted file mode 100644 index c3557e0db8f..00000000000 --- a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive_expected_result.json +++ /dev/null @@ -1,12 +0,0 @@ -[ - { - "queryName": "SNS Topic is Publicly Accessible For Subscription", - "severity": "MEDIUM", - "line": 3 - }, - { - "queryName": "SNS Topic is Publicly Accessible For Subscription", - "severity": "MEDIUM", - "line": 25 - } -] From 2f11c12236c0613ba1cd45ff5b7a28491b98b03b Mon Sep 17 00:00:00 2001 From: cxMiguelSilva Date: Mon, 2 May 2022 12:53:39 +0100 Subject: [PATCH 03/12] update SNS Topic is Publicly Accessible for cF --- .../metadata.json | 6 ++-- .../query.rego | 25 ++++++++++++++++ .../test/negative1.yaml | 15 ++++++++++ .../test/negative2.json | 23 ++++++++++++++ .../test/positive1.yaml | 15 ++++++++++ .../test/positive2.yaml | 15 ++++++++++ .../test/positive3.json | 23 ++++++++++++++ .../test/positive4.json | 23 ++++++++++++++ .../test/positive_expected_result.json | 26 ++++++++++++++++ .../query.rego | 30 ------------------- .../test/negative1.yaml | 10 ------- .../test/negative2.json | 18 ----------- .../test/negative3.json | 25 ---------------- .../test/negative4.yaml | 13 -------- .../test/positive1.yaml | 7 ----- .../test/positive2.json | 12 -------- .../test/positive_expected_result.json | 14 --------- 17 files changed, 168 insertions(+), 132 deletions(-) rename assets/queries/cloudFormation/aws/{sns_topic_is_publicly_accessible_for_subscription => sns_topic_is_publicly_accessible}/metadata.json (74%) create mode 100644 assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/query.rego create mode 100644 assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/negative1.yaml create mode 100644 assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/negative2.json create mode 100644 assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive1.yaml create mode 100644 assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive2.yaml create mode 100644 assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive3.json create mode 100644 assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive4.json create mode 100644 assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json delete mode 100644 assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/query.rego delete mode 100644 assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/negative1.yaml delete mode 100644 assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/negative2.json delete mode 100644 assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/negative3.json delete mode 100644 assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/negative4.yaml delete mode 100644 assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive1.yaml delete mode 100644 assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive2.json delete mode 100644 assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive_expected_result.json diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/metadata.json b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/metadata.json similarity index 74% rename from assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/metadata.json rename to assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/metadata.json index cb89b3e157e..4ebbbedf23a 100644 --- a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/metadata.json +++ b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/metadata.json @@ -1,8 +1,8 @@ { "id": "ae53ce91-42b5-46bf-a84f-9a13366a4f13", - "queryName": "SNS Topic is Publicly Accessible For Subscription", - "severity": "LOW", - "category": "Observability", + "queryName": "SNS Topic is Publicly Accessible", + "severity": "HIGH", + "category": "Access Control", "descriptionText": "Ensure appropriate subscribers to each SNS topic", "descriptionUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sns-topic.html#cfn-sns-topic-subscription", "platform": "CloudFormation", diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/query.rego b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/query.rego new file mode 100644 index 00000000000..d1a638406e4 --- /dev/null +++ b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/query.rego @@ -0,0 +1,25 @@ +package Cx + +import data.generic.common as common_lib + +notValidTokens := {"*",""} + +CxPolicy[result] { + resource := input.document[i].Resources[name] + resource.Type == "AWS::SNS::TopicPolicy" + + policy := resource.Properties.PolicyDocument + st := common_lib.get_statement(common_lib.get_policy(policy)) + statement := st[_] + common_lib.is_allow_effect(statement) + common_lib.equalsOrInArray(statement.Principal, notValidTokens[_]) + + result := { + "documentId": input.document[i].id, + "searchKey": sprintf("Resources.%s.Properties", [name]), + "issueType": "IncorrectValue", + "keyExpectedValue": sprintf("Resources.%s.Properties.PolicyDocument.Statement does not allow all actions from all principals", [name]), + "keyActualValue": sprintf("Resources.%s.Properties.PolicyDocument.Statement allows all actions from all principals", [name]), + "searchLine": common_lib.build_search_line(["Resource", name, "Properties", "PolicyDocument"], []), + } +} diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/negative1.yaml b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/negative1.yaml new file mode 100644 index 00000000000..7d52a35e034 --- /dev/null +++ b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/negative1.yaml @@ -0,0 +1,15 @@ +AWSTemplateFormatVersion: '2010-09-09' +Description: '' +Resources: + snsPolicy: + Type: AWS::SNS::TopicPolicy + Properties: + PolicyDocument: + Statement: [ + { + "Sid": "MyTopicPolicy", + "Effect": "Allow", + "Principal": "otherPrincipal", + "Action": ["sns:Publish"], + "Resource": "arn:aws:sns:MyTopic" + }] diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/negative2.json b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/negative2.json new file mode 100644 index 00000000000..bfe8a4e5574 --- /dev/null +++ b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/negative2.json @@ -0,0 +1,23 @@ +{ + "AWSTemplateFormatVersion": "2010-09-09", + "Description": "", + "Resources": { + "mysnspolicy0" : { + "Type" : "AWS::SNS::TopicPolicy", + "Properties" : { + "PolicyDocument" : { + "Id" : "MyTopicPolicy", + "Version" : "2012-10-17", + "Statement" : [ { + "Sid" : "My-statement-id", + "Effect" : "Allow", + "Principal" : "otherPrincipal", + "Action" : "sns:Publish", + "Resource" : "*" + } ] + }, + "Topics" : [ { "Ref" : "MySNSTopic" } ] + } + } + } +} diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive1.yaml b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive1.yaml new file mode 100644 index 00000000000..a510b7e14f7 --- /dev/null +++ b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive1.yaml @@ -0,0 +1,15 @@ +AWSTemplateFormatVersion: '2010-09-09' +Description: '' +Resources: + snsPolicy: + Type: AWS::SNS::TopicPolicy + Properties: + PolicyDocument: + Statement: [ + { + "Sid": "MyTopicPolicy", + "Effect": "Allow", + "Principal": "*", + "Action": ["sns:Publish"], + "Resource": "arn:aws:sns:MyTopic" + }] diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive2.yaml b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive2.yaml new file mode 100644 index 00000000000..f5bbe1d0c1e --- /dev/null +++ b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive2.yaml @@ -0,0 +1,15 @@ +AWSTemplateFormatVersion: '2010-09-09' +Description: '' +Resources: + snsPolicy: + Type: AWS::SNS::TopicPolicy + Properties: + PolicyDocument: + Statement: [ + { + "Sid": "MyTopicPolicy", + "Effect": "Allow", + "Principal": "", + "Action": ["sns:Publish"], + "Resource": "arn:aws:sns:MyTopic" + }] diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive3.json b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive3.json new file mode 100644 index 00000000000..09a388d6bbd --- /dev/null +++ b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive3.json @@ -0,0 +1,23 @@ +{ + "AWSTemplateFormatVersion": "2010-09-09", + "Description": "", + "Resources": { + "mysnspolicy0" : { + "Type" : "AWS::SNS::TopicPolicy", + "Properties" : { + "PolicyDocument" : { + "Id" : "MyTopicPolicy", + "Version" : "2012-10-17", + "Statement" : [ { + "Sid" : "My-statement-id", + "Effect" : "Allow", + "Principal" : "*", + "Action" : "sns:Publish", + "Resource" : "*" + } ] + }, + "Topics" : [ { "Ref" : "MySNSTopic" } ] + } + } + } +} diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive4.json b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive4.json new file mode 100644 index 00000000000..fca94b18529 --- /dev/null +++ b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive4.json @@ -0,0 +1,23 @@ +{ + "AWSTemplateFormatVersion": "2010-09-09", + "Description": "", + "Resources": { + "mysnspolicy0" : { + "Type" : "AWS::SNS::TopicPolicy", + "Properties" : { + "PolicyDocument" : { + "Id" : "MyTopicPolicy", + "Version" : "2012-10-17", + "Statement" : [ { + "Sid" : "My-statement-id", + "Effect" : "Allow", + "Principal" : "", + "Action" : "sns:Publish", + "Resource" : "*" + } ] + }, + "Topics" : [ { "Ref" : "MySNSTopic" } ] + } + } + } +} diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json new file mode 100644 index 00000000000..bd3aa88a9cb --- /dev/null +++ b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json @@ -0,0 +1,26 @@ +[ + { + "line": 6, + "fileName": "positive1.yaml", + "queryName": "SNS Topic is Publicly Accessible", + "severity": "HIGH" + }, + { + "queryName": "SNS Topic is Publicly Accessible", + "severity": "HIGH", + "line": 6, + "fileName": "positive2.yaml" + }, + { + "queryName": "SNS Topic is Publicly Accessible", + "severity": "HIGH", + "line": 7, + "fileName": "positive3.json" + }, + { + "queryName": "SNS Topic is Publicly Accessible", + "severity": "HIGH", + "line": 7, + "fileName": "positive4.json" + } +] diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/query.rego b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/query.rego deleted file mode 100644 index d29aa4cb9cc..00000000000 --- a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/query.rego +++ /dev/null @@ -1,30 +0,0 @@ -package Cx - -CxPolicy[result] { - resourceSNS := input.document[i].Resources - some nameSNS - resourceSNS[nameSNS].Type == "AWS::SNS::Topic" - - not resourceSNS[nameSNS].Properties.Subscription - not has_aws_SNS_Sub(input,nameSNS) - - result := { - "documentId": input.document[i].id, - "searchKey": sprintf("Resources.%s.Properties", [nameSNS]), - "issueType": "MissingAttribute", - "keyExpectedValue": sprintf("'Resources.%s.Properties.Subscription' is set", [nameSNS]), - "keyActualValue": sprintf("'Resources.%s.Properties.Subscription' is not set", [nameSNS]), - } -} - -has_aws_SNS_Sub(input_document, name_SNS){ - resourceSNS := input_document.document[i].Resources - resourceSNS[j].Type == "AWS::SNS::Subscription" - topic := get_topic(resourceSNS[j].Properties.TopicArn) - topic == name_SNS -} -get_topic(topicArn) = topic { - topic := topicArn.Ref -} else = topic { - topic := topicArn -} diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/negative1.yaml b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/negative1.yaml deleted file mode 100644 index 8f0815d0b95..00000000000 --- a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/negative1.yaml +++ /dev/null @@ -1,10 +0,0 @@ -AWSTemplateFormatVersion: '2010-09-09' -Description: '' -Resources: - SnsTopic: - Type: 'AWS::SNS::Topic' - Properties: - Subscription: - - Endpoint: email@example.com - Protocol: email - TopicName: alarm-action diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/negative2.json b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/negative2.json deleted file mode 100644 index e3791861936..00000000000 --- a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/negative2.json +++ /dev/null @@ -1,18 +0,0 @@ -{ - "AWSTemplateFormatVersion": "2010-09-09", - "Description": "", - "Resources": { - "SnsTopic": { - "Type": "AWS::SNS::Topic", - "Properties": { - "Subscription": [ - { - "Endpoint": "email@example.com", - "Protocol": "email" - } - ], - "TopicName": "alarm-action" - } - } - } -} diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/negative3.json b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/negative3.json deleted file mode 100644 index 0b2f7a2b6c1..00000000000 --- a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/negative3.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "AWSTemplateFormatVersion": "2010-09-09", - "Description": "", - "Resources": { - "mytopicF1111A24": { - "Type": "AWS::SNS::Topic", - "Properties": { - "TopicName": "mytopic" - } - }, - "mytopictestexamplecomCB22222C3": { - "Type": "AWS::SNS::Subscription", - "Properties": { - "Protocol": "email", - "TopicArn": { - "Ref": "mytopicF1111A24" - }, - "Endpoint": "test@example.com" - }, - "Metadata": { - "aws:cdk:path": "stack-test/mytopic/test@example.com/Resource" - } - } - } -} diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/negative4.yaml b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/negative4.yaml deleted file mode 100644 index 91752b78419..00000000000 --- a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/negative4.yaml +++ /dev/null @@ -1,13 +0,0 @@ -AWSTemplateFormatVersion: '2010-09-09' -Description: '' -Resources: - MySNSTopic: - Type: AWS::SNS::Topic - Properties: - TopicName: createProductTopic - MySubscription: - Type: AWS::SNS::Subscription - Properties: - Endpoint: test@example.com - Protocol: email - TopicArn: !Ref MySNSTopic diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive1.yaml b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive1.yaml deleted file mode 100644 index 8ed601d8e91..00000000000 --- a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive1.yaml +++ /dev/null @@ -1,7 +0,0 @@ -AWSTemplateFormatVersion: '2010-09-09' -Description: '' -Resources: - SnsTopic: - Type: 'AWS::SNS::Topic' - Properties: - TopicName: alarm-action diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive2.json b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive2.json deleted file mode 100644 index 44c3ff1258d..00000000000 --- a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive2.json +++ /dev/null @@ -1,12 +0,0 @@ -{ - "Resources": { - "SnsTopic": { - "Type": "AWS::SNS::Topic", - "Properties": { - "TopicName": "alarm-action" - } - } - }, - "AWSTemplateFormatVersion": "2010-09-09", - "Description": "" -} diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive_expected_result.json b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive_expected_result.json deleted file mode 100644 index b8b2af86c73..00000000000 --- a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive_expected_result.json +++ /dev/null @@ -1,14 +0,0 @@ -[ - { - "line": 6, - "fileName": "positive1.yaml", - "queryName": "SNS Topic is Publicly Accessible For Subscription", - "severity": "LOW" - }, - { - "queryName": "SNS Topic is Publicly Accessible For Subscription", - "severity": "LOW", - "line": 5, - "fileName": "positive2.json" - } -] From d95c0e07c39304399fb037ae7b89d515b6348c39 Mon Sep 17 00:00:00 2001 From: cxMiguelSilva Date: Mon, 2 May 2022 12:57:19 +0100 Subject: [PATCH 04/12] update SNS Topic is Publicly Accessible ansible --- .../ansible/aws/sns_topic_is_publicly_accessible/query.rego | 1 + 1 file changed, 1 insertion(+) diff --git a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/query.rego b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/query.rego index 7c02736fd5b..61f1fe3a28b 100644 --- a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/query.rego +++ b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/query.rego @@ -21,5 +21,6 @@ CxPolicy[result] { "issueType": "IncorrectValue", "keyExpectedValue": "sns_topic.subscriptions should be undefined", "keyActualValue": "sns_topic.subscriptions is defined", + "searchLine": common_lib.build_search_line(["playbooks", t, modules[m], "policy"], []), } } From 1221d017cb61947397ebd6cfc3fda302aeca6722 Mon Sep 17 00:00:00 2001 From: cxMiguelSilva Date: Mon, 2 May 2022 13:02:36 +0100 Subject: [PATCH 05/12] update description --- .../aws/sns_topic_is_publicly_accessible/metadata.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/metadata.json b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/metadata.json index 4ebbbedf23a..c70082b9eda 100644 --- a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/metadata.json +++ b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/metadata.json @@ -3,8 +3,8 @@ "queryName": "SNS Topic is Publicly Accessible", "severity": "HIGH", "category": "Access Control", - "descriptionText": "Ensure appropriate subscribers to each SNS topic", - "descriptionUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sns-topic.html#cfn-sns-topic-subscription", + "descriptionText": "SNS Topic Policy should not allow any principal to access", + "descriptionUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sns-policy.html", "platform": "CloudFormation", "descriptionID": "93100b84", "cloudProvider": "aws" From e26d5514722b423f66c3c45e6b59458858a6bf4c Mon Sep 17 00:00:00 2001 From: cxMiguelSilva Date: Mon, 2 May 2022 15:00:49 +0100 Subject: [PATCH 06/12] change any principal check --- .../query.rego | 8 +++---- .../test/positive.yaml | 2 +- .../query.rego | 14 +++++------ .../test/{positive3.json => positive2.json} | 0 .../test/positive2.yaml | 15 ------------ .../test/positive4.json | 23 ------------------- .../test/positive_expected_result.json | 18 +++------------ .../metadata.json | 6 ++--- .../query.rego | 0 .../test/negative.tf | 0 .../test/positive.tf | 0 .../test/positive_expected_result.json | 7 ++++++ .../test/positive_expected_result.json | 7 ------ 13 files changed, 23 insertions(+), 77 deletions(-) rename assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/{positive3.json => positive2.json} (100%) delete mode 100644 assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive2.yaml delete mode 100644 assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive4.json rename assets/queries/terraform/aws/{sns_topic_is_publicly_accessible_for_subscription => sns_topic_is_publicly_accessible}/metadata.json (60%) rename assets/queries/terraform/aws/{sns_topic_is_publicly_accessible_for_subscription => sns_topic_is_publicly_accessible}/query.rego (100%) rename assets/queries/terraform/aws/{sns_topic_is_publicly_accessible_for_subscription => sns_topic_is_publicly_accessible}/test/negative.tf (100%) rename assets/queries/terraform/aws/{sns_topic_is_publicly_accessible_for_subscription => sns_topic_is_publicly_accessible}/test/positive.tf (100%) create mode 100644 assets/queries/terraform/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json delete mode 100644 assets/queries/terraform/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive_expected_result.json diff --git a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/query.rego b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/query.rego index 61f1fe3a28b..b8dbbe32c50 100644 --- a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/query.rego +++ b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/query.rego @@ -3,8 +3,6 @@ package Cx import data.generic.ansible as ansLib import data.generic.common as common_lib -notValidToken := {"*", ""} - CxPolicy[result] { task := ansLib.tasks[id][t] modules := {"community.aws.sns_topic", "sns_topic"} @@ -13,14 +11,14 @@ CxPolicy[result] { policies := snsTopicCommunity.policy statement := policies.Statement[i] statement.Effect == "Allow" - statement.Principal == notValidToken[_] + common_lib.any_principal(statement) result := { "documentId": id, "searchKey": sprintf("name={{%s}}.{{%s}}.policy", [task.name, modules[m]]), "issueType": "IncorrectValue", - "keyExpectedValue": "sns_topic.subscriptions should be undefined", - "keyActualValue": "sns_topic.subscriptions is defined", + "keyExpectedValue": "sns_topic.policy does not allow actions from all principals", + "keyActualValue": "sns_topic.policy allows actions from all principals", "searchLine": common_lib.build_search_line(["playbooks", t, modules[m], "policy"], []), } } diff --git a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/positive.yaml b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/positive.yaml index f311594d06f..c92b932f18e 100644 --- a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/positive.yaml +++ b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/positive.yaml @@ -25,7 +25,7 @@ Statement: - Effect: Allow Action: Publish - Principal: '' + Principal: '*' - name: Create alarm SNS topic sns_topic: diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/query.rego b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/query.rego index d1a638406e4..9ef2fcab3ca 100644 --- a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/query.rego +++ b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/query.rego @@ -2,24 +2,22 @@ package Cx import data.generic.common as common_lib -notValidTokens := {"*",""} - CxPolicy[result] { resource := input.document[i].Resources[name] resource.Type == "AWS::SNS::TopicPolicy" policy := resource.Properties.PolicyDocument st := common_lib.get_statement(common_lib.get_policy(policy)) - statement := st[_] + statement := st[j] common_lib.is_allow_effect(statement) - common_lib.equalsOrInArray(statement.Principal, notValidTokens[_]) + common_lib.any_principal(statement) result := { "documentId": input.document[i].id, - "searchKey": sprintf("Resources.%s.Properties", [name]), + "searchKey": sprintf("Resources.%s.Properties.PolicyDocument.Statement", [name]), "issueType": "IncorrectValue", - "keyExpectedValue": sprintf("Resources.%s.Properties.PolicyDocument.Statement does not allow all actions from all principals", [name]), - "keyActualValue": sprintf("Resources.%s.Properties.PolicyDocument.Statement allows all actions from all principals", [name]), - "searchLine": common_lib.build_search_line(["Resource", name, "Properties", "PolicyDocument"], []), + "keyExpectedValue": sprintf("Resources.%s.Properties.PolicyDocument.Statement does not allow actions from all principals", [name]), + "keyActualValue": sprintf("Resources.%s.Properties.PolicyDocument.Statement allows actions from all principals", [name]), + "searchLine": common_lib.build_search_line(["Resource", name, "Properties", "PolicyDocument","Statement"], []), } } diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive3.json b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive2.json similarity index 100% rename from assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive3.json rename to assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive2.json diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive2.yaml b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive2.yaml deleted file mode 100644 index f5bbe1d0c1e..00000000000 --- a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive2.yaml +++ /dev/null @@ -1,15 +0,0 @@ -AWSTemplateFormatVersion: '2010-09-09' -Description: '' -Resources: - snsPolicy: - Type: AWS::SNS::TopicPolicy - Properties: - PolicyDocument: - Statement: [ - { - "Sid": "MyTopicPolicy", - "Effect": "Allow", - "Principal": "", - "Action": ["sns:Publish"], - "Resource": "arn:aws:sns:MyTopic" - }] diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive4.json b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive4.json deleted file mode 100644 index fca94b18529..00000000000 --- a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive4.json +++ /dev/null @@ -1,23 +0,0 @@ -{ - "AWSTemplateFormatVersion": "2010-09-09", - "Description": "", - "Resources": { - "mysnspolicy0" : { - "Type" : "AWS::SNS::TopicPolicy", - "Properties" : { - "PolicyDocument" : { - "Id" : "MyTopicPolicy", - "Version" : "2012-10-17", - "Statement" : [ { - "Sid" : "My-statement-id", - "Effect" : "Allow", - "Principal" : "", - "Action" : "sns:Publish", - "Resource" : "*" - } ] - }, - "Topics" : [ { "Ref" : "MySNSTopic" } ] - } - } - } -} diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json index bd3aa88a9cb..48ad320bbae 100644 --- a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json +++ b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json @@ -1,6 +1,6 @@ [ { - "line": 6, + "line": 8, "fileName": "positive1.yaml", "queryName": "SNS Topic is Publicly Accessible", "severity": "HIGH" @@ -8,19 +8,7 @@ { "queryName": "SNS Topic is Publicly Accessible", "severity": "HIGH", - "line": 6, - "fileName": "positive2.yaml" - }, - { - "queryName": "SNS Topic is Publicly Accessible", - "severity": "HIGH", - "line": 7, - "fileName": "positive3.json" - }, - { - "queryName": "SNS Topic is Publicly Accessible", - "severity": "HIGH", - "line": 7, - "fileName": "positive4.json" + "line": 11, + "fileName": "positive2.json" } ] diff --git a/assets/queries/terraform/aws/sns_topic_is_publicly_accessible_for_subscription/metadata.json b/assets/queries/terraform/aws/sns_topic_is_publicly_accessible/metadata.json similarity index 60% rename from assets/queries/terraform/aws/sns_topic_is_publicly_accessible_for_subscription/metadata.json rename to assets/queries/terraform/aws/sns_topic_is_publicly_accessible/metadata.json index eec72306c86..c18c59ef855 100644 --- a/assets/queries/terraform/aws/sns_topic_is_publicly_accessible_for_subscription/metadata.json +++ b/assets/queries/terraform/aws/sns_topic_is_publicly_accessible/metadata.json @@ -1,9 +1,9 @@ { "id": "b26d2b7e-60f6-413d-a3a1-a57db24aa2b3", - "queryName": "SNS Topic is Publicly Accessible For Subscription", - "severity": "MEDIUM", + "queryName": "SNS Topic is Publicly Accessible", + "severity": "HIGH", "category": "Access Control", - "descriptionText": "This query checks if SNS Topic is Accessible For Subscription", + "descriptionText": "SNS Topic Policy should not allow any principal to access", "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic", "platform": "Terraform", "descriptionID": "52e85de5", diff --git a/assets/queries/terraform/aws/sns_topic_is_publicly_accessible_for_subscription/query.rego b/assets/queries/terraform/aws/sns_topic_is_publicly_accessible/query.rego similarity index 100% rename from assets/queries/terraform/aws/sns_topic_is_publicly_accessible_for_subscription/query.rego rename to assets/queries/terraform/aws/sns_topic_is_publicly_accessible/query.rego diff --git a/assets/queries/terraform/aws/sns_topic_is_publicly_accessible_for_subscription/test/negative.tf b/assets/queries/terraform/aws/sns_topic_is_publicly_accessible/test/negative.tf similarity index 100% rename from assets/queries/terraform/aws/sns_topic_is_publicly_accessible_for_subscription/test/negative.tf rename to assets/queries/terraform/aws/sns_topic_is_publicly_accessible/test/negative.tf diff --git a/assets/queries/terraform/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive.tf b/assets/queries/terraform/aws/sns_topic_is_publicly_accessible/test/positive.tf similarity index 100% rename from assets/queries/terraform/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive.tf rename to assets/queries/terraform/aws/sns_topic_is_publicly_accessible/test/positive.tf diff --git a/assets/queries/terraform/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json b/assets/queries/terraform/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json new file mode 100644 index 00000000000..2991efdbc11 --- /dev/null +++ b/assets/queries/terraform/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json @@ -0,0 +1,7 @@ +[ + { + "queryName": "SNS Topic is Publicly Accessible", + "severity": "HIGH", + "line": 2 + } +] diff --git a/assets/queries/terraform/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive_expected_result.json b/assets/queries/terraform/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive_expected_result.json deleted file mode 100644 index 228b497eedf..00000000000 --- a/assets/queries/terraform/aws/sns_topic_is_publicly_accessible_for_subscription/test/positive_expected_result.json +++ /dev/null @@ -1,7 +0,0 @@ -[ - { - "queryName": "SNS Topic is Publicly Accessible For Subscription", - "severity": "MEDIUM", - "line": 2 - } -] From 8b98109e1f8a355298af0874e6a2124e56886a93 Mon Sep 17 00:00:00 2001 From: cxMiguelSilva Date: Mon, 2 May 2022 15:17:11 +0100 Subject: [PATCH 07/12] update CloudTrail Log Files Not Encrypted With CMK --- .../test/positive_expected_result.json | 7 ------- .../metadata.json | 4 ++-- .../query.rego | 0 .../test/negative.yaml | 0 .../test/positive.yaml | 0 .../test/positive_expected_result.json | 7 +++++++ .../test/positive_expected_result.json | 14 -------------- .../metadata.json | 4 ++-- .../query.rego | 0 .../test/negative1.yaml | 0 .../test/negative2.json | 0 .../test/positive1.yaml | 0 .../test/positive2.json | 0 .../test/positive_expected_result.json | 14 ++++++++++++++ .../test/positive_expected_result.json | 7 ------- .../metadata.json | 4 ++-- .../query.rego | 0 .../test/negative.tf | 0 .../test/positive.tf | 0 .../test/positive_expected_result.json | 7 +++++++ 20 files changed, 34 insertions(+), 34 deletions(-) delete mode 100644 assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted/test/positive_expected_result.json rename assets/queries/ansible/aws/{cloudtrail_log_files_not_encrypted => cloudtrail_log_files_not_encrypted_with_cmk}/metadata.json (81%) rename assets/queries/ansible/aws/{cloudtrail_log_files_not_encrypted => cloudtrail_log_files_not_encrypted_with_cmk}/query.rego (100%) rename assets/queries/ansible/aws/{cloudtrail_log_files_not_encrypted => cloudtrail_log_files_not_encrypted_with_cmk}/test/negative.yaml (100%) rename assets/queries/ansible/aws/{cloudtrail_log_files_not_encrypted => cloudtrail_log_files_not_encrypted_with_cmk}/test/positive.yaml (100%) create mode 100644 assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/positive_expected_result.json delete mode 100644 assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted/test/positive_expected_result.json rename assets/queries/cloudFormation/aws/{cloudtrail_log_files_not_encrypted => cloudtrail_log_files_not_encrypted_with_cmk}/metadata.json (82%) rename assets/queries/cloudFormation/aws/{cloudtrail_log_files_not_encrypted => cloudtrail_log_files_not_encrypted_with_cmk}/query.rego (100%) rename assets/queries/cloudFormation/aws/{cloudtrail_log_files_not_encrypted => cloudtrail_log_files_not_encrypted_with_cmk}/test/negative1.yaml (100%) rename assets/queries/cloudFormation/aws/{cloudtrail_log_files_not_encrypted => cloudtrail_log_files_not_encrypted_with_cmk}/test/negative2.json (100%) rename assets/queries/cloudFormation/aws/{cloudtrail_log_files_not_encrypted => cloudtrail_log_files_not_encrypted_with_cmk}/test/positive1.yaml (100%) rename assets/queries/cloudFormation/aws/{cloudtrail_log_files_not_encrypted => cloudtrail_log_files_not_encrypted_with_cmk}/test/positive2.json (100%) create mode 100644 assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/positive_expected_result.json delete mode 100644 assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted/test/positive_expected_result.json rename assets/queries/terraform/aws/{cloudtrail_log_files_not_encrypted => cloudtrail_log_files_not_encrypted_with_cmk}/metadata.json (81%) rename assets/queries/terraform/aws/{cloudtrail_log_files_not_encrypted => cloudtrail_log_files_not_encrypted_with_cmk}/query.rego (100%) rename assets/queries/terraform/aws/{cloudtrail_log_files_not_encrypted => cloudtrail_log_files_not_encrypted_with_cmk}/test/negative.tf (100%) rename assets/queries/terraform/aws/{cloudtrail_log_files_not_encrypted => cloudtrail_log_files_not_encrypted_with_cmk}/test/positive.tf (100%) create mode 100644 assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/positive_expected_result.json diff --git a/assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted/test/positive_expected_result.json b/assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted/test/positive_expected_result.json deleted file mode 100644 index 0104eb70722..00000000000 --- a/assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted/test/positive_expected_result.json +++ /dev/null @@ -1,7 +0,0 @@ -[ - { - "queryName": "CloudTrail Log Files Not Encrypted", - "severity": "HIGH", - "line": 2 - } -] diff --git a/assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted/metadata.json b/assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted_with_cmk/metadata.json similarity index 81% rename from assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted/metadata.json rename to assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted_with_cmk/metadata.json index a0d74d7fd9b..df75d830625 100644 --- a/assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted/metadata.json +++ b/assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted_with_cmk/metadata.json @@ -1,7 +1,7 @@ { "id": "f5587077-3f57-4370-9b4e-4eb5b1bac85b", - "queryName": "CloudTrail Log Files Not Encrypted", - "severity": "HIGH", + "queryName": "CloudTrail Log Files Not Encrypted With CMK", + "severity": "LOW", "category": "Encryption", "descriptionText": "CloudTrail Log Files should be encrypted with Key Management Service (KMS)", "descriptionUrl": "https://docs.ansible.com/ansible/latest/collections/community/aws/cloudtrail_module.html", diff --git a/assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted/query.rego b/assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted_with_cmk/query.rego similarity index 100% rename from assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted/query.rego rename to assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted_with_cmk/query.rego diff --git a/assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted/test/negative.yaml b/assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/negative.yaml similarity index 100% rename from assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted/test/negative.yaml rename to assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/negative.yaml diff --git a/assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted/test/positive.yaml b/assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/positive.yaml similarity index 100% rename from assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted/test/positive.yaml rename to assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/positive.yaml diff --git a/assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/positive_expected_result.json b/assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/positive_expected_result.json new file mode 100644 index 00000000000..7643d7313ae --- /dev/null +++ b/assets/queries/ansible/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/positive_expected_result.json @@ -0,0 +1,7 @@ +[ + { + "queryName": "CloudTrail Log Files Not Encrypted With CMK", + "severity": "LOW", + "line": 2 + } +] diff --git a/assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted/test/positive_expected_result.json b/assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted/test/positive_expected_result.json deleted file mode 100644 index ea6c39f47cd..00000000000 --- a/assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted/test/positive_expected_result.json +++ /dev/null @@ -1,14 +0,0 @@ -[ - { - "queryName": "CloudTrail Log Files Not Encrypted", - "severity": "HIGH", - "line": 62, - "fileName": "positive1.yaml" - }, - { - "queryName": "CloudTrail Log Files Not Encrypted", - "severity": "HIGH", - "line": 53, - "fileName": "positive2.json" - } -] diff --git a/assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted/metadata.json b/assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted_with_cmk/metadata.json similarity index 82% rename from assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted/metadata.json rename to assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted_with_cmk/metadata.json index 25a100613de..36d5748ebfe 100644 --- a/assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted/metadata.json +++ b/assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted_with_cmk/metadata.json @@ -1,7 +1,7 @@ { "id": "050a9ba8-d1cb-4c61-a5e8-8805a70d3b85", - "queryName": "CloudTrail Log Files Not Encrypted", - "severity": "HIGH", + "queryName": "CloudTrail Log Files Not Encrypted With CMK", + "severity": "LOW", "category": "Encryption", "descriptionText": "Logs delivered by CloudTrail should be encrypted using KMS", "descriptionUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudtrail-trail.html#cfn-cloudtrail-trail-kmskeyid", diff --git a/assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted/query.rego b/assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted_with_cmk/query.rego similarity index 100% rename from assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted/query.rego rename to assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted_with_cmk/query.rego diff --git a/assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted/test/negative1.yaml b/assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/negative1.yaml similarity index 100% rename from assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted/test/negative1.yaml rename to assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/negative1.yaml diff --git a/assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted/test/negative2.json b/assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/negative2.json similarity index 100% rename from assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted/test/negative2.json rename to assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/negative2.json diff --git a/assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted/test/positive1.yaml b/assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/positive1.yaml similarity index 100% rename from assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted/test/positive1.yaml rename to assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/positive1.yaml diff --git a/assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted/test/positive2.json b/assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/positive2.json similarity index 100% rename from assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted/test/positive2.json rename to assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/positive2.json diff --git a/assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/positive_expected_result.json b/assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/positive_expected_result.json new file mode 100644 index 00000000000..520df01994a --- /dev/null +++ b/assets/queries/cloudFormation/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/positive_expected_result.json @@ -0,0 +1,14 @@ +[ + { + "queryName": "CloudTrail Log Files Not Encrypted With CMK", + "severity": "LOW", + "line": 62, + "fileName": "positive1.yaml" + }, + { + "queryName": "CloudTrail Log Files Not Encrypted With CMK", + "severity": "LOW", + "line": 53, + "fileName": "positive2.json" + } +] diff --git a/assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted/test/positive_expected_result.json b/assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted/test/positive_expected_result.json deleted file mode 100644 index 11cdef8676a..00000000000 --- a/assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted/test/positive_expected_result.json +++ /dev/null @@ -1,7 +0,0 @@ -[ - { - "queryName": "CloudTrail Log Files Not Encrypted", - "severity": "HIGH", - "line": 1 - } -] diff --git a/assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted/metadata.json b/assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted_with_cmk/metadata.json similarity index 81% rename from assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted/metadata.json rename to assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted_with_cmk/metadata.json index 2827d1617f4..1a48fc94022 100644 --- a/assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted/metadata.json +++ b/assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted_with_cmk/metadata.json @@ -1,7 +1,7 @@ { "id": "5d9e3164-9265-470c-9a10-57ae454ac0c7", - "queryName": "CloudTrail Log Files Not Encrypted", - "severity": "HIGH", + "queryName": "CloudTrail Log Files Not Encrypted With CMK", + "severity": "LOW", "category": "Observability", "descriptionText": "Logs delivered by CloudTrail should be encrypted using KMS", "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudtrail#kms_key_id", diff --git a/assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted/query.rego b/assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted_with_cmk/query.rego similarity index 100% rename from assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted/query.rego rename to assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted_with_cmk/query.rego diff --git a/assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted/test/negative.tf b/assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/negative.tf similarity index 100% rename from assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted/test/negative.tf rename to assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/negative.tf diff --git a/assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted/test/positive.tf b/assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/positive.tf similarity index 100% rename from assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted/test/positive.tf rename to assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/positive.tf diff --git a/assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/positive_expected_result.json b/assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/positive_expected_result.json new file mode 100644 index 00000000000..41946912991 --- /dev/null +++ b/assets/queries/terraform/aws/cloudtrail_log_files_not_encrypted_with_cmk/test/positive_expected_result.json @@ -0,0 +1,7 @@ +[ + { + "queryName": "CloudTrail Log Files Not Encrypted With CMK", + "severity": "LOW", + "line": 1 + } +] From 255103ff6080122de67842e2ce50a8f90b7d79dd Mon Sep 17 00:00:00 2001 From: cxMiguelSilva Date: Mon, 2 May 2022 15:36:37 +0100 Subject: [PATCH 08/12] update yaml sample --- .../sns_topic_is_publicly_accessible/test/positive.yaml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/positive.yaml b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/positive.yaml index c92b932f18e..d5a8909517e 100644 --- a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/positive.yaml +++ b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/positive.yaml @@ -23,10 +23,9 @@ policy: Version: '2022-05-02' Statement: - - Effect: Allow - Action: Publish - Principal: '*' - + - Action: Publish + Effect: Allow + Principal: "*" - name: Create alarm SNS topic sns_topic: name: "alarms" From 58c9e6b9ba075b42c5a570469c581dc01d8992df Mon Sep 17 00:00:00 2001 From: cxMiguelSilva Date: Mon, 2 May 2022 15:38:23 +0100 Subject: [PATCH 09/12] change yaml sample --- .../aws/sns_topic_is_publicly_accessible/test/positive.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/positive.yaml b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/positive.yaml index d5a8909517e..db5c44bc834 100644 --- a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/positive.yaml +++ b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/positive.yaml @@ -50,6 +50,6 @@ policy: Version: '2022-05-02' Statement: - - Effect: Allow - Action: Publish - Principal: '*' + - Effect: Allow + Action: Publish + Principal: '*' From ff83a2f52f403d51ee1733227e8ee8dbc97e75e3 Mon Sep 17 00:00:00 2001 From: cxMiguelSilva Date: Mon, 2 May 2022 15:58:07 +0100 Subject: [PATCH 10/12] update line --- .../test/positive_expected_result.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json index b3e70fd9b62..73ce9cee89b 100644 --- a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json +++ b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json @@ -8,7 +8,7 @@ { "queryName": "SNS Topic is Publicly Accessible", "severity": "HIGH", - "line": 51, + "line": 50, "fileName": "positive.yaml" } ] From b1b2fd97400f45c372be36ccd595565adf74008b Mon Sep 17 00:00:00 2001 From: cxMiguelSilva Date: Mon, 2 May 2022 16:50:51 +0100 Subject: [PATCH 11/12] fix issues --- .../ansible/aws/sns_topic_is_publicly_accessible/query.rego | 5 +++-- .../aws/sns_topic_is_publicly_accessible/query.rego | 4 ++-- .../test/positive_expected_result.json | 4 ++-- .../metadata.json | 2 +- .../terraform/alicloud/vpc_flow_logs_disabled/metadata.json | 2 +- .../test/positive_expected_result.json | 2 +- 6 files changed, 10 insertions(+), 9 deletions(-) diff --git a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/query.rego b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/query.rego index b8dbbe32c50..79e3eea767e 100644 --- a/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/query.rego +++ b/assets/queries/ansible/aws/sns_topic_is_publicly_accessible/query.rego @@ -8,8 +8,9 @@ CxPolicy[result] { modules := {"community.aws.sns_topic", "sns_topic"} snsTopicCommunity := task[modules[m]] ansLib.checkState(snsTopicCommunity) - policies := snsTopicCommunity.policy - statement := policies.Statement[i] + st := common_lib.get_statement(common_lib.get_policy(snsTopicCommunity.policy)) + statement := st[_] + statement.Effect == "Allow" common_lib.any_principal(statement) diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/query.rego b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/query.rego index 9ef2fcab3ca..880422ffe34 100644 --- a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/query.rego +++ b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/query.rego @@ -14,10 +14,10 @@ CxPolicy[result] { result := { "documentId": input.document[i].id, - "searchKey": sprintf("Resources.%s.Properties.PolicyDocument.Statement", [name]), + "searchKey": sprintf("Resources.%s.Properties.PolicyDocument", [name]), "issueType": "IncorrectValue", "keyExpectedValue": sprintf("Resources.%s.Properties.PolicyDocument.Statement does not allow actions from all principals", [name]), "keyActualValue": sprintf("Resources.%s.Properties.PolicyDocument.Statement allows actions from all principals", [name]), - "searchLine": common_lib.build_search_line(["Resource", name, "Properties", "PolicyDocument","Statement"], []), + "searchLine": common_lib.build_search_line(["Resource", name, "Properties", "PolicyDocument"], []), } } diff --git a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json index 48ad320bbae..eb621b16955 100644 --- a/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json +++ b/assets/queries/cloudFormation/aws/sns_topic_is_publicly_accessible/test/positive_expected_result.json @@ -1,6 +1,6 @@ [ { - "line": 8, + "line": 7, "fileName": "positive1.yaml", "queryName": "SNS Topic is Publicly Accessible", "severity": "HIGH" @@ -8,7 +8,7 @@ { "queryName": "SNS Topic is Publicly Accessible", "severity": "HIGH", - "line": 11, + "line": 8, "fileName": "positive2.json" } ] diff --git a/assets/queries/terraform/alicloud/ram_password_security_policy_not_require_at_least_one_uppercase_character/metadata.json b/assets/queries/terraform/alicloud/ram_password_security_policy_not_require_at_least_one_uppercase_character/metadata.json index dc9f9af7325..4a36e9ca239 100644 --- a/assets/queries/terraform/alicloud/ram_password_security_policy_not_require_at_least_one_uppercase_character/metadata.json +++ b/assets/queries/terraform/alicloud/ram_password_security_policy_not_require_at_least_one_uppercase_character/metadata.json @@ -2,7 +2,7 @@ "id": "5e0fb613-ba9b-44c3-88f0-b44188466bfd", "queryName": "RAM Account Password Policy Not Require at Least one Uppercase Character", "severity": "MEDIUM", - "category": "Secret Management", + "category": "Best Practices", "descriptionText": "Ram Account Password Policy should have 'require_uppercase_characters' set to true", "descriptionUrl": "https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/ram_account_password_policy#require_uppercase_characters", "platform": "Terraform", diff --git a/assets/queries/terraform/alicloud/vpc_flow_logs_disabled/metadata.json b/assets/queries/terraform/alicloud/vpc_flow_logs_disabled/metadata.json index e52d97fd4c8..c8c39504f64 100644 --- a/assets/queries/terraform/alicloud/vpc_flow_logs_disabled/metadata.json +++ b/assets/queries/terraform/alicloud/vpc_flow_logs_disabled/metadata.json @@ -1,7 +1,7 @@ { "id": "d2731f3d-a992-44ed-812e-f4f1c2747d71", "queryName": "VPC Flow Logs Disabled", - "severity": "MEDIUM", + "severity": "LOW", "category": "Observability", "descriptionText": "Every VPC resource should have an associated Flow Log", "descriptionUrl": "https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/vpc_flow_log", diff --git a/assets/queries/terraform/alicloud/vpc_flow_logs_disabled/test/positive_expected_result.json b/assets/queries/terraform/alicloud/vpc_flow_logs_disabled/test/positive_expected_result.json index c3c49edacef..03ac6e46411 100644 --- a/assets/queries/terraform/alicloud/vpc_flow_logs_disabled/test/positive_expected_result.json +++ b/assets/queries/terraform/alicloud/vpc_flow_logs_disabled/test/positive_expected_result.json @@ -1,7 +1,7 @@ [ { "queryName": "VPC Flow Logs Disabled", - "severity": "MEDIUM", + "severity": "LOW", "line": 1, "fileName": "positive1.tf" } From 440fdf8b1719385b76b4eaa310a17c76d620917b Mon Sep 17 00:00:00 2001 From: cxMiguelSilva Date: Tue, 3 May 2022 10:25:55 +0100 Subject: [PATCH 12/12] fixing e2e errors --- .../metadata.json | 2 +- e2e/fixtures/E2E_CLI_031_RESULT.html | 40 +++--- e2e/fixtures/E2E_CLI_032_RESULT.json | 116 +++++++++--------- e2e/fixtures/E2E_CLI_036_RESULT.json | 108 ++++++++-------- e2e/fixtures/E2E_CLI_040_RESULT.html | 42 +++---- 5 files changed, 154 insertions(+), 154 deletions(-) diff --git a/assets/queries/terraform/alicloud/ram_password_security_policy_not_require_at_least_one_uppercase_character/metadata.json b/assets/queries/terraform/alicloud/ram_password_security_policy_not_require_at_least_one_uppercase_character/metadata.json index 4a36e9ca239..dc9f9af7325 100644 --- a/assets/queries/terraform/alicloud/ram_password_security_policy_not_require_at_least_one_uppercase_character/metadata.json +++ b/assets/queries/terraform/alicloud/ram_password_security_policy_not_require_at_least_one_uppercase_character/metadata.json @@ -2,7 +2,7 @@ "id": "5e0fb613-ba9b-44c3-88f0-b44188466bfd", "queryName": "RAM Account Password Policy Not Require at Least one Uppercase Character", "severity": "MEDIUM", - "category": "Best Practices", + "category": "Secret Management", "descriptionText": "Ram Account Password Policy should have 'require_uppercase_characters' set to true", "descriptionUrl": "https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/ram_account_password_policy#require_uppercase_characters", "platform": "Terraform", diff --git a/e2e/fixtures/E2E_CLI_031_RESULT.html b/e2e/fixtures/E2E_CLI_031_RESULT.html index b7707185502..417593ac47d 100644 --- a/e2e/fixtures/E2E_CLI_031_RESULT.html +++ b/e2e/fixtures/E2E_CLI_031_RESULT.html @@ -1,8 +1,8 @@ -KICS Scan ResultCheckmarx logo
KICS REPORT04/28/2022 11:02KICS.IO
KICS development +KICS Scan ResultCheckmarx logo
KICS REPORT05/02/2022 17:48KICS.IO
KICS development Scanned paths: /path/e2e/fixtures/samples/positive.yaml -Platforms: CloudFormationStart time: 11:01:46, Apr 28 2022 -End time: 11:02:01, Apr 28 2022

Vulnerabilities:

4 -HIGH
11 +Platforms: CloudFormationStart time: 17:48:43, May 02 2022 +End time: 17:48:52, May 02 2022

Vulnerabilities:

6 +HIGH
9 MEDIUM
6 LOW
0 INFO
21 @@ -14,10 +14,15 @@ Line 48
Expected: 'Resources.TaskDefinition.Properties.NetworkMode' is set and is 'awsvpc' Found: 'Resources.TaskDefinition.Properties.NetworkMode' is undefined and defaults to 'bridge'
47 Type: AWS::ECS::TaskDefinition
48 Properties:
49 Family: !Join ['', [!Ref 'AWS::StackName', -ecs-demo-app]]

Fully Open Ingress

Platform: CloudFormation Category: Networking and Firewall
ECS Service's security group should not allow unrestricted access to all ports from all IPv4 addresseshttps://docs.aws.amazon.com/AmazonECS/latest/developerguide/get-set-up-for-amazon-ecs.html#create-a-base-security-group
Results (2)
File: fixtures\samples\positive.yaml -Line 24
Expected: Resource name 'EcsSecurityGroupHTTPinbound02' of type 'AWS::EC2::SecurityGroupIngress' should not accept ingress connections from all IPv4 adresses and to all available ports -Found: Resource name 'EcsSecurityGroupHTTPinbound02' of type 'AWS::EC2::SecurityGroupIngress' should not accept ingress connections from CIDR 0.0.0.0/0 to all available ports
23 ToPort: 0
24 CidrIp: 0.0.0.0/0
25 EcsSecurityGroupSSHinbound:
File: fixtures\samples\positive.yaml Line 32
Expected: Resource name 'EcsSecurityGroupSSHinbound' of type 'AWS::EC2::SecurityGroupIngress' should not accept ingress connections from all IPv4 adresses and to all available ports -Found: Resource name 'EcsSecurityGroupSSHinbound' of type 'AWS::EC2::SecurityGroupIngress' should not accept ingress connections from CIDR 0.0.0.0/0 to all available ports
31 ToPort: 0
32 CidrIp: 0.0.0.0/0
33 EcsSecurityGroupALBports:

ALB Is Not Integrated With WAF

Platform: CloudFormation +Found: Resource name 'EcsSecurityGroupSSHinbound' of type 'AWS::EC2::SecurityGroupIngress' should not accept ingress connections from CIDR 0.0.0.0/0 to all available ports
31 ToPort: 0
32 CidrIp: 0.0.0.0/0
33 EcsSecurityGroupALBports:
File: fixtures\samples\positive.yaml +Line 24
Expected: Resource name 'EcsSecurityGroupHTTPinbound02' of type 'AWS::EC2::SecurityGroupIngress' should not accept ingress connections from all IPv4 adresses and to all available ports +Found: Resource name 'EcsSecurityGroupHTTPinbound02' of type 'AWS::EC2::SecurityGroupIngress' should not accept ingress connections from CIDR 0.0.0.0/0 to all available ports
23 ToPort: 0
24 CidrIp: 0.0.0.0/0
25 EcsSecurityGroupSSHinbound:

Unrestricted Security Group Ingress

Platform: CloudFormation +Category: Networking and Firewall
AWS Security Group Ingress CIDR should not be open to the worldhttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group-ingress.html
Results (2)
File: fixtures\samples\positive.yaml +Line 32
Expected: Resources.EcsSecurityGroupSSHinbound.Properties.CidrIp is not open to the world (0.0.0.0/0) +Found: Resources.EcsSecurityGroupSSHinbound.Properties.CidrIp is open to the world (0.0.0.0/0)
31 ToPort: 0
32 CidrIp: 0.0.0.0/0
33 EcsSecurityGroupALBports:
File: fixtures\samples\positive.yaml +Line 24
Expected: Resources.EcsSecurityGroupHTTPinbound02.Properties.CidrIp is not open to the world (0.0.0.0/0) +Found: Resources.EcsSecurityGroupHTTPinbound02.Properties.CidrIp is open to the world (0.0.0.0/0)
23 ToPort: 0
24 CidrIp: 0.0.0.0/0
25 EcsSecurityGroupSSHinbound:

ALB Is Not Integrated With WAF

Platform: CloudFormation Category: Networking and Firewall
All Application Load Balancers (ALB) must be protected with Web Application Firewall (WAF) servicehttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafregional-webaclassociation.html
Results (1)
File: fixtures\samples\positive.yaml Line 86
Expected: 'Resources.ECSALB' does not have an 'internal' scheme and has a 'WebACLAssociation' associated Found: 'Resources.ECSALB' does not have an 'internal' scheme and a 'WebACLAssociation' associated
85 - Name: my-vol
86 ECSALB:
87 Type: AWS::ElasticLoadBalancingV2::LoadBalancer

Auto Scaling Group With No Associated ELB

Platform: CloudFormation @@ -37,30 +42,25 @@ Line 167
Expected: 'Resources.service.Properties.TaskDefinition' refers to a TaskDefinition with Role Found: 'Resources.service.Properties.TaskDefinition' does not refer to a TaskDefinition with Role
166 Role: !Ref 'ECSServiceRole'
167 TaskDefinition: !Ref 'TaskDefinition'
168 ECSServiceRole:

Security Group Ingress With Port Range

Platform: CloudFormation Category: Networking and Firewall
AWS Security Group Ingress should have a single porthttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group-ingress.html
Results (3)
File: fixtures\samples\positive.yaml +Line 35
Expected: Resources.EcsSecurityGroupALBports.Properties.FromPort is equal to Resources.EcsSecurityGroupALBports.Properties.ToPort +Found: Resources.EcsSecurityGroupALBports.Properties.FromPort is not equal to Resources.EcsSecurityGroupALBports.Properties.ToPort
34 Type: AWS::EC2::SecurityGroupIngress
35 Properties:
36 GroupId: !Ref 'EcsSecurityGroup'
File: fixtures\samples\positive.yaml Line 19
Expected: Resources.EcsSecurityGroupHTTPinbound02.Properties.FromPort is equal to Resources.EcsSecurityGroupHTTPinbound02.Properties.ToPort Found: Resources.EcsSecurityGroupHTTPinbound02.Properties.FromPort is not equal to Resources.EcsSecurityGroupHTTPinbound02.Properties.ToPort
18 Type: AWS::EC2::SecurityGroupIngress
19 Properties:
20 GroupId: !Ref 'EcsSecurityGroup'
File: fixtures\samples\positive.yaml Line 27
Expected: Resources.EcsSecurityGroupSSHinbound.Properties.FromPort is equal to Resources.EcsSecurityGroupSSHinbound.Properties.ToPort -Found: Resources.EcsSecurityGroupSSHinbound.Properties.FromPort is not equal to Resources.EcsSecurityGroupSSHinbound.Properties.ToPort
26 Type: AWS::EC2::SecurityGroupIngress
27 Properties:
28 GroupId: !Ref 'EcsSecurityGroup'
File: fixtures\samples\positive.yaml -Line 35
Expected: Resources.EcsSecurityGroupALBports.Properties.FromPort is equal to Resources.EcsSecurityGroupALBports.Properties.ToPort -Found: Resources.EcsSecurityGroupALBports.Properties.FromPort is not equal to Resources.EcsSecurityGroupALBports.Properties.ToPort
34 Type: AWS::EC2::SecurityGroupIngress
35 Properties:
36 GroupId: !Ref 'EcsSecurityGroup'

Unrestricted Security Group Ingress

Platform: CloudFormation -Category: Networking and Firewall
AWS Security Group Ingress CIDR should not be open to the worldhttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group-ingress.html
Results (2)
File: fixtures\samples\positive.yaml -Line 24
Expected: Resources.EcsSecurityGroupHTTPinbound02.Properties.CidrIp is not open to the world (0.0.0.0/0) -Found: Resources.EcsSecurityGroupHTTPinbound02.Properties.CidrIp is open to the world (0.0.0.0/0)
23 ToPort: 0
24 CidrIp: 0.0.0.0/0
25 EcsSecurityGroupSSHinbound:
File: fixtures\samples\positive.yaml -Line 32
Expected: Resources.EcsSecurityGroupSSHinbound.Properties.CidrIp is not open to the world (0.0.0.0/0) -Found: Resources.EcsSecurityGroupSSHinbound.Properties.CidrIp is open to the world (0.0.0.0/0)
31 ToPort: 0
32 CidrIp: 0.0.0.0/0
33 EcsSecurityGroupALBports:

ECS Task Definition HealthCheck Missing

Platform: CloudFormation +Found: Resources.EcsSecurityGroupSSHinbound.Properties.FromPort is not equal to Resources.EcsSecurityGroupSSHinbound.Properties.ToPort
26 Type: AWS::EC2::SecurityGroupIngress
27 Properties:
28 GroupId: !Ref 'EcsSecurityGroup'

ECS Task Definition HealthCheck Missing

Platform: CloudFormation Category: Observability
Amazon ECS must have the HealthCheck property defined to give more control over monitoring the health of taskshttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-taskdefinition-healthcheck.html
Results (2)
File: fixtures\samples\positive.yaml -Line 51
Expected: 'Resources.TaskDefinition.Properties.ContainerDefinitions' contains 'HealthCheck' property -Found: 'Resources.TaskDefinition.Properties.ContainerDefinitions' doesn't contain 'HealthCheck' property
50 ContainerDefinitions:
51 - Name: simple-app
52 Cpu: 10
File: fixtures\samples\positive.yaml Line 67
Expected: 'Resources.TaskDefinition.Properties.ContainerDefinitions' contains 'HealthCheck' property -Found: 'Resources.TaskDefinition.Properties.ContainerDefinitions' doesn't contain 'HealthCheck' property
66 - ContainerPort: 80
67 - Name: busybox
68 Cpu: 10

IAM Access Analyzer Not Enabled

Platform: CloudFormation +Found: 'Resources.TaskDefinition.Properties.ContainerDefinitions' doesn't contain 'HealthCheck' property
66 - ContainerPort: 80
67 - Name: busybox
68 Cpu: 10
File: fixtures\samples\positive.yaml +Line 51
Expected: 'Resources.TaskDefinition.Properties.ContainerDefinitions' contains 'HealthCheck' property +Found: 'Resources.TaskDefinition.Properties.ContainerDefinitions' doesn't contain 'HealthCheck' property
50 ContainerDefinitions:
51 - Name: simple-app
52 Cpu: 10

IAM Access Analyzer Not Enabled

Platform: CloudFormation Category: Best Practices
IAM Access Analyzer should be enabled and configured to continuously monitor resource permissionshttps://docs.amazonaws.cn/en_us/AWSCloudFormation/latest/UserGuide/aws-resource-accessanalyzer-analyzer.html
Results (1)
File: fixtures\samples\positive.yaml Line 9
Expected: 'AWS::AccessAnalyzer::Analyzer' is set Found: 'AWS::AccessAnalyzer::Analyzer' is undefined
8 Description: Select at two subnets in your selected VPC.
9Resources:
10 ECSCluster:

Security Group Rule Without Description

Platform: CloudFormation Category: Best Practices
AWS Security Group Rule should have description definedhttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group.html
Results (3)
File: fixtures\samples\positive.yaml -Line 19
Expected: Resources.EcsSecurityGroupHTTPinbound02.Properties.Description is set -Found: Resources.EcsSecurityGroupHTTPinbound02.Properties.Description is undefined
18 Type: AWS::EC2::SecurityGroupIngress
19 Properties:
20 GroupId: !Ref 'EcsSecurityGroup'
File: fixtures\samples\positive.yaml Line 35
Expected: Resources.EcsSecurityGroupALBports.Properties.Description is set Found: Resources.EcsSecurityGroupALBports.Properties.Description is undefined
34 Type: AWS::EC2::SecurityGroupIngress
35 Properties:
36 GroupId: !Ref 'EcsSecurityGroup'
File: fixtures\samples\positive.yaml +Line 19
Expected: Resources.EcsSecurityGroupHTTPinbound02.Properties.Description is set +Found: Resources.EcsSecurityGroupHTTPinbound02.Properties.Description is undefined
18 Type: AWS::EC2::SecurityGroupIngress
19 Properties:
20 GroupId: !Ref 'EcsSecurityGroup'
File: fixtures\samples\positive.yaml Line 27
Expected: Resources.EcsSecurityGroupSSHinbound.Properties.Description is set Found: Resources.EcsSecurityGroupSSHinbound.Properties.Description is undefined
26 Type: AWS::EC2::SecurityGroupIngress
27 Properties:
28 GroupId: !Ref 'EcsSecurityGroup'
KICS is open and will always stay such. Both the scanning engine and the security queries are clear and open for the software development community.
Spread the love: