Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(keyExpectedValue): cloudformation-aws queries convert to a recommendation rather than a current status - stage 2 #5647

Merged
merged 6 commits into from
Aug 23, 2022
Merged

fix(keyExpectedValue): cloudformation-aws queries convert to a recommendation rather than a current status - stage 2 #5647

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
656062f
fix(keyExpectedValue): cloudformation-aws queries convert to a recomm…
liorj-orca Jul 28, 2022
dcec419
fixed typos
rafaela-soares Aug 22, 2022
4ba73c7
fixed E2E tests
rafaela-soares Aug 22, 2022
04ae9a7
Merge remote-tracking branch 'upstream/master' into fix/keyExpectedVa…
rafaela-soares Aug 22, 2022
d97e267
requested changes
rafaela-soares Aug 22, 2022
5d00bf9
Merge remote-tracking branch 'upstream/master' into fix/keyExpectedVa…
rafaela-soares Aug 23, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion assets/queries/cloudFormation/aws/cmk_is_unusable/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Properties.Enabled", [name]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("'Resources.%s.Properties.Enabled' is true", [name]),
"keyExpectedValue": sprintf("'Resources.%s.Properties.Enabled' should be true", [name]),
"keyActualValue": sprintf("'Resources.%s.Properties.Enabled' is false", [name]),
}
}
Expand Down
4 changes: 2 additions & 2 deletions assets/queries/cloudFormation/aws/cmk_rotation_disabled/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Properties", [name]),
"issueType": "MissingAttribute",
"keyExpectedValue": sprintf("'Resources.%s.Properties.EnableKeyRotation' is defined and not null", [name]),
"keyExpectedValue": sprintf("'Resources.%s.Properties.EnableKeyRotation' should be defined and not null", [name]),
"keyActualValue": sprintf("'Resources.%s.Properties.EnableKeyRotation' is undefined or null", [name]),
}
}
Expand All @@ -34,7 +34,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Properties.EnableKeyRotation", [name]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("'Resources.%s.Properties.EnableKeyRotation' is true", [name]),
"keyExpectedValue": sprintf("'Resources.%s.Properties.EnableKeyRotation' should be true", [name]),
"keyActualValue": sprintf("'Resources.%s.Properties.EnableKeyRotation' is false", [name]),
}
}
2 changes: 1 addition & 1 deletion assets/queries/cloudFormation/aws/codebuild_not_encrypted/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Project.Properties", [name]),
"issueType": "MissingAttribute",
"keyExpectedValue": sprintf("Resources.%s.Project.Properties.EncryptionKey' is defined and not null", [name]),
"keyExpectedValue": sprintf("Resources.%s.Project.Properties.EncryptionKey' should be defined and not null", [name]),
"keyActualValue": sprintf("Resources.%s.Project.Properties.EncryptionKey' is undefined or null", [name]),
}
}
2 changes: 1 addition & 1 deletion assets/queries/cloudFormation/aws/cognito_userpool_without_mfa/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Properties", [name]),
"issueType": "MissingAttribute",
"keyExpectedValue": sprintf("Resources.%s.Properties.MfaConfiguration is set", [name]),
"keyExpectedValue": sprintf("Resources.%s.Properties.MfaConfiguration should be set", [name]),
"keyActualValue": sprintf("Resources.%s.Properties.MfaConfiguration is undefined", [name]),
}
}
Expand Down
2 changes: 1 addition & 1 deletion ...ies/cloudFormation/aws/config_configuration_aggregator_to_all_regions_disabled/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Properties", [name]),
"issueType": "MissingAttribute",
"keyExpectedValue": sprintf("'Resources.%s.Properties' has aggregator sources defined", [name]),
"keyExpectedValue": sprintf("'Resources.%s.Properties' should have aggregator sources defined", [name]),
"keyActualValue": sprintf("'Resources.%s.Properties' does not have aggregator sources defined", [name]),
}
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/cloudFormation/aws/config_rule_for_encryption_volumes_disabled/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(firstRule, name),
"searchKey": sprintf("Resources.%s", [name]),
"issueType": "MissingAttribute",
"keyExpectedValue": "There is a ConfigRule for encrypted volumes.",
"keyExpectedValue": "There should be a ConfigRule for encrypted volumes.",
"keyActualValue": "There isn't a ConfigRule for encrypted volumes."
}
}
Expand Down
4 changes: 2 additions & 2 deletions .../queries/cloudFormation/aws/connection_between_cloudfront_origin_not_encrypted/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resources, name),
"searchKey": sprintf("Resources.%s.Properties.DistributionConfig.DefaultCacheBehavior.ViewerProtocolPolicy", [name]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("Resources.%s.Properties.DistributionConfig.DefaultCacheBehavior.ViewerProtocolPolicy is 'https-only' or 'redirect-to-https'", [name]),
"keyExpectedValue": sprintf("Resources.%s.Properties.DistributionConfig.DefaultCacheBehavior.ViewerProtocolPolicy should be 'https-only' or 'redirect-to-https'", [name]),
"keyActualValue": sprintf("Resources.%s.Properties.DistributionConfig.DefaultCacheBehavior.ViewerProtocolPolicy 'isn't https-only' or 'redirect-to-https'", [name]),
}
}
Expand All @@ -27,7 +27,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resources, name),
"searchKey": sprintf("Resources.%s.Properties.DistributionConfig.CacheBehaviors.ViewerProtocolPolicy", [name]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("Resources.%s.Properties.DistributionConfig.CacheBehaviors.ViewerProtocolPolicy is 'https-only' or 'redirect-to-https'", [name]),
"keyExpectedValue": sprintf("Resources.%s.Properties.DistributionConfig.CacheBehaviors.ViewerProtocolPolicy should be 'https-only' or 'redirect-to-https'", [name]),
"keyActualValue": sprintf("Resources.%s.Properties.DistributionConfig.CacheBehaviors.ViewerProtocolPolicy 'isn't https-only' or 'redirect-to-https'", [name]),
}
}
2 changes: 1 addition & 1 deletion assets/queries/cloudFormation/aws/db_instance_publicly_accessible/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Properties.PubliclyAccessible", [name]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("'Resources.%s.Properties.PubliclyAccessible' is set to false", [name]),
"keyExpectedValue": sprintf("'Resources.%s.Properties.PubliclyAccessible' should be set to false", [name]),
"keyActualValue": sprintf("'Resources.%s.Properties.PubliclyAccessible' is set to true", [name]),
"searchLine": common_lib.build_search_line(["Resources", name, "Properties", "PubliclyAccessible"], []),
}
Expand Down
6 changes: 3 additions & 3 deletions assets/queries/cloudFormation/aws/db_security_group_open_to_large_scope/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Properties.SecurityGroupIngress", [name]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("'Resources.%s.Properties.SecurityGroupIngress' doesn't have more than 256 hosts.", [name]),
"keyExpectedValue": sprintf("'Resources.%s.Properties.SecurityGroupIngress' should not have more than 256 hosts.", [name]),
"keyActualValue": sprintf("'Resources.%s.Properties.SecurityGroupIngress' has more than 256 hosts.", [name]),
}
}
Expand All @@ -34,7 +34,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Properties.SecurityGroupIngress", [name]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("'Resources.%s.Properties.SecurityGroupIngress' doesn't have more than 256 hosts.", [name]),
"keyExpectedValue": sprintf("'Resources.%s.Properties.SecurityGroupIngress' should not have more than 256 hosts.", [name]),
"keyActualValue": sprintf("'Resources.%s.Properties.SecurityGroupIngress' has more than 256 hosts.", [name]),
}
}
Expand All @@ -51,7 +51,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Properties.DBSecurityGroupIngress", [name]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("'Resources.%s.Properties.DBSecurityGroupIngress' doesn't have more than 256 hosts.", [name]),
"keyExpectedValue": sprintf("'Resources.%s.Properties.DBSecurityGroupIngress' should not have more than 256 hosts.", [name]),
"keyActualValue": sprintf("'Resources.%s.Properties.DBSecurityGroupIngress' has more than 256 hosts.", [name]),
}
}
Expand Down
2 changes: 1 addition & 1 deletion ...s/queries/cloudFormation/aws/default_security_groups_with_unrestricted_traffic/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resources, name),
"searchKey": sprintf("Resources.%s.Properties", [name]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("Resources.%s.Properties.GroupName is defined as default and the inbound and outbound rules are empty.", [name]),
"keyExpectedValue": sprintf("Resources.%s.Properties.GroupName should be defined as default and the inbound and outbound rules should be empty.", [name]),
"keyActualValue": sprintf("Resources.%s.Properties.GroupName is defined as default and the inbound and outbound rules are not empty.", [name]),
}
}
Expand Down
2 changes: 1 addition & 1 deletion ...on/aws/directory_service_microsoft_ad_password_set_to_plaintext_or_default_ref/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ CxPolicy[result] {
"resourceName": "n/a",
"searchKey": sprintf("Parameters.%s.Default", [paramName]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("Parameters.%s.Default isn't defined", [paramName]),
"keyExpectedValue": sprintf("Parameters.%s.Default should not be defined", [paramName]),
"keyActualValue": sprintf("Parameters.%s.Default is defined", [paramName]),
}
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/cloudFormation/aws/directory_service_simple_ad_password_exposed/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ CxPolicy[result] {
"resourceName": "n/a",
"searchKey": sprintf("Parameters.%s.Default", [paramName]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("Parameters.%s.Default is defined", [paramName]),
"keyExpectedValue": sprintf("Parameters.%s.Default should be defined", [paramName]),
"keyActualValue": sprintf("Parameters.%s.Default shouldn't be defined", [paramName]),
}
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/cloudFormation/aws/dms_endpoint_mongo_db_settings_password_exposed/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ CxPolicy[result] {
"resourceName": "n/a",
"searchKey": sprintf("Parameters.%s.Default", [paramName]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("Parameters.%s.Default is defined", [paramName]),
"keyExpectedValue": sprintf("Parameters.%s.Default should be defined", [paramName]),
"keyActualValue": sprintf("Parameters.%s.Default shouldn't be defined", [paramName]),
}
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/cloudFormation/aws/dms_endpoint_password_exposed/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ CxPolicy[result] {
"resourceName": "n/a",
"searchKey": sprintf("Parameters.%s.Default", [paramName]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("Parameters.%s.Default is defined", [paramName]),
"keyExpectedValue": sprintf("Parameters.%s.Default should be defined", [paramName]),
"keyActualValue": sprintf("Parameters.%s.Default shouldn't be defined", [paramName]),
}
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/cloudFormation/aws/docdb_cluster_master_password_in_plaintext/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ CxPolicy[result] {
"resourceName": "n/a",
"searchKey": sprintf("Parameters.%s.Default", [paramName]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("Parameters.%s.Default is defined", [paramName]),
"keyExpectedValue": sprintf("Parameters.%s.Default should be defined", [paramName]),
"keyActualValue": sprintf("Parameters.%s.Default shouldn't be defined", [paramName]),
}
}
Expand Down
6 changes: 3 additions & 3 deletions assets/queries/cloudFormation/aws/dynamodb_with_aws_owned_cmk/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, key),
"searchKey": sprintf("Resources.%s.properties;", [key]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("Resources[%s].properties.SSESpecification.SSEEnabled is true", [key]),
"keyExpectedValue": sprintf("Resources[%s].properties.SSESpecification.SSEEnabled should be true", [key]),
"keyActualValue": sprintf("Resources[%s].properties.SSESpecification.SSEEnabled is false", [key]),
}
}
Expand All @@ -35,7 +35,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, key),
"searchKey": sprintf("Resources.%s.properties;", [key]),
"issueType": "MissingAttribute",
"keyExpectedValue": sprintf("Resources.%s.properties.SSESpecification is set", [key]),
"keyExpectedValue": sprintf("Resources.%s.properties.SSESpecification should be set", [key]),
"keyActualValue": sprintf("Resources.%s.properties.SSESpecification is undefined", [key]),
}
}
Expand All @@ -53,7 +53,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, key),
"searchKey": sprintf("Resources.%s.properties;", [key]),
"issueType": "MissingAttribute",
"keyExpectedValue": sprintf("Resources.%s.properties.SSESpecification.SSEEnabled is set", [key]),
"keyExpectedValue": sprintf("Resources.%s.properties.SSESpecification.SSEEnabled should be set", [key]),
"keyActualValue": sprintf("Resources.%s.properties.SSESpecification.SSEEnabled is undefined", [key]),
}
}
4 changes: 2 additions & 2 deletions assets/queries/cloudFormation/aws/ebs_volume_encryption_disabled/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Properties", [name]),
"issueType": "MissingAttribute",
"keyExpectedValue": sprintf("Resources.%s.Properties.Encrypted is defined and not null", [name]),
"keyExpectedValue": sprintf("Resources.%s.Properties.Encrypted should be defined and not null", [name]),
"keyActualValue": sprintf("Resources.%s.Properties.Encrypted is undefined or null", [name]),
}
}
Expand All @@ -34,7 +34,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Properties.Encrypted", [name]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("Resources.%s.Properties.Encrypted is true", [name]),
"keyExpectedValue": sprintf("Resources.%s.Properties.Encrypted should be true", [name]),
"keyActualValue": sprintf("Resources.%s.Properties.Encrypted is false", [name]),
}
}
2 changes: 1 addition & 1 deletion assets/queries/cloudFormation/aws/ebs_volume_not_attached_to_instances/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s", [name]),
"issueType": "MissingAttribute",
"keyExpectedValue": sprintf("'Resources.%s' is attached to instances", [name]),
"keyExpectedValue": sprintf("'Resources.%s' should be attached to instances", [name]),
"keyActualValue": sprintf("'Resources.%s' is not attached to instances", [name]),
}
}
Expand Down
6 changes: 3 additions & 3 deletions assets/queries/cloudFormation/aws/ec2_instance_has_no_iam_role/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Properties", [name]),
"issueType": "MissingAttribute",
"keyExpectedValue": sprintf("'Resources.%s.Properties.IamInstanceProfile' is set", [name]),
"keyExpectedValue": sprintf("'Resources.%s.Properties.IamInstanceProfile' should be set", [name]),
"keyActualValue": sprintf("'Resources.%s.Properties.IamInstanceProfile' is undefined", [name]),
}
}
Expand All @@ -37,7 +37,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Properties.IamInstanceProfile", [name]),
"issueType": "MissingAttribute",
"keyExpectedValue": sprintf("'Resources.%s.Properties.IamInstanceProfile' has matching IamInstanceProfile resource", [name]),
"keyExpectedValue": sprintf("'Resources.%s.Properties.IamInstanceProfile' should have a matching IamInstanceProfile resource", [name]),
"keyActualValue": sprintf("'Resources.%s.Properties.IamInstanceProfile' does not have matching IamInstanceProfile resource", [name]),
}
}
Expand All @@ -59,7 +59,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Properties", [iamProfile]),
"issueType": "MissingAttribute",
"keyExpectedValue": sprintf("'Resources.%s.Properties.Roles' is set", [iamProfile]),
"keyExpectedValue": sprintf("'Resources.%s.Properties.Roles' should be set", [iamProfile]),
"keyActualValue": sprintf("'Resources.%s.Properties.Roles' is undefined", [iamProfile]),
}
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/cloudFormation/aws/ec2_network_acl_duplicate_rule/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(entry1, name),
"searchKey": sprintf("Resources.%s.Properties.RuleNumber", [name]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("'Resources.%s' has not the same rule number as other entry for the same NetworkACL", [name]),
"keyExpectedValue": sprintf("'Resources.%s' shouldn't have the same rule number as other entry for the same NetworkACL", [name]),
"keyActualValue": sprintf("'Resources.%s' has the same rule number as other entry for the same NetworkACL", [name]),
}
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/cloudFormation/aws/ec2_network_acl_ineffective_denied_traffic/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Properties.CidrBlock", [name]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("Traffic denial is effective (Action is 'Deny' when CidrBlock is '0.0.0.0/0')", [name]),
"keyExpectedValue": sprintf("Traffic denial should be effective (Action is 'Deny' when CidrBlock is '0.0.0.0/0')", [name]),
"keyActualValue": sprintf("Traffic denial is ineffective (Action is 'Deny' when CidrBlock is different from '0.0.0.0/0'", [name]),
}
}
4 changes: 2 additions & 2 deletions assets/queries/cloudFormation/aws/ec2_not_ebs_optimized/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Properties.EbsOptimized", [name]),
"issueType": "MissingAttribute",
"keyExpectedValue": sprintf("Resources.%s.Properties to have EbsOptimized set to true.", [name]),
"keyExpectedValue": sprintf("Resources.%s.Properties should have EbsOptimized set to true.", [name]),
"keyActualValue": sprintf("Resources.%s.Properties doesn't have EbsOptimized set to true.", [name]),
}
}
Expand All @@ -36,7 +36,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Properties.EbsOptimized", [name]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("Resources.%s.Properties to have EbsOptimized set to true.", [name]),
"keyExpectedValue": sprintf("Resources.%s.Properties should have EbsOptimized set to true.", [name]),
"keyActualValue": sprintf("Resources.%s.Properties.EbsOptimized is set to false.", [name]),
}
}
Expand Down
4 changes: 2 additions & 2 deletions assets/queries/cloudFormation/aws/ec2_permissive_network_acl_protocols/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,8 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Properties.Protocol", [name]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("'Resources.%s.Properties.Protocol' should be hould be either 6 (for TCP), 17 (for UDP), 1 (for ICMP), or 58 (for ICMPv6, which must include an IPv6 CIDR block, ICMP type, and code)", [name]),
"keyActualValue": sprintf("'Resources.%s.Properties.Protocol' is configured with a protocol different then 6 (for TCP), 17 (for UDP), 1 (for ICMP), or 58 (for ICMPv6, which must include an IPv6 CIDR block, ICMP type, and code)", [name]),
"keyExpectedValue": sprintf("'Resources.%s.Properties.Protocol' should be either 6 (for TCP), 17 (for UDP), 1 (for ICMP), or 58 (for ICMPv6, which must include an IPv6 CIDR block, ICMP type, and code)", [name]),
rafaela-soares marked this conversation as resolved.
Show resolved Hide resolved
"keyActualValue": sprintf("'Resources.%s.Properties.Protocol' is configured with a protocol different than 6 (for TCP), 17 (for UDP), 1 (for ICMP), or 58 (for ICMPv6, which must include an IPv6 CIDR block, ICMP type, and code)", [name]),
}
}

Expand Down
2 changes: 1 addition & 1 deletion assets/queries/cloudFormation/aws/ec2_public_instance_exposed_through_subnet/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, j),
"searchKey": sprintf("Resources.%s", [subnetName]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("Resources.%s is a private subnet", [subnetName]),
"keyExpectedValue": sprintf("Resources.%s should be a private subnet", [subnetName]),
"keyActualValue": sprintf("Resources.%s has a route for unrestricted internet traffic", [subnetName]),
}
}
Expand Down
4 changes: 2 additions & 2 deletions assets/queries/cloudFormation/aws/ecr_image_tag_not_immutable/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Properties", [name]),
"issueType": "MissingAttribute",
"keyExpectedValue": sprintf("Resources.%s.Properties.ImageTagMutability is defined and not null", [name]),
"keyExpectedValue": sprintf("Resources.%s.Properties.ImageTagMutability should be defined and not null", [name]),
"keyActualValue": sprintf("Resources.%s.Properties.ImageTagMutability is undefined or null", [name]),
}
}
Expand All @@ -32,7 +32,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Properties.ImageTagMutability", [name]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("Resources.%s.Properties.ImageTagMutability is 'IMMUTABLE'", [name]),
"keyExpectedValue": sprintf("Resources.%s.Properties.ImageTagMutability should be 'IMMUTABLE'", [name]),
"keyActualValue": sprintf("Resources.%s.Properties.ImageTagMutability is 'MUTABLE'", [name]),
}
}
2 changes: 1 addition & 1 deletion assets/queries/cloudFormation/aws/ecr_repository_is_publicly_accessible/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Properties.RepositoryPolicyText", [name]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("Resources.%s.Properties.RepositoryPolicyText.Statement.Principal doesn't contain '*'", [name]),
"keyExpectedValue": sprintf("Resources.%s.Properties.RepositoryPolicyText.Statement.Principal shouldn't contain '*'", [name]),
"keyActualValue": sprintf("Resources.%s.Properties.RepositoryPolicyText.Statement.Principal contains '*'", [name]),
"searchLine": common_lib.build_search_line(["Resource", name, "Properties", "RepositoryPolicyTexts"], []),
}
Expand Down
Loading