fix(query): support GCP IAM policy members as lists

[Tohar-orca]

Proposed Changes

• The service_account_with_improper_privileges rule should take into account policies with multiple bindings

I submit this contribution under the Apache-2.0 license.

[cxMiguelSilva]

Hi @Tohar-orca, thank you so much for this amazing contribution.
The proposed changes LGTM 🚀

[cxMiguelSilva]

Hi @asofsilva, kindly do the QA checking for these changes.

[cxMiguelSilva]

Suggested change

	"searchLine": common_lib.build_search_line(["resource", "google_iam_policy", name, "binding", x, "role"], []),
	"searchLine": common_lib.build_search_line(["data", "google_iam_policy", name, "binding", x, "role"], []),

Hi @Tohar-orca, @asofsilva noticed that the line is not correctly detected during the QA checks. Would you mind changing the search lines for the Policies that check the data from resource to data?

[Tohar-orca]

Of course! Done :)

[cxMiguelSilva]

Thanks

[asofsilva]

Hi @Tohar-orca,
I would like to suggest you to add a new positive test file (ex: positive4.tf) where all the serviceAccounts have improper roles, in order to have a test result with more than one vulnerability. For example, a file like:

data "google_iam_policy" "admin" {
  binding {
    role = "roles/admin"
    members = [
      "serviceAccount:your-custom-sa@your-project.iam.gserviceaccount.com",
    ]
  }
  binding {
    role = "roles/editor"
    members = [
      "serviceAccount:alice@gmail.com",
    ]
  }
}

What do you think?

Thank you :)

[Tohar-orca]

Hi @Tohar-orca, I would like to suggest you to add a new positive test file (ex: positive4.tf) where all the serviceAccounts have improper roles, in order to have a test result with more than one vulnerability. For example, a file like:

data "google_iam_policy" "admin" {
  binding {
    role = "roles/admin"
    members = [
      "serviceAccount:your-custom-sa@your-project.iam.gserviceaccount.com",
    ]
  }
  binding {
    role = "roles/editor"
    members = [
      "serviceAccount:alice@gmail.com",
    ]
  }
}

What do you think?

Thank you :)

Hey @asofsilva good idea, I've added a test as you suggested :)