Cannot get custom checks for Terraform config to work (misconfiguration, rego) #6453
-
QuestionHi! 👋🏻 I'm migrating from Since I'm new to Rego I decided to simplify things and first get my checks to work with But I simply don't know how to get these checks to work with This is my example: I have this policy ( # METADATA
# title: "Creating a key for a service account"
# description: "..."
# url: https://example.com
# schemas:
# - input: schema["cloud"]
# custom:
# id: creating_key_for_service_account
# severity: HIGH
# recommmended_actions: "..."
# input:
# selector:
# - type: terraform
package custom.creating_key_for_service_account
deny[msg] {
some type
resource := input.resource[type]
type == "google_service_account_key"
msg = sprintf("Creating a key for a service account: %v", [type])
}and this Terraform config ( resource "google_service_account" "myaccount" {
account_id = "myaccount"
display_name = "My Service Account"
}
resource "google_service_account_key" "mykey" {
service_account_id = google_service_account.myaccount.name
public_key_type = "TYPE_X509_PEM_FILE"
}With When I try the same with But when I try to do something that is more or less in-line with that schema (using deny[msg] {
some type
resource := input.google.iam.organizations[type] # This is not a correct reference, but it does "trigger" schema parsing
type == "google_service_account_key"
msg = sprintf("Creating a key for a service account: %v", [type])
}then I get: It looks like something similar has been reported before: #5865? So my question is; how can I get custom checks for Terraform (HCL) to work? Hopefully somebody can point me in the right direction. TargetFilesystem ScannerMisconfiguration Output FormatNone ModeStandalone Operating SystemMacOS Sonoma 14.4.1 VersionVersion: 0.50.1
Policy Bundle:
Digest: sha256:cdff1bc8c97e4f5cd04782b057c00f5ea8cd81147a506ac4be76bef13710f2d3
DownloadedAt: 2024-04-03 09:47:28.942338 +0000 UTC |
Beta Was this translation helpful? Give feedback.
Replies: 3 comments 4 replies
-
|
hi you can always provide your own schema if that's what you want. The docs are here As far as this custom check is concerned, what are you trying to do? |
Beta Was this translation helpful? Give feedback.
-
|
Hi @simar7, thanks for your reply!
Thanks, I did had a look at it but the thing I'm not sure about: will the schema dictate how the configuration files are parsed by
In this case (the example I shared) a simple check is done to make sure that the google_service_account_key resource is not being used in configurations. Something we also limit on permission level, but this check is a nice to have for doing 'static analysis', thus warning before doing a |
Beta Was this translation helpful? Give feedback.
-
|
In attempt to get more insight in how the # METADATA
# title: "Trying to see what the input is"
# schemas:
# - input: schema.input
# custom:
# id: foo
# severity: HIGH
# input:
# combine: true
package custom.foo
deny[res]{
msg := sprintf("%v", [input])
res := result.new(msg, input)
}
Running Although multiple The |
Beta Was this translation helpful? Give feedback.
-
|
I think I found out what is happening for my example. Why the JSON didn't contain expected data. In my example After adding something like Sharing my test setup for completeness:
# METADATA
# title: "Trying to see what the input is"
# description: "Printing the complete input"
# custom:
# id: foo
# severity: HIGH
package custom.foo
deny[res]{
msg := sprintf("%v", [input])
res := result.new(msg, input)
}
resource "google_service_account" "myaccount" {
account_id = "myaccount"
display_name = "My Service Account"
}
resource "google_service_account_key" "mykey" {
service_account_id = google_service_account.myaccount.name
public_key_type = "TYPE_X509_PEM_FILE"
}
# Adding a resource that is known in https://github.com/aquasecurity/trivy-iac/tree/main/internal/adapters/terraform/google
resource "google_project_iam_member" "secret-accessor-on-project-level" {
project = "your-project-id"
role = "roles/secretmanager.secretAccessor"
member = "serviceAccount:your-service@your-project-id.iam.gserviceaccount.com"
}Command: Output: The printed JSON then contains data under |
Beta Was this translation helpful? Give feedback.
-
|
This is off-topic from my original question. But it is an outcome of putting in some time and effort to get our custom checks to work with Because I now have the feeling that the structure of the For me, referring to Is it perhaps also possible in |
Beta Was this translation helpful? Give feedback.
-
|
I understand but as I mentioned you can always specify a custom schema if you want. As for comparison with conftest, Trivy provides support for many IaC (e.g. CloudFormation, Azure ARM etc.) so making it specific to HCL isn't ideal. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for your replies! I'm going to close this discussion. |
Beta Was this translation helpful? Give feedback.
I think I found out what is happening for my example. Why the JSON didn't contain expected data.
In my example
main.tfI usedresource "google_service_account".But I think that this kind of resource is not recognized. That's at least my impression after browsing this code: https://github.com/aquasecurity/trivy-iac/tree/main/internal/adapters/terraform/google.
After adding something like
resource "google_project_iam_member"to themain.tfI do see that the JSON includes GCP specific information.Sharing my test setup for completeness:
deny.rego: