feat(misconf): show the resource name in the report

[nikpivkin]

Description

Before

2023-06-06T16:24:07.908-0400    INFO    Misconfiguration scanning is enabled
2023-06-06T16:24:08.307-0400    INFO    Detected config files: 1

terraform-aws-modules/security-group/aws/main.tf (terraform)

Tests: 4 (SUCCESSES: 3, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1)

CRITICAL: Security group rule allows ingress from public internet.
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
 terraform-aws-modules/security-group/aws/main.tf:197-204
 191   resource "aws_security_group_rule" "ingress_with_cidr_blocks" {
 ...   
 197 ┌   cidr_blocks = split(
 198 │     ",",
 199 │     lookup(
 200 │       var.ingress_with_cidr_blocks[count.index],
 201 │       "cidr_blocks",
 202 │       join(",", var.ingress_cidr_blocks),
 203 └     ),
 ...   

After

2023-07-11T14:31:05.741+0600    INFO    Misconfiguration scanning is enabled
2023-07-11T14:31:06.123+0600    INFO    Detected config files: 2

terraform-aws-modules/security-group/aws/main.tf (terraform)

Tests: 6 (SUCCESSES: 5, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1)

CRITICAL: Security group rule allows ingress from public internet.
════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.

See https://avd.aquasec.com/misconfig/avd-aws-0107
──────────────────────────────────────────────────────────────────────────────────────────────────────────
 terraform-aws-modules/security-group/aws/main.tf:197-204
   via terraform-aws-modules/security-group/aws/main.tf:191-227 (aws_security_group_rule.ingress_with_cidr_blocks[0])
    via sg.tf:1-13 (module.aws-security-groups["db1"])
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 191   resource "aws_security_group_rule" "ingress_with_cidr_blocks" {
 ...   
 197 ┌   cidr_blocks = split(
 198 │     ",",
 199 │     lookup(
 200 │       var.ingress_with_cidr_blocks[count.index],
 201 │       "cidr_blocks",
 202 │       join(",", var.ingress_cidr_blocks),
 203 └     ),
 ...   
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Related issues

• Close feat: trivy config terraform should show the resource name #4581

Related PRs

• feat: add the occurrences field defsec#1383

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[simar7]

any update on this @nikpivkin?

[nikpivkin]

@simar7 The changes made to defsec have not yet been merged into trivy

[simar7]

We can add a small test for this change as described. In addition lets also document this behavior as it a user facing change.

[simar7]

Can we add a test case for this? You can add it here https://github.com/aquasecurity/trivy/blob/6cc3c4c9e59d6dcfd4d00ef88c6a25e834bf292d/pkg/report/table/misconfig_test.go

[simar7]

hi @knqyf263 this is a new feature and should go into v0.45.0, is there way to have a merge queue by milestone? Otherwise we will have to wait to merge until the end of the month is here.

[knqyf263]

hi @knqyf263 this is a new feature and should go into v0.45.0, is there way to have a merge queue by milestone?

As far as I know, there is no way to do that.

Otherwise we will have to wait to merge until the end of the month is here.

But v0.44.1 will be out next week, and we can merge this PR just after that.

[knqyf263]

v0.44.1 is out. I'll see if everything is fine in v0.44.1 (if there is a problem, we need to cut v0.44.2) and merge this PR.