diff --git a/validation/scenario-cloudformation-secret-fail/master-snapshot.json b/validation/scenario-cloudformation-secret-fail/master-snapshot.json new file mode 100644 index 0000000..7eae09a --- /dev/null +++ b/validation/scenario-cloudformation-secret-fail/master-snapshot.json @@ -0,0 +1,19 @@ +{ + "fileType": "masterSnapshot", + "snapshots": [ + { + "source": "gitConnectorCloudformation", + "testUser": "Shahin", + "nodes": [ + { + "masterSnapshotId": "ref_", + "type": "cloudformation", + "collection": "cloudFormation", + "paths":[ + "/leaked_secret/" + ] + } + ] + } + ] +} \ No newline at end of file diff --git a/validation/scenario-cloudformation-secret-fail/master-snapshot_gen.json b/validation/scenario-cloudformation-secret-fail/master-snapshot_gen.json new file mode 100644 index 0000000..3140a1e --- /dev/null +++ b/validation/scenario-cloudformation-secret-fail/master-snapshot_gen.json @@ -0,0 +1,22 @@ +{ + "fileType": "snapshot", + "snapshots": [ + { + "source": "gitConnectorCloudformation", + "testUser": "Shahin", + "nodes": [ + { + "masterSnapshotId": "ref_", + "type": "cloudformation", + "collection": "cloudFormation", + "paths": [ + "/leaked_secret/secret.yaml" + ], + "snapshotId": "ref_1", + "status": "active", + "validate": true + } + ] + } + ] +} \ No newline at end of file diff --git a/validation/scenario-cloudformation-secret-fail/master-test.json b/validation/scenario-cloudformation-secret-fail/master-test.json new file mode 100644 index 0000000..befdde3 --- /dev/null +++ b/validation/scenario-cloudformation-secret-fail/master-test.json @@ -0,0 +1,40 @@ +{ + "fileType":"mastertest", + "masterSnapshot":"master-snapshot", + "testSet": [ + { + "masterTestName": "AWS_TEST", + "version": "0.1", + "cases": [ + { + "masterTestId": "TEST_Ref_1", + "masterSnapshotId": [ + "ref_" + ], + "type":"rego", + "rule": "file(secrets.rego)", + "evals": [ + { + "id": "PR-AWS-0028-RGX", + "eval": "data.rule.gl_aws_secrets" + } + ] + }, + { + "masterTestId": "TEST_Ref_2", + "masterSnapshotId": [ + "ref_" + ], + "type":"rego", + "rule": "file(secrets.rego)", + "evals": [ + { + "id": "PR-AWS-0029-RGX", + "eval": "data.rule.gl_aws_account" + } + ] + } + ] + } + ] +} \ No newline at end of file diff --git a/validation/scenario-cloudformation-secret-fail/secrets.rego b/validation/scenario-cloudformation-secret-fail/secrets.rego new file mode 100644 index 0000000..dec51b2 --- /dev/null +++ b/validation/scenario-cloudformation-secret-fail/secrets.rego @@ -0,0 +1,78 @@ +package rule + +# PR-AWS-0028-RGX +# + +default gl_aws_secrets = null + +aws_issue["gl_aws_secrets"] { + [path, value] := walk(input) + regexp := "^[A-Za-z0-9/\\+=]{40}$" + regex.match(regexp, format_int(value, 10)) + regex.match("^(?i)aws_?(secret)?_?(access)?_?key$", path[_]) +} + +aws_issue["gl_aws_secrets"] { + [path, value] := walk(input) + regexp := "^[A-Za-z0-9/\\+=]{40}$" + regex.match(regexp, value) + regex.match("^(?i)aws_?(secret)?_?(access)?_?key$", path[_]) +} + +gl_aws_secrets = false { + aws_issue["gl_aws_secrets"] +} + +gl_aws_secrets_err = "There is a possibility that AWS secret has leaked" { + aws_issue["gl_aws_secrets"] +} + +gl_aws_secrets_metadata := { + "Policy Code": "PR-AWS-0028-RGX", + "Type": "IaC", + "Product": "AWS", + "Language": "AWS Cloud formation", + "Policy Title": "Secrets should be removed from the source code", + "Policy Description": "We should not have any secret in the source code. Make sure to put the secrets in a vault", + "Resource Type": "", + "Policy Help URL": "", + "Resource Help URL": "" +} + +# +# PR-AWS-0029-RGX +# + +default gl_aws_account = null + +aws_issue["gl_aws_account"] { + [path, value] := walk(input) + regexp := "^[0-9]{12}$" + regex.match(regexp, format_int(value, 10)) +} + +aws_issue["gl_aws_account"] { + [path, value] := walk(input) + regexp := "^[0-9]{12}$" + regex.match(regexp, value) +} + +gl_aws_account = false { + aws_issue["gl_aws_account"] +} + +gl_aws_account_err = "There is a possibility that AWS account ID has leaked" { + aws_issue["gl_aws_account"] +} + +gl_aws_account_metadata := { + "Policy Code": "PR-AWS-0029-RGX", + "Type": "IaC", + "Product": "AWS", + "Language": "AWS Cloud formation", + "Policy Title": "Secrets should be removed from the source code", + "Policy Description": "We should not have any secret in the source code. Make sure to put the secrets in a vault", + "Resource Type": "", + "Policy Help URL": "", + "Resource Help URL": "" +} diff --git a/validation/scenario-cloudformation-secret-fail/snapshots/ref_1 b/validation/scenario-cloudformation-secret-fail/snapshots/ref_1 new file mode 100644 index 0000000..3eb8e13 --- /dev/null +++ b/validation/scenario-cloudformation-secret-fail/snapshots/ref_1 @@ -0,0 +1,80 @@ +{ + "structure": "filesystem", + "error": null, + "reference": "master", + "contentType": "yaml", + "source": "gitConnectorCloudformation", + "paths": [ + "/leaked_secret/secret.yaml" + ], + "timestamp": 1631619532149, + "queryuser": null, + "checksum": "99914b932bd37a50b983c5e7c90ae93b", + "node": { + "masterSnapshotId": "ref_", + "type": "cloudformation", + "collection": "cloudFormation", + "paths": [ + "/leaked_secret/secret.yaml" + ], + "snapshotId": "ref_1", + "status": "active", + "validate": true + }, + "snapshotId": "ref_1", + "collection": "cloudformation", + "json": { + "AWSTemplateFormatVersion": "2010-09-09", + "Resources": [ + { + "Type": "AWS::Lambda::Function", + "Properties": { + "Environment": { + "Variables": { + "AWS_SECRET_ACCESS_KEY": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", + "AWS_ACCESS_KEY_ID": "ASIAIOSFODNN7EXAMPLE", + "AWS_ACCOUNT_ID": "123456789012" + } + }, + "Runtime": "nodejs12.x", + "Role": { + "Fn::GetAtt": [ + "FunctionExecutionRole", + "Arn" + ] + }, + "Handler": "index.handler", + "Code": { + "ZipFile": "exports.handler = async (event) => {\n const response = {\n statusCode: 200,\n body: JSON.stringify('Hello from Lambda!'),\n };\n return response;\n};\n" + } + }, + "Name": "MyProxyFunction" + }, + { + "Type": "AWS::IAM::Role", + "Properties": { + "AssumeRolePolicyDocument": { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": { + "Service": [ + "lambda.amazonaws.com" + ] + }, + "Action": [ + "sts:AssumeRole" + ] + } + ] + }, + "ManagedPolicyArns": [ + "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" + ] + }, + "Name": "FunctionExecutionRole" + } + ] + } +} \ No newline at end of file diff --git a/validation/scenario-cloudformation-secret-pass/master-snapshot.json b/validation/scenario-cloudformation-secret-pass/master-snapshot.json new file mode 100644 index 0000000..7805808 --- /dev/null +++ b/validation/scenario-cloudformation-secret-pass/master-snapshot.json @@ -0,0 +1,19 @@ +{ + "fileType": "masterSnapshot", + "snapshots": [ + { + "source": "gitConnectorCloudformation", + "testUser": "Shahin", + "nodes": [ + { + "masterSnapshotId": "ref_", + "type": "cloudformation", + "collection": "cloudFormation", + "paths":[ + "/lambda/" + ] + } + ] + } + ] +} \ No newline at end of file diff --git a/validation/scenario-cloudformation-secret-pass/master-snapshot_gen.json b/validation/scenario-cloudformation-secret-pass/master-snapshot_gen.json new file mode 100644 index 0000000..437bfc2 --- /dev/null +++ b/validation/scenario-cloudformation-secret-pass/master-snapshot_gen.json @@ -0,0 +1,22 @@ +{ + "fileType": "snapshot", + "snapshots": [ + { + "source": "gitConnectorCloudformation", + "testUser": "Shahin", + "nodes": [ + { + "masterSnapshotId": "ref_", + "type": "cloudformation", + "collection": "cloudFormation", + "paths": [ + "/lambda/lambda-sample.yaml" + ], + "snapshotId": "ref_1", + "status": "active", + "validate": true + } + ] + } + ] +} \ No newline at end of file diff --git a/validation/scenario-cloudformation-secret-pass/master-test.json b/validation/scenario-cloudformation-secret-pass/master-test.json new file mode 100644 index 0000000..befdde3 --- /dev/null +++ b/validation/scenario-cloudformation-secret-pass/master-test.json @@ -0,0 +1,40 @@ +{ + "fileType":"mastertest", + "masterSnapshot":"master-snapshot", + "testSet": [ + { + "masterTestName": "AWS_TEST", + "version": "0.1", + "cases": [ + { + "masterTestId": "TEST_Ref_1", + "masterSnapshotId": [ + "ref_" + ], + "type":"rego", + "rule": "file(secrets.rego)", + "evals": [ + { + "id": "PR-AWS-0028-RGX", + "eval": "data.rule.gl_aws_secrets" + } + ] + }, + { + "masterTestId": "TEST_Ref_2", + "masterSnapshotId": [ + "ref_" + ], + "type":"rego", + "rule": "file(secrets.rego)", + "evals": [ + { + "id": "PR-AWS-0029-RGX", + "eval": "data.rule.gl_aws_account" + } + ] + } + ] + } + ] +} \ No newline at end of file diff --git a/validation/scenario-cloudformation-secret-pass/secrets.rego b/validation/scenario-cloudformation-secret-pass/secrets.rego new file mode 100644 index 0000000..dec51b2 --- /dev/null +++ b/validation/scenario-cloudformation-secret-pass/secrets.rego @@ -0,0 +1,78 @@ +package rule + +# PR-AWS-0028-RGX +# + +default gl_aws_secrets = null + +aws_issue["gl_aws_secrets"] { + [path, value] := walk(input) + regexp := "^[A-Za-z0-9/\\+=]{40}$" + regex.match(regexp, format_int(value, 10)) + regex.match("^(?i)aws_?(secret)?_?(access)?_?key$", path[_]) +} + +aws_issue["gl_aws_secrets"] { + [path, value] := walk(input) + regexp := "^[A-Za-z0-9/\\+=]{40}$" + regex.match(regexp, value) + regex.match("^(?i)aws_?(secret)?_?(access)?_?key$", path[_]) +} + +gl_aws_secrets = false { + aws_issue["gl_aws_secrets"] +} + +gl_aws_secrets_err = "There is a possibility that AWS secret has leaked" { + aws_issue["gl_aws_secrets"] +} + +gl_aws_secrets_metadata := { + "Policy Code": "PR-AWS-0028-RGX", + "Type": "IaC", + "Product": "AWS", + "Language": "AWS Cloud formation", + "Policy Title": "Secrets should be removed from the source code", + "Policy Description": "We should not have any secret in the source code. Make sure to put the secrets in a vault", + "Resource Type": "", + "Policy Help URL": "", + "Resource Help URL": "" +} + +# +# PR-AWS-0029-RGX +# + +default gl_aws_account = null + +aws_issue["gl_aws_account"] { + [path, value] := walk(input) + regexp := "^[0-9]{12}$" + regex.match(regexp, format_int(value, 10)) +} + +aws_issue["gl_aws_account"] { + [path, value] := walk(input) + regexp := "^[0-9]{12}$" + regex.match(regexp, value) +} + +gl_aws_account = false { + aws_issue["gl_aws_account"] +} + +gl_aws_account_err = "There is a possibility that AWS account ID has leaked" { + aws_issue["gl_aws_account"] +} + +gl_aws_account_metadata := { + "Policy Code": "PR-AWS-0029-RGX", + "Type": "IaC", + "Product": "AWS", + "Language": "AWS Cloud formation", + "Policy Title": "Secrets should be removed from the source code", + "Policy Description": "We should not have any secret in the source code. Make sure to put the secrets in a vault", + "Resource Type": "", + "Policy Help URL": "", + "Resource Help URL": "" +} diff --git a/validation/scenario-cloudformation-secret-pass/snapshots/ref_1 b/validation/scenario-cloudformation-secret-pass/snapshots/ref_1 new file mode 100644 index 0000000..ef9081a --- /dev/null +++ b/validation/scenario-cloudformation-secret-pass/snapshots/ref_1 @@ -0,0 +1,147 @@ +{ + "structure": "filesystem", + "error": null, + "reference": "master", + "contentType": "yaml", + "source": "gitConnectorCloudformation", + "paths": [ + "/lambda/lambda-sample.yaml" + ], + "timestamp": 1631619544535, + "queryuser": null, + "checksum": "99914b932bd37a50b983c5e7c90ae93b", + "node": { + "masterSnapshotId": "ref_", + "type": "cloudformation", + "collection": "cloudFormation", + "paths": [ + "/lambda/lambda-sample.yaml" + ], + "snapshotId": "ref_1", + "status": "active", + "validate": true + }, + "snapshotId": "ref_1", + "collection": "cloudformation", + "json": { + "AWSTemplateFormatVersion": "2010-09-09", + "Description": "Template for Lambda Sample.", + "Parameters": { + "EnvName": { + "Type": "String", + "Description": "Name of an environment. 'dev', 'staging', 'prod' and any name.", + "AllowedPattern": "^.*[^0-9]$", + "ConstraintDescription": "Must end with non-numeric character." + }, + "LambdaHandlerPath": { + "Type": "String", + "Description": "Path of a Lambda Handler.", + "AllowedPattern": "^.*[^0-9]$", + "ConstraintDescription": "Must end with non-numeric character." + } + }, + "Outputs": { + "LambdaRoleARN": { + "Description": "Role for Lambda execution.", + "Value": { + "Fn::GetAtt": [ + "LambdaRole", + "Arn" + ] + }, + "Export": { + "Name": { + "Fn::Sub": "LambdaRole" + } + } + }, + "LambdaFunctionName": { + "Value": { + "Ref": "LambdaFunction" + } + }, + "LambdaFunctionARN": { + "Description": "Lambda function ARN.", + "Value": { + "Fn::GetAtt": [ + "LambdaFunction", + "Arn" + ] + }, + "Export": { + "Name": { + "Fn::Sub": "LambdaARN-${EnvName}" + } + } + } + }, + "Resources": [ + { + "Type": "AWS::IAM::Role", + "Properties": { + "RoleName": { + "Fn::Sub": "lambda-role" + }, + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": [ + "sts:AssumeRole" + ], + "Effect": "Allow", + "Principal": { + "Service": [ + "lambda.amazonaws.com" + ] + } + } + ], + "Version": "2012-10-17" + }, + "ManagedPolicyArns": [ + "arn:aws:iam::aws:policy/AWSLambdaExecute", + "arn:aws:iam::aws:policy/AmazonS3FullAccess", + "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess", + "arn:aws:iam::aws:policy/AmazonKinesisFullAccess" + ], + "Path": "/" + }, + "Name": "LambdaRole" + }, + { + "Type": "AWS::Lambda::Function", + "Properties": { + "FunctionName": { + "Fn::Sub": "lambda-function-${EnvName}" + }, + "Description": "LambdaFunctioni of nodejs10.x.", + "Runtime": "nodejs10.x", + "Code": { + "ZipFile": "exports.handler = function(event, context){\n var sample = sample;" + }, + "Handler": "${LambdaHandlerPath}", + "MemorySize": 128, + "Timeout": 10, + "Role": { + "Fn::GetAtt": [ + "LambdaRole", + "Arn" + ] + }, + "TracingConfig": { + "Mode": "PassThrough" + }, + "Environment": { + "Variables": { + "ENV": { + "Fn::Sub": "${EnvName}" + }, + "TZ": "UTC" + } + } + }, + "Name": "LambdaFunction" + } + ] + } +} \ No newline at end of file diff --git a/validation/scenario-terraform-aws-secret-fail/master-snapshot.json b/validation/scenario-terraform-aws-secret-fail/master-snapshot.json new file mode 100644 index 0000000..a6e3243 --- /dev/null +++ b/validation/scenario-terraform-aws-secret-fail/master-snapshot.json @@ -0,0 +1,19 @@ +{ + "fileType": "masterSnapshot", + "snapshots": [ + { + "source": "gitConnectorTerraform", + "testUser": "Shahin", + "nodes": [ + { + "masterSnapshotId": "ref_", + "type": "terraform", + "collection": "terraform", + "paths": [ + "aws/secret/" + ] + } + ] + } + ] +} \ No newline at end of file diff --git a/validation/scenario-terraform-aws-secret-fail/master-snapshot_gen.json b/validation/scenario-terraform-aws-secret-fail/master-snapshot_gen.json new file mode 100644 index 0000000..0784646 --- /dev/null +++ b/validation/scenario-terraform-aws-secret-fail/master-snapshot_gen.json @@ -0,0 +1,22 @@ +{ + "fileType": "snapshot", + "snapshots": [ + { + "source": "gitConnectorTerraform", + "testUser": "Shahin", + "nodes": [ + { + "masterSnapshotId": "ref_", + "type": "terraform", + "collection": "terraform", + "paths": [ + "aws/secret/main.tf" + ], + "snapshotId": "ref_1", + "status": "active", + "validate": true + } + ] + } + ] +} \ No newline at end of file diff --git a/validation/scenario-terraform-aws-secret-fail/master-test.json b/validation/scenario-terraform-aws-secret-fail/master-test.json new file mode 100644 index 0000000..befdde3 --- /dev/null +++ b/validation/scenario-terraform-aws-secret-fail/master-test.json @@ -0,0 +1,40 @@ +{ + "fileType":"mastertest", + "masterSnapshot":"master-snapshot", + "testSet": [ + { + "masterTestName": "AWS_TEST", + "version": "0.1", + "cases": [ + { + "masterTestId": "TEST_Ref_1", + "masterSnapshotId": [ + "ref_" + ], + "type":"rego", + "rule": "file(secrets.rego)", + "evals": [ + { + "id": "PR-AWS-0028-RGX", + "eval": "data.rule.gl_aws_secrets" + } + ] + }, + { + "masterTestId": "TEST_Ref_2", + "masterSnapshotId": [ + "ref_" + ], + "type":"rego", + "rule": "file(secrets.rego)", + "evals": [ + { + "id": "PR-AWS-0029-RGX", + "eval": "data.rule.gl_aws_account" + } + ] + } + ] + } + ] +} \ No newline at end of file diff --git a/validation/scenario-terraform-aws-secret-fail/secrets.rego b/validation/scenario-terraform-aws-secret-fail/secrets.rego new file mode 100644 index 0000000..dec51b2 --- /dev/null +++ b/validation/scenario-terraform-aws-secret-fail/secrets.rego @@ -0,0 +1,78 @@ +package rule + +# PR-AWS-0028-RGX +# + +default gl_aws_secrets = null + +aws_issue["gl_aws_secrets"] { + [path, value] := walk(input) + regexp := "^[A-Za-z0-9/\\+=]{40}$" + regex.match(regexp, format_int(value, 10)) + regex.match("^(?i)aws_?(secret)?_?(access)?_?key$", path[_]) +} + +aws_issue["gl_aws_secrets"] { + [path, value] := walk(input) + regexp := "^[A-Za-z0-9/\\+=]{40}$" + regex.match(regexp, value) + regex.match("^(?i)aws_?(secret)?_?(access)?_?key$", path[_]) +} + +gl_aws_secrets = false { + aws_issue["gl_aws_secrets"] +} + +gl_aws_secrets_err = "There is a possibility that AWS secret has leaked" { + aws_issue["gl_aws_secrets"] +} + +gl_aws_secrets_metadata := { + "Policy Code": "PR-AWS-0028-RGX", + "Type": "IaC", + "Product": "AWS", + "Language": "AWS Cloud formation", + "Policy Title": "Secrets should be removed from the source code", + "Policy Description": "We should not have any secret in the source code. Make sure to put the secrets in a vault", + "Resource Type": "", + "Policy Help URL": "", + "Resource Help URL": "" +} + +# +# PR-AWS-0029-RGX +# + +default gl_aws_account = null + +aws_issue["gl_aws_account"] { + [path, value] := walk(input) + regexp := "^[0-9]{12}$" + regex.match(regexp, format_int(value, 10)) +} + +aws_issue["gl_aws_account"] { + [path, value] := walk(input) + regexp := "^[0-9]{12}$" + regex.match(regexp, value) +} + +gl_aws_account = false { + aws_issue["gl_aws_account"] +} + +gl_aws_account_err = "There is a possibility that AWS account ID has leaked" { + aws_issue["gl_aws_account"] +} + +gl_aws_account_metadata := { + "Policy Code": "PR-AWS-0029-RGX", + "Type": "IaC", + "Product": "AWS", + "Language": "AWS Cloud formation", + "Policy Title": "Secrets should be removed from the source code", + "Policy Description": "We should not have any secret in the source code. Make sure to put the secrets in a vault", + "Resource Type": "", + "Policy Help URL": "", + "Resource Help URL": "" +} diff --git a/validation/scenario-terraform-aws-secret-fail/snapshots/ref_1 b/validation/scenario-terraform-aws-secret-fail/snapshots/ref_1 new file mode 100644 index 0000000..0f63023 --- /dev/null +++ b/validation/scenario-terraform-aws-secret-fail/snapshots/ref_1 @@ -0,0 +1,41 @@ +{ + "structure": "filesystem", + "error": null, + "reference": "master", + "contentType": "terraform", + "source": "gitConnectorTerraform", + "paths": [ + "aws/secret/main.tf" + ], + "timestamp": 1631619561375, + "queryuser": null, + "checksum": "99914b932bd37a50b983c5e7c90ae93b", + "node": { + "masterSnapshotId": "ref_", + "type": "terraform", + "collection": "terraform", + "paths": [ + "aws/secret/main.tf" + ], + "snapshotId": "ref_1", + "status": "active", + "validate": true + }, + "snapshotId": "ref_1", + "collection": "terraform", + "json": { + "resources": [ + { + "type": "alkira_credential_aws_vpc", + "name": "account1", + "properties": { + "name": "customer-aws-1", + "aws_access_key": "ASIAIOSFODNN7EXAMPLE", + "aws_secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", + "aws_account_id": 123456789012, + "type": "ACCESS_KEY" + } + } + ] + } +} \ No newline at end of file diff --git a/validation/scenario-terraform-aws-secret-pass/master-snapshot.json b/validation/scenario-terraform-aws-secret-pass/master-snapshot.json new file mode 100644 index 0000000..a6de6a9 --- /dev/null +++ b/validation/scenario-terraform-aws-secret-pass/master-snapshot.json @@ -0,0 +1,19 @@ +{ + "fileType": "masterSnapshot", + "snapshots": [ + { + "source": "gitConnectorTerraform", + "testUser": "Shahin", + "nodes": [ + { + "masterSnapshotId": "ref_", + "type": "terraform", + "collection": "terraform", + "paths": [ + "aws/elb/" + ] + } + ] + } + ] +} \ No newline at end of file diff --git a/validation/scenario-terraform-aws-secret-pass/master-snapshot_gen.json b/validation/scenario-terraform-aws-secret-pass/master-snapshot_gen.json new file mode 100644 index 0000000..251ef09 --- /dev/null +++ b/validation/scenario-terraform-aws-secret-pass/master-snapshot_gen.json @@ -0,0 +1,25 @@ +{ + "fileType": "snapshot", + "snapshots": [ + { + "source": "gitConnectorTerraform", + "testUser": "Shahin", + "nodes": [ + { + "masterSnapshotId": "ref_", + "type": "terraform", + "collection": "terraform", + "paths": [ + "aws/elb/terraform.tfvars", + "aws/elb/provider.tf", + "aws/elb/vars.tf", + "aws/elb/main.tf" + ], + "snapshotId": "ref_1", + "status": "active", + "validate": true + } + ] + } + ] +} \ No newline at end of file diff --git a/validation/scenario-terraform-aws-secret-pass/master-test.json b/validation/scenario-terraform-aws-secret-pass/master-test.json new file mode 100644 index 0000000..befdde3 --- /dev/null +++ b/validation/scenario-terraform-aws-secret-pass/master-test.json @@ -0,0 +1,40 @@ +{ + "fileType":"mastertest", + "masterSnapshot":"master-snapshot", + "testSet": [ + { + "masterTestName": "AWS_TEST", + "version": "0.1", + "cases": [ + { + "masterTestId": "TEST_Ref_1", + "masterSnapshotId": [ + "ref_" + ], + "type":"rego", + "rule": "file(secrets.rego)", + "evals": [ + { + "id": "PR-AWS-0028-RGX", + "eval": "data.rule.gl_aws_secrets" + } + ] + }, + { + "masterTestId": "TEST_Ref_2", + "masterSnapshotId": [ + "ref_" + ], + "type":"rego", + "rule": "file(secrets.rego)", + "evals": [ + { + "id": "PR-AWS-0029-RGX", + "eval": "data.rule.gl_aws_account" + } + ] + } + ] + } + ] +} \ No newline at end of file diff --git a/validation/scenario-terraform-aws-secret-pass/secrets.rego b/validation/scenario-terraform-aws-secret-pass/secrets.rego new file mode 100644 index 0000000..dec51b2 --- /dev/null +++ b/validation/scenario-terraform-aws-secret-pass/secrets.rego @@ -0,0 +1,78 @@ +package rule + +# PR-AWS-0028-RGX +# + +default gl_aws_secrets = null + +aws_issue["gl_aws_secrets"] { + [path, value] := walk(input) + regexp := "^[A-Za-z0-9/\\+=]{40}$" + regex.match(regexp, format_int(value, 10)) + regex.match("^(?i)aws_?(secret)?_?(access)?_?key$", path[_]) +} + +aws_issue["gl_aws_secrets"] { + [path, value] := walk(input) + regexp := "^[A-Za-z0-9/\\+=]{40}$" + regex.match(regexp, value) + regex.match("^(?i)aws_?(secret)?_?(access)?_?key$", path[_]) +} + +gl_aws_secrets = false { + aws_issue["gl_aws_secrets"] +} + +gl_aws_secrets_err = "There is a possibility that AWS secret has leaked" { + aws_issue["gl_aws_secrets"] +} + +gl_aws_secrets_metadata := { + "Policy Code": "PR-AWS-0028-RGX", + "Type": "IaC", + "Product": "AWS", + "Language": "AWS Cloud formation", + "Policy Title": "Secrets should be removed from the source code", + "Policy Description": "We should not have any secret in the source code. Make sure to put the secrets in a vault", + "Resource Type": "", + "Policy Help URL": "", + "Resource Help URL": "" +} + +# +# PR-AWS-0029-RGX +# + +default gl_aws_account = null + +aws_issue["gl_aws_account"] { + [path, value] := walk(input) + regexp := "^[0-9]{12}$" + regex.match(regexp, format_int(value, 10)) +} + +aws_issue["gl_aws_account"] { + [path, value] := walk(input) + regexp := "^[0-9]{12}$" + regex.match(regexp, value) +} + +gl_aws_account = false { + aws_issue["gl_aws_account"] +} + +gl_aws_account_err = "There is a possibility that AWS account ID has leaked" { + aws_issue["gl_aws_account"] +} + +gl_aws_account_metadata := { + "Policy Code": "PR-AWS-0029-RGX", + "Type": "IaC", + "Product": "AWS", + "Language": "AWS Cloud formation", + "Policy Title": "Secrets should be removed from the source code", + "Policy Description": "We should not have any secret in the source code. Make sure to put the secrets in a vault", + "Resource Type": "", + "Policy Help URL": "", + "Resource Help URL": "" +} diff --git a/validation/scenario-terraform-aws-secret-pass/snapshots/ref_1 b/validation/scenario-terraform-aws-secret-pass/snapshots/ref_1 new file mode 100644 index 0000000..df1ef3e --- /dev/null +++ b/validation/scenario-terraform-aws-secret-pass/snapshots/ref_1 @@ -0,0 +1,210 @@ +{ + "structure": "filesystem", + "error": null, + "reference": "master", + "contentType": "terraform", + "source": "gitConnectorTerraform", + "paths": [ + "aws/elb/terraform.tfvars", + "aws/elb/provider.tf", + "aws/elb/vars.tf", + "aws/elb/main.tf" + ], + "timestamp": 1631619574649, + "queryuser": null, + "checksum": "99914b932bd37a50b983c5e7c90ae93b", + "node": { + "masterSnapshotId": "ref_", + "type": "terraform", + "collection": "terraform", + "paths": [ + "aws/elb/terraform.tfvars", + "aws/elb/provider.tf", + "aws/elb/vars.tf", + "aws/elb/main.tf" + ], + "snapshotId": "ref_1", + "status": "active", + "validate": true + }, + "snapshotId": "ref_1", + "collection": "terraform", + "json": { + "data": { + "aws_region": { + "current": {} + } + }, + "resources": [ + { + "type": "aws_vpc", + "name": "vpc", + "properties": { + "cidr_block": "10.10.0.0/16", + "instance_tenancy": "default", + "enable_dns_hostnames": false, + "enable_dns_support": true, + "enable_classiclink": null, + "enable_classiclink_dns_support": null, + "assign_generated_ipv6_cidr_block": false, + "tags": { + "environment": "Production", + "project": "Prancer" + }, + "enable_ipv6": false + } + }, + { + "type": "aws_internet_gateway", + "name": "gateway", + "properties": { + "vpc_id": "${module.vpc.vpc_id}", + "tags": { + "environment": "Production", + "project": "Prancer" + } + } + }, + { + "type": "aws_subnet", + "name": "subnet", + "properties": { + "vpc_id": "${module.vpc.vpc_id}", + "cidr_block": "10.10.1.0/24", + "availability_zone": "${data.aws_region.current.name}${element(var.az, count.index)}", + "availability_zone_id": null, + "map_public_ip_on_launch": false, + "assign_ipv6_address_on_creation": false, + "ipv6_cidr_block": null, + "tags": { + "environment": "Production", + "project": "Prancer" + }, + "subnet_cidr_block": "10.10.1.0/24" + } + }, + { + "type": "aws_subnet", + "name": "subnet", + "properties": { + "vpc_id": "${module.vpc.vpc_id}", + "cidr_block": "10.10.3.0/24", + "availability_zone": "${data.aws_region.current.name}${element(var.az, count.index)}", + "availability_zone_id": null, + "map_public_ip_on_launch": false, + "assign_ipv6_address_on_creation": false, + "ipv6_cidr_block": null, + "tags": { + "environment": "Production", + "project": "Prancer" + }, + "subnet_cidr_block": "10.10.3.0/24" + } + }, + { + "type": "aws_lb", + "name": "lb", + "properties": { + "name": "prancer-lb", + "name_prefix": null, + "load_balancer_type": "application", + "internal": false, + "security_groups": [], + "subnets": [ + "${module.subnets[0].id}", + "${module.subnets[1].id}" + ], + "idle_timeout": 400, + "enable_cross_zone_load_balancing": false, + "enable_deletion_protection": false, + "enable_http2": true, + "ip_address_type": "ipv4", + "drop_invalid_header_fields": false, + "access_logs": [], + "subnet_mapping": [], + "tags": {}, + "timeouts": [ + { + "create": "10m", + "update": "10m", + "delete": "10m" + } + ] + } + }, + { + "type": "aws_elb", + "name": "elb", + "properties": { + "name": "prancer-elb", + "availability_zones": [ + "us-east-2a", + "us-east-2b" + ], + "security_groups": [], + "access_logs": [], + "listener": [ + { + "instance_port": 8000, + "instance_protocol": "http", + "lb_port": 80, + "lb_protocol": "http", + "ssl_certificate_id": null + } + ], + "health_check": [ + { + "healthy_threshold": 2, + "unhealthy_threshold": 2, + "timeout": 3, + "target": "HTTP:8000/", + "interval": 30 + } + ], + "instances": [], + "cross_zone_load_balancing": false, + "idle_timeout": 400, + "connection_draining": false, + "connection_draining_timeout": 400, + "tags": { + "Name": "foobar-terraform-elb" + }, + "logging_enabled": false, + "bucket": "", + "bucket_prefix": "", + "log_interval": 60, + "healthy_threshold": 2, + "unhealthy_threshold": 2, + "timeout": 3, + "target": "HTTP:8000/", + "check_interval": 30 + } + }, + { + "type": "aws_load_balancer_policy", + "name": "elbpolicy", + "properties": { + "load_balancer_name": "${module.elb.id}", + "policy_name": "prancer-cipher", + "policy_type_name": "SSLNegotiationPolicyType", + "policy_attribute": [ + { + "name": "RC4-MD5", + "value": true + }, + { + "name": "Protocol-SSLv3", + "value": true + } + ], + "elb_name": "${module.elb.id}", + "policy_type": "SSLNegotiationPolicyType", + "policy_attribute_map": { + "RC4-MD5": true, + "Protocol-SSLv3": true + } + } + } + ] + } +} \ No newline at end of file