Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(queries): add missing check in ec2 instance has public ip #5720

Merged
merged 12 commits into from
Aug 23, 2022
Merged

fix(queries): add missing check in ec2 instance has public ip #5720

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
0031da4
stage
cxMiguelSilva Aug 17, 2022
61b512d
Merge branch 'master' of https://github.com/Checkmarx/kics
cxMiguelSilva Aug 18, 2022
75fc6f1
add missing check in EC2 Instance Has Public IP
cxMiguelSilva Aug 19, 2022
ff22609
add negative samples
cxMiguelSilva Aug 19, 2022
37d674e
add cleanPath
cxMiguelSilva Aug 22, 2022
780fb9c
escaping html
cxMiguelSilva Aug 22, 2022
4cc1d97
fix unhandled error
cxMiguelSilva Aug 22, 2022
ea589b1
ignore command warning
cxMiguelSilva Aug 22, 2022
8add0f7
fix //#nosec
cxMiguelSilva Aug 22, 2022
fc0861a
update no sec
cxMiguelSilva Aug 22, 2022
3756b0f
ignore gosec
cxMiguelSilva Aug 22, 2022
59552cf
remove test.json
cxMiguelSilva Aug 22, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions assets/queries/ansible/aws/ec2_instance_has_public_ip/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,15 @@
package Cx

import data.generic.ansible as ansLib
import data.generic.common as common_lib

CxPolicy[result] {
task := ansLib.tasks[id][t]
modules := {"amazon.aws.ec2", "ec2"}
ec2 := task[modules[m]]
checkState(ec2)

not common_lib.valid_key(ec2, "network_interfaces")
ansLib.isAnsibleTrue(ec2.assign_public_ip)

# There is no default value for assign_public_ip
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/cloudFormation/aws/ec2_subnet_mapping_public_ip_on_launch/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"id": "b3de4e4c-14be-4159-b99d-9ad194365e4c",
"queryName": "EC2 Instance Has Public IP",
"queryName": "EC2 Instance Subnet Has Public IP Mapping On Launch",
"severity": "HIGH",
"category": "Networking and Firewall",
"descriptionText": "EC2 Subnet should not have MapPublicIpOnLaunch set to true",
Expand Down
4 changes: 2 additions & 2 deletions ...udFormation/aws/ec2_subnet_mapping_public_ip_on_launch/test/positive_expected_result.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
[
{
"queryName": "EC2 Instance Has Public IP",
"queryName": "EC2 Instance Subnet Has Public IP Mapping On Launch",
cxMiguelSilva marked this conversation as resolved.
Show resolved Hide resolved
"severity": "HIGH",
"line": 7,
"fileName": "positive1.yaml"
},
{
"queryName": "EC2 Instance Has Public IP",
"queryName": "EC2 Instance Subnet Has Public IP Mapping On Launch",
"severity": "HIGH",
"line": 8,
"fileName": "positive2.json"
Expand Down
6 changes: 6 additions & 0 deletions assets/queries/terraform/aws/ec2_instance_has_public_ip/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ CxPolicy[result] {
resource := input.document[i].resource.aws_instance[name]

not common_lib.valid_key(resource, "associate_public_ip_address")
not common_lib.valid_key(resource, "network_interface")

result := {
"documentId": input.document[i].id,
Expand All @@ -23,7 +24,9 @@ CxPolicy[result] {
CxPolicy[result] {
module := input.document[i].module[name]
keyToCheck := common_lib.get_module_equivalent_key("aws", module.source, "aws_instance", "associate_public_ip_address")
netInterfaceKey := common_lib.get_module_equivalent_key("aws", module.source, "aws_instance", "network_interface")

not common_lib.valid_key(module, netInterfaceKey)
not common_lib.valid_key(module, keyToCheck)

result := {
Expand All @@ -42,6 +45,7 @@ CxPolicy[result] {
resource := input.document[i].resource.aws_instance[name]

isTrue(resource.associate_public_ip_address)
not common_lib.valid_key(resource, "network_interface")

result := {
"documentId": input.document[i].id,
Expand All @@ -58,7 +62,9 @@ CxPolicy[result] {
CxPolicy[result] {
module := input.document[i].module[name]
keyToCheck := common_lib.get_module_equivalent_key("aws", module.source, "aws_instance", "associate_public_ip_address")
netInterfaceKey := common_lib.get_module_equivalent_key("aws", module.source, "aws_instance", "network_interface")

not common_lib.valid_key(module, netInterfaceKey)
isTrue(module[keyToCheck])

result := {
Expand Down
Loading