diff --git a/avd_docs/aws/elasticache/AVD-AWS-0196/docs.md b/avd_docs/aws/elasticache/AVD-AWS-0196/docs.md new file mode 100644 index 000000000..06433a177 --- /dev/null +++ b/avd_docs/aws/elasticache/AVD-AWS-0196/docs.md @@ -0,0 +1,13 @@ + +Missing description for security group/security group rule. + +### Impact + + + +{{ remediationActions }} + +### Links +- https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/SecurityGroups.Creating.html + + diff --git a/internal/rules/policies/cloud/policies/aws/elasticache/add_description_for_security_group.rego b/internal/rules/policies/cloud/policies/aws/elasticache/add_description_for_security_group.rego new file mode 100644 index 000000000..afa5dcd64 --- /dev/null +++ b/internal/rules/policies/cloud/policies/aws/elasticache/add_description_for_security_group.rego @@ -0,0 +1,25 @@ +# METADATA +# title: "Elasticache Security Group Description" +# description: "Missing description for security group/security group rule." +# scope: package +# schemas: +# - input: schema.input +# related_resources: +# - https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/SecurityGroups.Creating.html +# custom: +# avd_id: AVD-AWS-0196 +# provider: aws +# service: elasticache +# severity: LOW +# short_code: add-description-for-security-group +# recommended_action: "Security groups and security group rules should include a description for auditing purposes. Simplifies auditing, debugging, and managing security groups." +# input: +# selector: +# - type: cloud +package builtin.aws.elasticache.aws0196 + +deny[res] { + sg := input.aws.elasticache.securitygroups[_] + sg.description.value == "" + res := result.new("Security group does not have a description.", sg.description) +} diff --git a/internal/rules/policies/cloud/policies/aws/elasticache/add_description_for_security_group_test.rego b/internal/rules/policies/cloud/policies/aws/elasticache/add_description_for_security_group_test.rego new file mode 100644 index 000000000..089a07d55 --- /dev/null +++ b/internal/rules/policies/cloud/policies/aws/elasticache/add_description_for_security_group_test.rego @@ -0,0 +1,11 @@ +package builtin.aws.elasticache.aws0196 + +test_detects_when_description_not_have { + r := deny with input as {"aws": {"elasticache": {"securitygroups": [{"description": {"value": ""}}]}}} + count(r) == 1 +} + +test_when_description_have { + r := deny with input as {"aws": {"elasticache": {"securitygroups": [{"description": {"value": "description"}}]}}} + count(r) == 0 +}