feat(terraform): PC-Policy-Team: Ensure GCP compute firewall ingress does not allow unrestricted access to all ports

checkov/terraform/checks/graph_checks/gcp/GCPComputeFirewallOverlyPermissiveToAllTraffic.yaml

@@ -0,0 +1,34 @@
+metadata:
+  name: "Ensure GCP compute firewall ingress does not allow unrestricted access to all ports"
+  id: "CKV2_GCP_12"
+  category: "NETWORKING"
+definition:
+  or:
+    - cond_type: "attribute"
+      resource_types:
+        - "google_compute_firewall"
+      attribute: "disabled"
+      operator: "equals"
+      value: "true"
+    - cond_type: "attribute"
+      resource_types:
+        - "google_compute_firewall"
+      attribute: "direction"
+      operator: "equals"
+      value: "EGRESS"
+    - cond_type: "attribute"
+      resource_types:
+        - "google_compute_firewall"
+      attribute: "allow.protocol"
+      operator: "not_equals"
+      value: "all"
+    - cond_type: "attribute"
+      resource_types:
+        - "google_compute_firewall"
+      attribute: "source_ranges"
+      operator: "within"
+      value:
+        - "::/0"
+        - "::0"
+        - "0.0.0.0"
+        - "0.0.0.0/0"

tests/terraform/graph/checks/resources/GCPComputeFirewallOverlyPermissiveToAllTraffic/expected.yaml

@@ -0,0 +1,9 @@
+pass:
+  - "google_compute_firewall.compute-firewall-ok-1"
+  - "google_compute_firewall.compute-firewall-ok-2"
+  - "google_compute_firewall.compute-firewall-ok-3"
+fail:
+  - "google_compute_firewall.compute-firewall-not-ok-1"
+  - "google_compute_firewall.compute-firewall-not-ok-2"
+  - "google_compute_firewall.compute-firewall-not-ok-3"
+  - "google_compute_firewall.compute-firewall-not-ok-4"

tests/terraform/graph/checks/resources/GCPComputeFirewallOverlyPermissiveToAllTraffic/main.tf

@@ -0,0 +1,89 @@
+resource "google_compute_network" "example" {
+  name = "example"
+  auto_create_subnetworks = false
+}
+
+#case1 - PASS
+resource "google_compute_firewall" "compute-firewall-ok-1" {
+  name    = "compute-firewall-ok-1"
+  network = google_compute_network.example.name
+
+  deny {
+    protocol = "all"
+  }
+  source_ranges = ["0.0.0.0/0"]
+  disabled = false
+}
+
+#case2 - PASS
+resource "google_compute_firewall" "compute-firewall-ok-2" {
+  name    = "compute-firewall-ok-2"
+  network = google_compute_network.example.name
+
+  allow {
+    protocol = "all"
+  }
+  source_ranges = ["::/0"]
+  disabled = true
+}
+
+#case3 - PASS
+resource "google_compute_firewall" "compute-firewall-ok-3" {
+  name    = "compute-firewall-ok-3"
+  network = google_compute_network.example.name
+
+  allow {
+    protocol = "tcp"
+    ports = ["140"]
+  }
+  source_ranges = ["0.0.0.0", "192.168.2.0"]
+  disabled = false
+}
+
+#case4 - FAIL
+resource "google_compute_firewall" "compute-firewall-not-ok-1" {
+  name    = "compute-firewall-not-ok-1"
+  network = google_compute_network.example.name
+
+  allow {
+    protocol = "all"
+  }
+  source_ranges = ["::/0"]
+  disabled = false
+}
+
+#case5 - FAIL
+resource "google_compute_firewall" "compute-firewall-not-ok-2" {
+  name    = "compute-firewall-not-ok-2"
+  network = google_compute_network.example.name
+
+  allow {
+    protocol = "all"
+  }
+  source_ranges = ["0.0.0.0", "192.168.2.0"]
+  disabled = false
+}
+
+#case6 - FAIL
+resource "google_compute_firewall" "compute-firewall-not-ok-3" {
+  name    = "compute-firewall-not-ok-3"
+  network = google_compute_network.example.name
+
+  allow {
+    protocol = "all"
+  }
+  source_ranges = ["0.0.0.0/0"]
+  disabled = false
+}
+
+#case7 - FAIL
+resource "google_compute_firewall" "compute-firewall-not-ok-4" {
+  name    = "compute-firewall-not-ok-4"
+  network = google_compute_network.example.name
+
+  allow {
+    protocol = "all"
+  }
+  source_ranges = ["::0"]
+  disabled = false
+}

tests/terraform/graph/checks/test_yaml_policies.py

@@ -260,6 +260,9 @@ def test_S3BucketReplicationConfiguration(self):
     def test_AppLoadBalancerTLS12(self):
         self.go("AppLoadBalancerTLS12")
 
+    def test_GCPComputeFirewallOverlyPermissiveToAllTraffic(self):
+        self.go("GCPComputeFirewallOverlyPermissiveToAllTraffic")
+
     def test_registry_load(self):
         registry = Registry(parser=NXGraphCheckParser(), checks_dir=str(
             Path(__file__).parent.parent.parent.parent.parent / "checkov" / "terraform" / "checks" / "graph_checks"))