accurics.azure.AKS.3 is defective

[xortim]

• terrascan version: 1.50
• Operating System: all

Description

Using terrascan to interrogate a Terraform plan file. When attempting to resolve the HIGH severity error produced by terrascan with regard to resource locks on azure resources, the provided rule does not compare the relevant components to determine if a lock is present.

What I Did

main.tf

locals {
  name_prefix = "prefix"
  name_suffix = "suffix"
}

resource "azurerm_container_registry" "this" {
  name                = "${local.name_prefix}acr${local.name_suffix}"
  resource_group_name = "resource_group_name"
  location            = "eastus"

  sku                      = var.sku
  admin_enabled            = var.admin_enabled
}

resource "azurerm_management_lock" "this" {
  name       = "${local.name_prefix}acr${local.name_suffix}"
  scope      = azurerm_container_registry.this.id
  lock_level = "CanNotDelete"
  notes      = "Managed by terraform. Locked for the warm and fuzzies"
}

This rule is trigged as a violation containerRegistryResourceLock.rego

I enabled debugging mode and grabbed the "expected" result and decoded it.

{
    "reme_containerRegistryResourceLock": [
        {
            "Actual": null,
            "Attribute": "",
            "AttributeDataType": "resource",
            "CodeType": "resource",
            "Expected": "cmVzb3VyY2UgImF6dXJlcm1fbWFuYWdlbWVudF9sb2NrIiAidGhpcyIgewogIG5hbWUgICAgICAgPSAiYXp1cmVybV9tYW5hZ2VtZW50X2xvY2sudGhpcyIKICBzY29wZSAgICAgID0gYXp1cmVybV9jb250YWluZXJfcmVnaXN0cnkudGhpcy5pZAogIGxvY2tfbGV2ZWwgPSAiQ2FuTm90RGVsZXRlIgogICMgYXp1cmVybV9tYW5hZ2VtZW50X2xvY2sgZG9lcyBub3QgY29udGFpbiB0YWdzLCBhbmQgd2UgY2Fubm90IG1hdGNoIHRoZW0gbm90IHVubGVzcyB0aGUgcmVzb3VyY2UgaXMgZGVwbG95ZWQgaW4gdGhlIGNsb3VkLgogIG5vdGVzICAgICAgPSAiQ2Fubm90IERlbGV0ZSBSZXNvdXJjZSIKfQ==",
            "Id": "azurerm_container_registry.this",
            "ReplaceType": "add",
            "Traverse": ""
        }
    ]
}

The expected lock resource is:

resource "azurerm_management_lock" "this" {
  name       = "azurerm_management_lock.this"
  scope      = azurerm_container_registry.this.id
  lock_level = "CanNotDelete"
  # azurerm_management_lock does not contain tags, and we cannot match them not unless the resource is deployed in the cloud.
  notes      = "Cannot Delete Resource"
}