feat(terraform): 7 new policies #7056

TomerSegev241 · 2025-03-17T08:52:54Z

User description

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Description

Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change.

Fixes # (issue)

New/Edited policies (Delete if not relevant)

Description

Include a description of what makes it a violation and any relevant external links.

Fix

How does someone fix the issue in code and/or in runtime?

Checklist:

I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
I have added tests that prove my feature, policy, or fix is effective and works
New and existing tests pass locally with my changes

Generated description

Below is a concise technical summary of the changes proposed in this PR:

Topic

Details

Unit Testing

Adds comprehensive unit tests for each new AWS security policy, ensuring proper functionality and integration with the Checkov framework

Modified files (7)

tests/terraform/checks/resource/aws/test_S3BucketPubliclyReadableViaACL.py
tests/terraform/checks/resource/aws/test_AutoScalingGroupWithPublicAccess.py
tests/terraform/checks/resource/aws/test_RedshiftClusterWithCommonUsernameAndPublicAccess.py
tests/terraform/checks/resource/aws/test_EMRPubliclyAccessible.py
tests/terraform/checks/resource/aws/test_UnpatchedAuroraPostgresDB.py
tests/terraform/checks/resource/aws/test_S3AccessPointPubliclyAccessible.py
tests/terraform/checks/resource/aws/test_WAFv2VulnerableForLog4j.py

Latest Contributors(0)

User	Commit	Date

AWS Security Policies

Implements 7 new security policies for AWS resources, addressing various security concerns including public access, vulnerable configurations, and common misconfigurations

Modified files (7)

checkov/terraform/checks/resource/aws/S3BucketPubliclyReadableViaACL.py
checkov/terraform/checks/resource/aws/AutoScalingGroupWithPublicAccess.py
checkov/terraform/checks/resource/aws/RedshiftClusterWithCommonUsernameAndPublicAccess.py
checkov/terraform/checks/resource/aws/EMRPubliclyAccessible.py
checkov/terraform/checks/resource/aws/UnpatchedAuroraPostgresDB.py
checkov/terraform/checks/resource/aws/S3AccessPointPubliclyAccessible.py
checkov/terraform/checks/resource/aws/WAFv2VulnerableForLog4j.py

Latest Contributors(0)

User	Commit	Date

Module Integration

Updates the __init__.py file to integrate the new security policies into the Checkov framework, ensuring they are properly loaded and executed during scans

Modified files (1)

__init__.py

Latest Contributors(0)

User	Commit	Date

Test Resources

Provides example Terraform configurations for each new policy, demonstrating both compliant and non-compliant scenarios to facilitate accurate testing and user understanding

Modified files (7)

tests/terraform/checks/resource/aws/example_S3BucketPubliclyReadableViaACL/main.tf
tests/terraform/checks/resource/aws/example_AutoScalingGroupWithPublicAccess/main.tf
tests/terraform/checks/resource/aws/example_WAFv2VulnerableForLog4j/main.tf
tests/terraform/checks/resource/aws/example_UnpatchedAuroraPostgresDB/main.tf
tests/terraform/checks/resource/aws/example_EMRPubliclyAccessible/main.tf
tests/terraform/checks/resource/aws/example_RedshiftClusterWithCommonUsernameAndPublicAccess/main.tf
tests/terraform/checks/resource/aws/example_S3AccessPointPubliclyAccessible/main.tf

Latest Contributors(0)

User	Commit	Date

This pull request is reviewed by Baz. Join @TomerSegev241 and the rest of your team on (Baz).

tsmithv11

Nice work! Left some comments. Also:

Please add in the description the CKV ID to Prisma Cloud ID mapping
Make sure the tests pass
Add evaluated_keys or get_evaluated_keys

checkov/terraform/checks/resource/aws/AutoScalingGroupWithPublicAccess.py

checkov/terraform/checks/resource/aws/EMRPubliclyAccessible.py

tsmithv11 · 2025-03-21T23:42:30Z

checkov/terraform/checks/resource/aws/EMRPubliclyAccessible.py

+    def scan_resource_conf(self, conf):
+        if 'block_public_access' in conf:
+            for arg in list(conf['block_public_access'][0].keys()):
+                if arg in ['block_public_acls', 'ignore_public_acls', 'restrict_public_buckets']:
+                    if str(conf['block_public_access'][0][arg][0]).lower() == 'false':
+                        return CheckResult.FAILED
+        return CheckResult.PASSED


These attributes don't exist. You want to check if block_public_security_group_rules is true (BaseResourceValueCheck)

checkov/terraform/checks/resource/aws/RedshiftClusterWithCommonUsernameAndPublicAccess.py

tsmithv11 · 2025-03-21T23:54:49Z

checkov/terraform/checks/resource/aws/RedshiftClusterWithCommonUsernameAndPublicAccess.py

+                if 'publicly_accessible' in conf:
+                    if str(conf['publicly_accessible'][0]).lower() == 'true':
+                        return CheckResult.FAILED


Default publicly_accessible is true, so also check for the absence of the attribute

tsmithv11 · 2025-03-21T23:59:51Z

checkov/terraform/checks/resource/aws/S3BucketPubliclyReadableViaACL.py

+    def scan_resource_conf(self, conf):
+        if 'acl' in conf:
+            if conf['acl'][0] == 'public-read':
+                return CheckResult.FAILED
+        return CheckResult.PASSED


This is like CKV_AWS_20 but less complete and different than what 630d3779-d932-4fbf-9cce-6e8d793c6916 is looking for

I see what you mean, do you think that this is more accurate? (setting block_public_policy to false)

You need to check that the S3 has the pbulic access block, and check if there is a aws_s3_account_public_access_block and check if there is a aws_s3_bucket_website_configuration attached. It would look closer to this: https://github.com/bridgecrewio/checkov/blob/66988745cf9b93c449e3693219c5679e3be19a32/checkov/terraform/checks/resource/aws/S3SecureDataTransport.py

checkov/terraform/checks/resource/aws/S3BucketPubliclyReadableViaACL.py

checkov/terraform/checks/resource/aws/UnpatchedAuroraPostgresDB.py

checkov/terraform/checks/resource/aws/WAFv2VulnerableForLog4j.py

…icAccess.py Co-authored-by: Taylor <[email protected]>

Co-authored-by: Taylor <[email protected]>

…nUsernameAndPublicAccess.py Co-authored-by: Taylor <[email protected]>

…ViaACL.py Co-authored-by: Taylor <[email protected]>

…B.py Co-authored-by: Taylor <[email protected]>

Co-authored-by: Taylor <[email protected]>

…essible.py Co-authored-by: Taylor <[email protected]>

…from-CSPM' into feat(terraform)-medium-policies-from-CSPM

…from-CSPM' into feat(terraform)-medium-policies-from-CSPM # Conflicts: # checkov/terraform/checks/resource/aws/EMRPubliclyAccessible.py # checkov/terraform/checks/resource/aws/RedshiftClusterWithCommonUsernameAndPublicAccess.py # checkov/terraform/checks/resource/aws/S3BucketPubliclyReadableViaACL.py # checkov/terraform/checks/resource/aws/WAFv2VulnerableForLog4j.py

…from-CSPM' into feat(terraform)-medium-policies-from-CSPM

TomerSegev241 and others added 2 commits March 17, 2025 10:52

7 new policies

4402b14

Merge branch 'main' into feat(terraform)-medium-policies-from-CSPM

5c0fda1

TomerSegev241 changed the title ~~7 new policies~~ feat(terraform): 7 new policies Mar 17, 2025

Merge branch 'main' into feat(terraform)-medium-policies-from-CSPM

1b4fe7d

tsmithv11 had a problem deploying to scan-security March 21, 2025 23:51 — with GitHub Actions Failure

tsmithv11 requested changes Mar 22, 2025

View reviewed changes

Update checkov/terraform/checks/resource/aws/AutoScalingGroupWithPubl…

be6fb41

…icAccess.py Co-authored-by: Taylor <[email protected]>

TomerSegev241 had a problem deploying to scan-security March 23, 2025 08:17 — with GitHub Actions Failure

Update checkov/terraform/checks/resource/aws/EMRPubliclyAccessible.py

2303bb7

Co-authored-by: Taylor <[email protected]>

TomerSegev241 had a problem deploying to scan-security March 23, 2025 08:17 — with GitHub Actions Failure

Update checkov/terraform/checks/resource/aws/RedshiftClusterWithCommo…

ff53111

…nUsernameAndPublicAccess.py Co-authored-by: Taylor <[email protected]>

TomerSegev241 had a problem deploying to scan-security March 23, 2025 08:17 — with GitHub Actions Failure

Update checkov/terraform/checks/resource/aws/S3BucketPubliclyReadable…

b0973cd

…ViaACL.py Co-authored-by: Taylor <[email protected]>

TomerSegev241 had a problem deploying to scan-security March 23, 2025 08:18 — with GitHub Actions Failure

TomerSegev241 and others added 2 commits March 23, 2025 10:18

Update checkov/terraform/checks/resource/aws/UnpatchedAuroraPostgresD…

0f13976

…B.py Co-authored-by: Taylor <[email protected]>

Update checkov/terraform/checks/resource/aws/WAFv2VulnerableForLog4j.py

18d55df

Co-authored-by: Taylor <[email protected]>

TomerSegev241 had a problem deploying to scan-security March 23, 2025 08:18 — with GitHub Actions Failure

Update checkov/terraform/checks/resource/aws/S3AccessPointPubliclyAcc…

22e7019

…essible.py Co-authored-by: Taylor <[email protected]>

TomerSegev241 had a problem deploying to scan-security March 23, 2025 08:19 — with GitHub Actions Failure

TomerSegev241 added 2 commits March 23, 2025 14:17

changes due to @taylor comments

0ece751

Merge remote-tracking branch 'origin/feat(terraform)-medium-policies-…

f814203

…from-CSPM' into feat(terraform)-medium-policies-from-CSPM

TomerSegev241 had a problem deploying to scan-security March 23, 2025 12:18 — with GitHub Actions Failure

pre-commit warnings fixed

3fe07ce

TomerSegev241 had a problem deploying to scan-security March 23, 2025 12:25 — with GitHub Actions Failure

TomerSegev241 added 2 commits April 30, 2025 14:51

update due to Taylor comments

756672e

TomerSegev241 requested a deployment to scan-security April 30, 2025 12:23 — with GitHub Actions Waiting

Merge branch 'main' into feat(terraform)-medium-policies-from-CSPM

23f40a1

TomerSegev241 requested a deployment to scan-security April 30, 2025 12:25 — with GitHub Actions Waiting

delete auto created init file

27ea5bb

Merge branch 'main' into feat(terraform)-medium-policies-from-CSPM

3ecba3a

TomerSegev241 requested a deployment to scan-security May 4, 2025 08:27 — with GitHub Actions Waiting

Merge remote-tracking branch 'origin/feat(terraform)-medium-policies-…

028ec9e

…from-CSPM' into feat(terraform)-medium-policies-from-CSPM

TomerSegev241 requested a deployment to scan-security May 4, 2025 08:45 — with GitHub Actions Waiting

delete auto created init file

69691d5

TomerSegev241 requested a deployment to scan-security May 4, 2025 08:56 — with GitHub Actions Waiting

delete python test file

39c9513

TomerSegev241 requested a deployment to scan-security May 4, 2025 09:08 — with GitHub Actions Waiting

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(terraform): 7 new policies #7056

feat(terraform): 7 new policies #7056

TomerSegev241 commented Mar 17, 2025 •

edited by baz-reviewer bot

Loading

tsmithv11 left a comment

tsmithv11 Mar 21, 2025

tsmithv11 Mar 21, 2025

tsmithv11 Mar 21, 2025

TomerSegev241 Mar 23, 2025

tsmithv11 Mar 24, 2025

feat(terraform): 7 new policies #7056

Are you sure you want to change the base?

feat(terraform): 7 new policies #7056

Conversation

TomerSegev241 commented Mar 17, 2025 • edited by baz-reviewer bot Loading

User description

Description

New/Edited policies (Delete if not relevant)

Description

Fix

Checklist:

Generated description

tsmithv11 left a comment

Choose a reason for hiding this comment

tsmithv11 Mar 21, 2025

Choose a reason for hiding this comment

tsmithv11 Mar 21, 2025

Choose a reason for hiding this comment

tsmithv11 Mar 21, 2025

Choose a reason for hiding this comment

TomerSegev241 Mar 23, 2025

Choose a reason for hiding this comment

tsmithv11 Mar 24, 2025

Choose a reason for hiding this comment

TomerSegev241 commented Mar 17, 2025 •

edited by baz-reviewer bot

Loading