Skip to content

Commit

Permalink
fix merge error conflict
Browse files Browse the repository at this point in the history
  • Loading branch information
ArturRibeiro-CX committed Sep 20, 2024
1 parent 1321068 commit 370636a
Show file tree
Hide file tree
Showing 4 changed files with 56 additions and 0 deletions.
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
{
"id": "fb387023-e4bb-42a8-9a70-6708aa7ff21b",
"queryName": "Nifcloud RDB Has Public DB Access",
"severity": "HIGH",
"category": "Access Control",
"descriptionText": "The RDB has public DB access",
"descriptionUrl": "https://registry.terraform.io/providers/nifcloud/nifcloud/latest/docs/resources/db_instance#publicly_accessible",
"platform": "Terraform",
"descriptionID": "e4ce28b6",
"cloudProvider": "nifcloud",
"cwe": "732"
}
34 changes: 34 additions & 0 deletions assets/queries/terraform/nifcloud/db_has_public_access/query.rego
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
package Cx

import data.generic.terraform as tf_lib
import data.generic.common as common_lib

CxPolicy[result] {
dbInstance := input.document[i].resource.nifcloud_db_instance[name]
dbInstance.publicly_accessible == true
result := {
"documentId": input.document[i].id,
"resourceType": "nifcloud_db_instance",
"resourceName": tf_lib.get_resource_name(dbInstance, name),
"searchKey": sprintf("nifcloud_db_instance[%s]", [name]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("'nifcloud_db_instance[%s]' should not use publicly accessible set to true. You should limit all access to the minimum that is required for your application to function.", [name]),
"keyActualValue": sprintf("'nifcloud_db_instance[%s]' has publicly accessible set to true.", [name]),
}
}

CxPolicy[result] {

dbInstance := input.document[i].resource.nifcloud_db_instance[name]
not common_lib.valid_key(dbInstance, "publicly_accessible")

result := {
"documentId": input.document[i].id,
"resourceType": "nifcloud_db_instance",
"resourceName": tf_lib.get_resource_name(dbInstance, name),
"searchKey": sprintf("nifcloud_db_instance[%s]", [name]),
"issueType": "MissingAttribute",
"keyExpectedValue": sprintf("'nifcloud_db_instance[%s]' should have publicly accessible defined as the default value is set to true. You should limit all access to the minimum that is required for your application to function.", [name]),
"keyActualValue": sprintf("'nifcloud_db_instance[%s]' doesn't define publicly accessible.", [name]),
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
resource "nifcloud_db_instance" "negative" {
identifier = "example"
instance_class = "db.large8"
publicly_accessible = false
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
resource "nifcloud_db_instance" "positive" {
identifier = "example"
instance_class = "db.large8"
publicly_accessible = true
}

0 comments on commit 370636a

Please sign in to comment.