Skip to content

Commit ab9331e

Browse files
cx-ricardo-jesuscx-ricardo-jesus
authored
feat(queries): implemented queries to check if managed identity is not enabled (#7863)
1 parent a511b6f commit ab9331e

File tree

44 files changed

+695
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+695
-0
lines changed

‎assets/queries/terraform/azure/app_service_slot_managed_identity_disabled/metadata.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"id": "0f7964fa-96fd-4a72-9fb7-3cdef71479db",
3+
"queryName": "Beta - App Service Slot Managed Identity Disabled",
4+
"severity": "MEDIUM",
5+
"category": "Insecure Configurations",
6+
"descriptionText": "App Service Slot should have managed identity enabled",
7+
"descriptionUrl": "https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/windows_web_app_slot",
8+
"platform": "Terraform",
9+
"descriptionID": "0f7964fa",
10+
"cloudProvider": "azure",
11+
"cwe": "522",
12+
"riskScore": "3.0",
13+
"experimental": "true"
14+
}

‎assets/queries/terraform/azure/app_service_slot_managed_identity_disabled/query.rego‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
package Cx
2+
3+
import data.generic.common as common_lib
4+
import data.generic.terraform as tf_lib
5+
6+
resource_types := {"azurerm_app_service_slot", "azurerm_linux_web_app_slot", "azurerm_windows_web_app_slot"}
7+
8+
CxPolicy[result] {
9+
app_service_slot := input.document[i].resource[resource_types[idx_type]][name]
10+
11+
not common_lib.valid_key(app_service_slot, "identity")
12+
13+
result := {
14+
"documentId": input.document[i].id,
15+
"resourceType": resource_types[idx_type],
16+
"resourceName": tf_lib.get_resource_name(app_service_slot, name),
17+
"searchKey": sprintf("%s[%s]", [resource_types[idx_type], name]),
18+
"issueType": "MissingAttribute",
19+
"keyExpectedValue": "'type' field should have the values 'SystemAssigned' or 'UserAssigned' defined inside the 'identity' block",
20+
"keyActualValue": "'identity' block is not defined",
21+
"searchLine": common_lib.build_search_line(["resource", resource_types[idx_type], name], []),
22+
"remediationType": "addition",
23+
"remediation": "identity {\n\t\ttype = \"SystemAssigned, UserAssigned\"\n\t}",
24+
}
25+
}

‎assets/queries/terraform/azure/app_service_slot_managed_identity_disabled/test/negative1.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
resource "azurerm_app_service_slot" "negative1" {
2+
name = random_id.server.hex
3+
app_service_name = azurerm_app_service.example.name
4+
location = azurerm_resource_group.example.location
5+
resource_group_name = azurerm_resource_group.example.name
6+
app_service_plan_id = azurerm_app_service_plan.example.id
7+
8+
identity {
9+
type = "SystemAssigned, UserAssigned"
10+
}
11+
}

‎assets/queries/terraform/azure/app_service_slot_managed_identity_disabled/test/negative2.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
resource "azurerm_linux_web_app_slot" "negative2" {
2+
name = "example-slot"
3+
app_service_id = azurerm_linux_web_app.example.id
4+
5+
site_config {}
6+
7+
identity {
8+
type = "SystemAssigned, UserAssigned"
9+
}
10+
}

‎assets/queries/terraform/azure/app_service_slot_managed_identity_disabled/test/negative3.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
resource "azurerm_windows_web_app_slot" "negative3" {
2+
name = "example-slot"
3+
app_service_id = azurerm_windows_web_app.example.id
4+
5+
site_config {}
6+
7+
identity {
8+
type = "SystemAssigned, UserAssigned"
9+
}
10+
}

‎assets/queries/terraform/azure/app_service_slot_managed_identity_disabled/test/positive1.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
resource "azurerm_app_service_slot" "positive1" {
2+
name = random_id.server.hex
3+
app_service_name = azurerm_app_service.example.name
4+
location = azurerm_resource_group.example.location
5+
resource_group_name = azurerm_resource_group.example.name
6+
app_service_plan_id = azurerm_app_service_plan.example.id
7+
}

‎assets/queries/terraform/azure/app_service_slot_managed_identity_disabled/test/positive2.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
resource "azurerm_linux_web_app_slot" "positive2" {
2+
name = "example-slot"
3+
app_service_id = azurerm_linux_web_app.example.id
4+
5+
site_config {}
6+
}

‎assets/queries/terraform/azure/app_service_slot_managed_identity_disabled/test/positive3.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
resource "azurerm_windows_web_app_slot" "positive3" {
2+
name = "example-slot"
3+
app_service_id = azurerm_windows_web_app.example.id
4+
5+
site_config {}
6+
}

‎assets/queries/terraform/azure/app_service_slot_managed_identity_disabled/test/positive_expected_result.json‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
[
2+
{
3+
"queryName": "Beta - App Service Slot Managed Identity Disabled",
4+
"severity": "MEDIUM",
5+
"line": 1,
6+
"fileName": "positive1.tf"
7+
},
8+
{
9+
"queryName": "Beta - App Service Slot Managed Identity Disabled",
10+
"severity": "MEDIUM",
11+
"line": 1,
12+
"fileName": "positive2.tf"
13+
},
14+
{
15+
"queryName": "Beta - App Service Slot Managed Identity Disabled",
16+
"severity": "MEDIUM",
17+
"line": 1,
18+
"fileName": "positive3.tf"
19+
}
20+
]

‎assets/queries/terraform/azure/container_app_managed_identity_disabled/metadata.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"id": "829246df-02c5-490c-993b-10a07a7242e9",
3+
"queryName": "Beta - Container App Managed Identity Disabled",
4+
"severity": "MEDIUM",
5+
"category": "Insecure Configurations",
6+
"descriptionText": "Container Apps should have managed identity enabled",
7+
"descriptionUrl": "https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/container_app",
8+
"platform": "Terraform",
9+
"descriptionID": "829246df",
10+
"cloudProvider": "azure",
11+
"cwe": "522",
12+
"riskScore": "3.0",
13+
"experimental": "true"
14+
}

0 commit comments

Comments
 (0)