Merge pull request #6980 from Checkmarx/bicep-kics-1313

feat(bicep): adding bicep support

.github/scripts/coverage/.coverageignore

@@ -3,4 +3,5 @@ pkg/engine/mock/*.go
 */**/*_test.go
 **/*_mock.go
 pkg/parser/jsonfilter/parser/jsonfilter*
+pkg/parser/bicep/antlr/parser/bicep*
 internal/sentry

.golangci.yml

@@ -137,3 +137,4 @@ run:
     - docs
     - vendor
     - pkg/parser/jsonfilter/parser
+    - pkg/parser/bicep/antlr

Makefile

@@ -131,7 +131,7 @@ dkr-compose: ## build docker image and runs docker-compose up
 .PHONY: dkr-build-antlr
 dkr-build-antlr: ## build ANTLRv4 docker image and generate parser based on given grammar
 	@docker build -t antlr4-generator:dev -f ./docker/Dockerfile.antlr .
-	@docker run --rm -u $(id -u ${USER}):$(id -g ${USER}) -v $(pwd)/pkg/parser/jsonfilter/:/work -it antlr4-generator:dev
+	@docker run --rm -u $(id -u ${USER}):$(id -g ${USER}) -v $(pwd)/pkg/parser:/work -it antlr4-generator:dev
 
 .PHONY: release
 release: ## goreleaser --rm-dist

assets/queries/azureResourceManager/account_admins_not_notified_by_email/test/negative1.bicep

@@ -0,0 +1,9 @@
+resource sample_server_default 'Microsoft.Sql/servers/databases/securityAlertPolicies@2021-02-01-preview' = {
+  name: 'sample/server/default'
+  properties: {
+    emailAccountAdmins: true
+    emailAddresses: ['[email protected]']
+    retentionDays: 4
+    state: 'Enabled'
+  }
+}

assets/queries/azureResourceManager/account_admins_not_notified_by_email/test/negative2.bicep

@@ -0,0 +1,9 @@
+resource sample_server_default 'Microsoft.Sql/servers/databases/securityAlertPolicies@2021-02-01-preview' = {
+  name: 'sample/server/default'
+  properties: {
+    emailAccountAdmins: true
+    emailAddresses: ['[email protected]']
+    retentionDays: 4
+    state: 'Enabled'
+  }
+}

assets/queries/azureResourceManager/account_admins_not_notified_by_email/test/positive1.bicep

@@ -0,0 +1,9 @@
+resource sample_server_default 'Microsoft.Sql/servers/databases/securityAlertPolicies@2021-02-01-preview' = {
+  name: 'sample/server/default'
+  properties: {
+    emailAccountAdmins: false
+    emailAddresses: ['[email protected]']
+    retentionDays: 4
+    state: 'Enabled'
+  }
+}

assets/queries/azureResourceManager/account_admins_not_notified_by_email/test/positive2.bicep

@@ -0,0 +1,8 @@
+resource sample_server_default 'Microsoft.Sql/servers/databases/securityAlertPolicies@2021-02-01-preview' = {
+  name: 'sample/server/default'
+  properties: {
+    emailAddresses: ['[email protected]']
+    retentionDays: 4
+    state: 'Enabled'
+  }
+}

assets/queries/azureResourceManager/account_admins_not_notified_by_email/test/positive3.bicep

@@ -0,0 +1,9 @@
+resource sample_server_default 'Microsoft.Sql/servers/databases/securityAlertPolicies@2021-02-01-preview' = {
+  name: 'sample/server/default'
+  properties: {
+    emailAccountAdmins: false
+    emailAddresses: ['[email protected]']
+    retentionDays: 4
+    state: 'Enabled'
+  }
+}

assets/queries/azureResourceManager/account_admins_not_notified_by_email/test/positive4.bicep

@@ -0,0 +1,8 @@
+resource sample_server_default 'Microsoft.Sql/servers/databases/securityAlertPolicies@2021-02-01-preview' = {
+  name: 'sample/server/default'
+  properties: {
+    emailAddresses: ['[email protected]']
+    retentionDays: 4
+    state: 'Enabled'
+  }
+}

assets/queries/azureResourceManager/account_admins_not_notified_by_email/test/positive_expected_result.json

@@ -22,5 +22,29 @@
     "severity": "INFO",
     "line": 15,
     "filename": "positive4.json"
+  },
+  {
+    "queryName": "Account Admins Not Notified By Email",
+    "severity": "INFO",
+    "line": 4,
+    "filename": "positive1.bicep"
+  }, 
+  {
+    "queryName": "Account Admins Not Notified By Email",
+    "severity": "INFO",
+    "line": 3,
+    "filename": "positive2.bicep"
+  },
+  {
+    "queryName": "Account Admins Not Notified By Email",
+    "severity": "INFO",
+    "line": 4,
+    "filename": "positive3.bicep"
+  },
+  {
+    "queryName": "Account Admins Not Notified By Email",
+    "severity": "INFO",
+    "line": 3,
+    "filename": "positive4.bicep"
   }
 ]

assets/queries/azureResourceManager/aks_cluster_network_policy_not_configured/test/negative1.bicep

@@ -0,0 +1,34 @@
+resource aksCluster1 'Microsoft.ContainerService/managedClusters@2020-02-01' = {
+  name: 'aksCluster1'
+  location: resourceGroup().location
+  properties: {
+    kubernetesVersion: '1.15.7'
+    dnsPrefix: 'dnsprefix'
+    agentPoolProfiles: [
+      {
+        name: 'agentpool'
+        count: 2
+        vmSize: 'Standard_A1'
+        osType: 'Linux'
+        storageProfile: 'ManagedDisks'
+      }
+    ]
+    linuxProfile: {
+      adminUsername: 'adminUserName'
+      ssh: {
+        publicKeys: [
+          {
+            keyData: 'keyData'
+          }
+        ]
+      }
+    }
+    servicePrincipalProfile: {
+      clientId: 'servicePrincipalAppId'
+      secret: 'servicePrincipalAppPassword'
+    }
+    networkProfile: {
+      networkPolicy: 'azure'
+    }
+  }
+}

assets/queries/azureResourceManager/aks_cluster_network_policy_not_configured/test/negative2.bicep

@@ -0,0 +1,34 @@
+resource aksCluster1 'Microsoft.ContainerService/managedClusters@2020-02-01' = {
+  name: 'aksCluster1'
+  location: resourceGroup().location
+  properties: {
+    kubernetesVersion: '1.15.7'
+    dnsPrefix: 'dnsprefix'
+    agentPoolProfiles: [
+      {
+        name: 'agentpool'
+        count: 2
+        vmSize: 'Standard_A1'
+        osType: 'Linux'
+        storageProfile: 'ManagedDisks'
+      }
+    ]
+    linuxProfile: {
+      adminUsername: 'adminUserName'
+      ssh: {
+        publicKeys: [
+          {
+            keyData: 'keyData'
+          }
+        ]
+      }
+    }
+    servicePrincipalProfile: {
+      clientId: 'servicePrincipalAppId'
+      secret: 'servicePrincipalAppPassword'
+    }
+    networkProfile: {
+      networkPolicy: 'azure'
+    }
+  }
+}

assets/queries/azureResourceManager/aks_cluster_network_policy_not_configured/test/positive1.bicep

@@ -0,0 +1,31 @@
+resource aksCluster1 'Microsoft.ContainerService/managedClusters@2020-02-01' = {
+  name: 'aksCluster1'
+  location: resourceGroup().location
+  properties: {
+    kubernetesVersion: '1.15.7'
+    dnsPrefix: 'dnsprefix'
+    agentPoolProfiles: [
+      {
+        name: 'agentpool'
+        count: 2
+        vmSize: 'Standard_A1'
+        osType: 'Linux'
+        storageProfile: 'ManagedDisks'
+      }
+    ]
+    linuxProfile: {
+      adminUsername: 'adminUserName'
+      ssh: {
+        publicKeys: [
+          {
+            keyData: 'keyData'
+          }
+        ]
+      }
+    }
+    servicePrincipalProfile: {
+      clientId: 'servicePrincipalAppId'
+      secret: 'servicePrincipalAppPassword'
+    }
+  }
+}

assets/queries/azureResourceManager/aks_cluster_network_policy_not_configured/test/positive2.bicep

@@ -0,0 +1,34 @@
+resource aksCluster1 'Microsoft.ContainerService/managedClusters@2020-02-01' = {
+  name: 'aksCluster1'
+  location: resourceGroup().location
+  properties: {
+    kubernetesVersion: '1.15.7'
+    dnsPrefix: 'dnsprefix'
+    agentPoolProfiles: [
+      {
+        name: 'agentpool'
+        count: 2
+        vmSize: 'Standard_A1'
+        osType: 'Linux'
+        storageProfile: 'ManagedDisks'
+      }
+    ]
+    linuxProfile: {
+      adminUsername: 'adminUserName'
+      ssh: {
+        publicKeys: [
+          {
+            keyData: 'keyData'
+          }
+        ]
+      }
+    }
+    servicePrincipalProfile: {
+      clientId: 'servicePrincipalAppId'
+      secret: 'servicePrincipalAppPassword'
+    }
+    networkProfile: {
+      networkPolicy: ''
+    }
+  }
+}

assets/queries/azureResourceManager/aks_cluster_network_policy_not_configured/test/positive3.bicep

@@ -0,0 +1,31 @@
+resource aksCluster1 'Microsoft.ContainerService/managedClusters@2020-02-01' = {
+  name: 'aksCluster1'
+  location: resourceGroup().location
+  properties: {
+    kubernetesVersion: '1.15.7'
+    dnsPrefix: 'dnsprefix'
+    agentPoolProfiles: [
+      {
+        name: 'agentpool'
+        count: 2
+        vmSize: 'Standard_A1'
+        osType: 'Linux'
+        storageProfile: 'ManagedDisks'
+      }
+    ]
+    linuxProfile: {
+      adminUsername: 'adminUserName'
+      ssh: {
+        publicKeys: [
+          {
+            keyData: 'keyData'
+          }
+        ]
+      }
+    }
+    servicePrincipalProfile: {
+      clientId: 'servicePrincipalAppId'
+      secret: 'servicePrincipalAppPassword'
+    }
+  }
+}

assets/queries/azureResourceManager/aks_cluster_network_policy_not_configured/test/positive4.bicep

@@ -0,0 +1,34 @@
+resource aksCluster1 'Microsoft.ContainerService/managedClusters@2020-02-01' = {
+  name: 'aksCluster1'
+  location: resourceGroup().location
+  properties: {
+    kubernetesVersion: '1.15.7'
+    dnsPrefix: 'dnsprefix'
+    agentPoolProfiles: [
+      {
+        name: 'agentpool'
+        count: 2
+        vmSize: 'Standard_A1'
+        osType: 'Linux'
+        storageProfile: 'ManagedDisks'
+      }
+    ]
+    linuxProfile: {
+      adminUsername: 'adminUserName'
+      ssh: {
+        publicKeys: [
+          {
+            keyData: 'keyData'
+          }
+        ]
+      }
+    }
+    servicePrincipalProfile: {
+      clientId: 'servicePrincipalAppId'
+      secret: 'servicePrincipalAppPassword'
+    }
+    networkProfile: {
+      networkPolicy: ''
+    }
+  }
+}

assets/queries/azureResourceManager/aks_cluster_network_policy_not_configured/test/positive_expected_result.json

@@ -22,5 +22,29 @@
     "severity": "MEDIUM",
     "line": 39,
     "filename": "positive4.json"
+  },
+  {
+    "queryName": "AKS Cluster Network Policy Not Configured",
+    "severity": "MEDIUM",
+    "line": 2,
+    "filename": "positive1.bicep"  
+  },
+  {
+    "queryName": "AKS Cluster Network Policy Not Configured",
+    "severity": "MEDIUM",
+    "line": 31,
+    "filename": "positive2.bicep"
+  },
+  {
+    "queryName": "AKS Cluster Network Policy Not Configured",
+    "severity": "MEDIUM",
+    "line": 2,
+    "filename": "positive3.bicep"
+  },
+  {
+    "queryName": "AKS Cluster Network Policy Not Configured",
+    "severity": "MEDIUM",
+    "line": 31,
+    "filename": "positive4.bicep"
   }
 ]

assets/queries/azureResourceManager/aks_cluster_rbac_disabled/test/negative1.bicep

@@ -0,0 +1,32 @@
+resource aksCluster1 'Microsoft.ContainerService/managedClusters@2020-02-01' = {
+  name: 'aksCluster1'
+  location: resourceGroup().location
+  properties: {
+    enableRBAC: true
+    kubernetesVersion: '1.15.7'
+    dnsPrefix: 'dnsprefix'
+    agentPoolProfiles: [
+      {
+        name: 'agentpool'
+        count: 2
+        vmSize: 'Standard_A1'
+        osType: 'Linux'
+        storageProfile: 'ManagedDisks'
+      }
+    ]
+    linuxProfile: {
+      adminUsername: 'adminUserName'
+      ssh: {
+        publicKeys: [
+          {
+            keyData: 'keyData'
+          }
+        ]
+      }
+    }
+    servicePrincipalProfile: {
+      clientId: 'servicePrincipalAppId'
+      secret: 'servicePrincipalAppPassword'
+    }
+  }
+}