fix(query): fix/cmk rotation disabled on terraform asymmetric key cre…

…ation (#5344) * fix support for AWS KMS in asymmetric keys - do not support automation key rotation * fix support for AWS KMS in asymmetric keys - do not support automation key rotation * fix support for AWS KMS in asymmetric keys - do not support automation key rotation * fix support for AWS KMS in asymmetric keys - do not support automation key rotation * fix support for AWS KMS in asymmetric keys - do not support automation key rotation * fix support for AWS KMS in asymmetric keys - do not support automation key rotation * fix support for AWS KMS in asymmetric keys - do not support automation key rotation * fix support for AWS KMS in asymmetric keys - do not support automation key rotation * fix support for AWS KMS in asymmetric keys - do not support automation key rotation * fix support for AWS KMS in asymmetric keys - do not support automation key rotation * Update assets/queries/terraform/aws/cmk_rotation_disabled/query.rego Co-authored-by: Rafaela Soares <[email protected]> * Update assets/queries/terraform/aws/cmk_rotation_disabled/query.rego Co-authored-by: Rafaela Soares <[email protected]> * Update assets/queries/terraform/aws/cmk_rotation_disabled/query.rego Co-authored-by: Rafaela Soares <[email protected]> * Update assets/queries/terraform/aws/cmk_rotation_disabled/query.rego Co-authored-by: Rafaela Soares <[email protected]> * fix support for AWS KMS in asymmetric keys - do not support automation key rotation * Update assets/queries/terraform/aws/cmk_rotation_disabled/query.rego Co-authored-by: Rafaela Soares <[email protected]> Co-authored-by: Rafaela Soares <[email protected]>
Checkmarx · May 24, 2022 · b1c5ad2 · b1c5ad2
1 parent f4ed3d0
commit b1c5ad2
Show file tree

Hide file tree

Showing 12 changed files with 93 additions and 14 deletions.
diff --git a/assets/queries/terraform/aws/cmk_rotation_disabled/query.rego b/assets/queries/terraform/aws/cmk_rotation_disabled/query.rego
@@ -1,3 +1,4 @@
+
 package Cx
 
 import data.generic.common as common_lib
@@ -6,7 +7,8 @@ CxPolicy[result] {
 	resource := input.document[i].resource.aws_kms_key[name]
 
 	not key_set_to_false(resource)
-	not common_lib.valid_key(resource, "enable_key_rotation")
+    not common_lib.valid_key(resource, "enable_key_rotation")
+    customer_master_key_spec_set_to_symmetric(resource)
 
 	result := {
 		"documentId": input.document[i].id,
@@ -17,21 +19,47 @@ CxPolicy[result] {
 	}
 }
 
+
+CxPolicy[result] {
+	resource := input.document[i].resource.aws_kms_key[name]
+
+	not key_set_to_false(resource)
+    resource.enable_key_rotation == true
+    not customer_master_key_spec_set_to_symmetric(resource)
+
+	result := {
+		"documentId": input.document[i].id,
+		"searchKey": sprintf("aws_kms_key[%s]", [name]),
+        "issueType": "IncorrectValue",
+		"keyExpectedValue": sprintf("aws_kms_key[%s].enable_key_rotation is set to false", [name]),
+		"keyActualValue": sprintf("aws_kms_key[%s].enable_key_rotation is true", [name]),
+	}
+}
+
+
 CxPolicy[result] {
 	resource := input.document[i].resource.aws_kms_key[name]
 
 	not key_set_to_false(resource)
-	resource.enable_key_rotation == false
+    resource.enable_key_rotation == false
+    customer_master_key_spec_set_to_symmetric(resource)
 
 	result := {
 		"documentId": input.document[i].id,
-		"searchKey": sprintf("aws_kms_key[%s].enable_key_rotation", [name]),
-		"issueType": "IncorrectValue",
+		"searchKey": sprintf("aws_kms_key[%s]", [name]),
+        "issueType": "IncorrectValue",
 		"keyExpectedValue": sprintf("aws_kms_key[%s].enable_key_rotation is set to true", [name]),
-		"keyActualValue": sprintf("aws_kms_key[%s].enable_key_rotation is set to false", [name]),
+		"keyActualValue": sprintf("aws_kms_key[%s].enable_key_rotation is false", [name]),
 	}
 }
 
+
+customer_master_key_spec_set_to_symmetric(resource) {
+     resource.customer_master_key_spec == "SYMMETRIC_DEFAULT"
+} else {
+     not common_lib.valid_key(resource, "customer_master_key_spec")
+}
+
 key_set_to_false(resource) {
 	resource.is_enabled == false
 }
diff --git a/assets/queries/terraform/aws/cmk_rotation_disabled/test/negative1.tf b/assets/queries/terraform/aws/cmk_rotation_disabled/test/negative1.tf
@@ -1,5 +1,5 @@
-resource "aws_kms_key" "a3" {
-  description             = "KMS key 1"
-  is_enabled = true
+resource "aws_kms_key" "negative1" {
+  description         = "KMS key 1"
+  is_enabled          = true
   enable_key_rotation = true
 }
diff --git a/assets/queries/terraform/aws/cmk_rotation_disabled/test/negative2.tf b/assets/queries/terraform/aws/cmk_rotation_disabled/test/negative2.tf
@@ -0,0 +1,4 @@
+resource "aws_kms_key" "negative2" {
+  description              = "KMS key 2"
+  customer_master_key_spec = "RSA_4096"
+}
diff --git a/assets/queries/terraform/aws/cmk_rotation_disabled/test/negative3.tf b/assets/queries/terraform/aws/cmk_rotation_disabled/test/negative3.tf
@@ -0,0 +1,4 @@
+resource "aws_kms_key" "negative3" {
+  description              = "KMS key 3"
+  customer_master_key_spec = "RSA_2048"
+}
diff --git a/assets/queries/terraform/aws/cmk_rotation_disabled/test/negative4.tf b/assets/queries/terraform/aws/cmk_rotation_disabled/test/negative4.tf
@@ -0,0 +1,4 @@
+resource "aws_kms_key" "negative4" {
+  description              = "KMS key 4"
+  customer_master_key_spec = "RSA_3072"
+}
diff --git a/assets/queries/terraform/aws/cmk_rotation_disabled/test/negative5.tf b/assets/queries/terraform/aws/cmk_rotation_disabled/test/negative5.tf
@@ -0,0 +1,5 @@
+resource "aws_kms_key" "negative5" {
+  description              = "KMS key 5"
+  customer_master_key_spec = "SYMMETRIC_DEFAULT"
+  enable_key_rotation      = true
+}
diff --git a/assets/queries/terraform/aws/cmk_rotation_disabled/test/positive1.tf b/assets/queries/terraform/aws/cmk_rotation_disabled/test/positive1.tf
@@ -1,3 +1,3 @@
-resource "aws_kms_key" "a" {
-  description             = "KMS key 1"
+resource "aws_kms_key" "positive1" {
+  description = "KMS key 1"
 }
diff --git a/assets/queries/terraform/aws/cmk_rotation_disabled/test/positive2.tf b/assets/queries/terraform/aws/cmk_rotation_disabled/test/positive2.tf
@@ -1,5 +1,5 @@
-resource "aws_kms_key" "a2" {
-  description             = "KMS key 2"
-  is_enabled = true
+resource "aws_kms_key" "positive2" {
+  description         = "KMS key 2"
+  is_enabled          = true
   enable_key_rotation = false
 }
diff --git a/assets/queries/terraform/aws/cmk_rotation_disabled/test/positive3.tf b/assets/queries/terraform/aws/cmk_rotation_disabled/test/positive3.tf
@@ -0,0 +1,6 @@
+resource "aws_kms_key" "positive3" {
+  description              = "KMS key 3"
+  is_enabled               = true
+  customer_master_key_spec = "SYMMETRIC_DEFAULT"
+  enable_key_rotation      = false
+}
diff --git a/assets/queries/terraform/aws/cmk_rotation_disabled/test/positive4.tf b/assets/queries/terraform/aws/cmk_rotation_disabled/test/positive4.tf
@@ -0,0 +1,5 @@
+resource "aws_kms_key" "positive4" {
+  description              = "KMS key 4"
+  customer_master_key_spec = "SYMMETRIC_DEFAULT"
+  enable_key_rotation      = false
+}
diff --git a/assets/queries/terraform/aws/cmk_rotation_disabled/test/positive5.tf b/assets/queries/terraform/aws/cmk_rotation_disabled/test/positive5.tf
@@ -0,0 +1,5 @@
+resource "aws_kms_key" "positive5" {
+  description              = "KMS key 5"
+  customer_master_key_spec = "RSA_2048"
+  enable_key_rotation      = true
+}
diff --git a/assets/queries/terraform/aws/cmk_rotation_disabled/test/positive_expected_result.json b/assets/queries/terraform/aws/cmk_rotation_disabled/test/positive_expected_result.json
@@ -8,7 +8,25 @@
   {
     "queryName": "CMK Rotation Disabled",
     "severity": "HIGH",
-    "line": 4,
+    "line": 1,
     "fileName": "positive2.tf"
+  },
+  {
+    "queryName": "CMK Rotation Disabled",
+    "severity": "HIGH",
+    "line": 1,
+    "fileName": "positive3.tf"
+  },
+  {
+    "queryName": "CMK Rotation Disabled",
+    "severity": "HIGH",
+    "line": 1,
+    "fileName": "positive4.tf"
+  },
+  {
+    "queryName": "CMK Rotation Disabled",
+    "severity": "HIGH",
+    "line": 1,
+    "fileName": "positive5.tf"
   }
 ]