Add wafv2 to query incl. negative test (#5529)

* Add wafv2 to query incl. negative test * fix typo Co-authored-by: Alexander Endris <[email protected]>
Checkmarx · Jun 30, 2022 · d0e2350 · d0e2350
1 parent 4cec726
commit d0e2350
Show file tree

Hide file tree

Showing 2 changed files with 68 additions and 3 deletions.
diff --git a/assets/queries/terraform/aws/api_gateway_without_waf/query.rego b/assets/queries/terraform/aws/api_gateway_without_waf/query.rego
@@ -22,10 +22,14 @@ CxPolicy[result] {
 }
 
 has_waf_associated(apiGatewayName) {
-    resource := input.document[_].resource.aws_wafregional_web_acl_association[_]
-
+    targetResources := {"aws_wafregional_web_acl_association", "aws_wafv2_web_acl_association"}
+
+    waf := targetResources[_]
+
+    resource := input.document[_].resource[waf][_]
+
     associatedResource := split(resource.resource_arn, ".")
-   
+
     associatedResource[0] == "${aws_api_gateway_stage"
     associatedResource[1] == apiGatewayName
 }
diff --git a/assets/queries/terraform/aws/api_gateway_without_waf/test/negative2.tf b/assets/queries/terraform/aws/api_gateway_without_waf/test/negative2.tf
@@ -0,0 +1,61 @@
+resource "aws_api_gateway_rest_api" "example" {
+  body = jsonencode({
+    openapi = "3.0.1"
+    info = {
+      title   = "example"
+      version = "1.0"
+    }
+    paths = {
+      "/path1" = {
+        get = {
+          x-amazon-apigateway-integration = {
+            httpMethod           = "GET"
+            payloadFormatVersion = "1.0"
+            type                 = "HTTP_PROXY"
+            uri                  = "https://ip-ranges.amazonaws.com/ip-ranges.json"
+          }
+        }
+      }
+    }
+  })
+
+  name = "example"
+}
+
+resource "aws_api_gateway_deployment" "example" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+
+  triggers = {
+    redeployment = sha1(jsonencode(aws_api_gateway_rest_api.example.body))
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_api_gateway_stage" "negative2" {
+  deployment_id = aws_api_gateway_deployment.example.id
+  rest_api_id   = aws_api_gateway_rest_api.example.id
+  stage_name    = "example"
+}
+
+resource "aws_wafv2_web_acl" "foo" {
+  name = "foo"
+  scope = "REGIONAL"
+
+  default_action {
+    allow {}
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name = "foo"
+    sampled_requests_enabled = false
+  }
+}
+
+resource "aws_wafv2_web_acl_association" "association" {
+  resource_arn = aws_api_gateway_stage.negative2.arn
+  web_acl_arn   = aws_wafv2_web_acl.foo.arn
+}