Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(keyExpectedValue): convert is not to a recommendation rather than a current status #5575

Merged
merged 1 commit into from
Jul 12, 2022
Merged

fix(keyExpectedValue): convert is not to a recommendation rather than a current status #5575

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion assets/queries/ansible/aws/auto_scaling_group_with_no_associated_elb/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.load_balancers", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("%s.load_balancers is not empty", [modules[m]]),
"keyExpectedValue": sprintf("%s.load_balancers should not be empty", [modules[m]]),
"keyActualValue": sprintf("%s.load_balancers is empty", [modules[m]]),
}
}
2 changes: 1 addition & 1 deletion assets/queries/ansible/aws/ec2_group_has_public_interface/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.rules.%s", [task.name, modules[m], cidr]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("'ec2_group.rules.%s' is not %s", [cidr, cidrValue]),
"keyExpectedValue": sprintf("'ec2_group.rules.%s' should not be %s", [cidr, cidrValue]),
"keyActualValue": sprintf("'ec2_group.rules.%s' is %s", [cidr, rule[cidr]]),
"searchLine": common_lib.build_search_line(["playbooks", t, modules[m], "rules", idx, cidr], []),
}
Expand Down
4 changes: 2 additions & 2 deletions assets/queries/ansible/aws/ec2_instance_using_default_security_group/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.%s", [task.name, modules[m], sgs[s]]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("'%s' is not using default security group", [sgs[s]]),
"keyExpectedValue": sprintf("'%s' should not be using default security group", [sgs[s]]),
"keyActualValue": sprintf("'%s' is using default security group", [sgs[s]]),
"searchLine": common_lib.build_search_line(["playbooks", t, modules[m], sgs[s]], [idx]),
}
Expand All @@ -47,7 +47,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.%s", [task.name, modules[m], sgs[s]]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("'%s' is not using default security group", [sgs[s]]),
"keyExpectedValue": sprintf("'%s' should not be using default security group", [sgs[s]]),
"keyActualValue": sprintf("'%s' is using default security group", [sgs[s]]),
"searchLine": common_lib.build_search_line(["playbooks", t, modules[m], sgs[s]], []),
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/ansible/aws/ec2_instance_using_default_vpc/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.vpc_subnet_id", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "'vpc_subnet_id' is not associated with a default VPC",
"keyExpectedValue": "'vpc_subnet_id' should not be associated with a default VPC",
"keyActualValue": "'vpc_subnet_id' is associated with a default VPC",
"searchLine": common_lib.build_search_line(["playbooks", t, modules[m], "vpc_subnet_id"], []),
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/ansible/aws/ecr_repository_is_publicly_accessible/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.policy", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "ecs_ecr.policy.Principal is not equal to '*'",
"keyExpectedValue": "ecs_ecr.policy.Principal should not be equal to '*'",
"keyActualValue": "ecs_ecr.policy.Principal is equal to '*'",
"searchLine": common_lib.build_search_line(["playbooks", t, modules[m], "policy"], []),
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/ansible/aws/ecs_service_admin_role_is_present/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.role", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "ecs_service.role is not an admin role",
"keyExpectedValue": "ecs_service.role should not be an admin role",
"keyActualValue": "ecs_service.role is an admin role",
}
}
2 changes: 1 addition & 1 deletion assets/queries/ansible/aws/elasticache_using_default_port/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.cache_port", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("'cache_port' is not set to %d", [enginePort]),
"keyExpectedValue": sprintf("'cache_port' should not be set to %d", [enginePort]),
"keyActualValue": sprintf("'cache_port' is set to %d", [enginePort]),
"searchLine": common_lib.build_search_line(["playbooks", t, modules[m], "cache_port"], []),
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/ansible/aws/elb_using_weak_ciphers/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.listeners.%s", [task.name, modules[m], j]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("%s.listeners.SslPolicy is not a weak cipher", [modules[m]]),
"keyExpectedValue": sprintf("%s.listeners.SslPolicy should not be a weak cipher", [modules[m]]),
"keyActualValue": sprintf("%s.listeners.SslPolicy is a weak cipher", [modules[m]]),
}
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/ansible/aws/rds_associated_with_public_subnet/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.%s", [task.name, rds[r], options[o]]),
"issueType": "MissingAttribute",
"keyExpectedValue": "RDS is not running in a public subnet",
"keyExpectedValue": "RDS should not be running in a public subnet",
"keyActualValue": "RDS is running in a public subnet",
"searchLine": common_lib.build_search_line(["playbooks", t, rds[r], options[o]], []),
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/ansible/aws/rds_using_default_port/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.port", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("'port' is not set to %d", [enginePort]),
"keyExpectedValue": sprintf("'port' should not be set to %d", [enginePort]),
"keyActualValue": sprintf("'port' is set to %d", [enginePort]),
"searchLine": common_lib.build_search_line(["playbooks", t, modules[m], "port"], []),
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/ansible/aws/redshift_using_default_port/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.port", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "redshift.port is not set to 5439",
"keyExpectedValue": "redshift.port should not be set to 5439",
"keyActualValue": "redshift.port is set to 5439",
"searchLine": common_lib.build_search_line(["playbooks", t, modules[m], "port"], []),
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/ansible/aws/root_account_has_active_access_keys/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "iam is not active for a root account",
"keyExpectedValue": "iam should not be active for a root account",
"keyActualValue": "iam is active for a root account",
}
}
2 changes: 1 addition & 1 deletion assets/queries/ansible/aws/s3_bucket_without_server-side_encryption/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.encryption", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "s3_bucket.encryption is not 'none'",
"keyExpectedValue": "s3_bucket.encryption should not be 'none'",
"keyActualValue": "s3_bucket.encryption is 'none'",
}
}
2 changes: 1 addition & 1 deletion assets/queries/ansible/aws/security_group_with_unrestricted_access_to_ssh/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.rules", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("ec2_group.rules[%d] SSH' (Port:22) is not public", [index]),
"keyExpectedValue": sprintf("ec2_group.rules[%d] SSH' (Port:22) should not be public", [index]),
"keyActualValue": sprintf("ec2_group.rules[%d] SSH' (Port:22) is public", [index]),
}
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/ansible/aws/user_data_shell_script_is_encoded/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.user_data", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "ec2_lc.user_data is not shell script",
"keyExpectedValue": "ec2_lc.user_data should not be shell script",
"keyActualValue": "ec2_lc.user_data is shell script",
}
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/ansible/azure/public_storage_account/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.network_acls.default_action", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "azure_rm_storageaccount.network_acls.default_action is not set",
"keyExpectedValue": "azure_rm_storageaccount.network_acls.default_action should not be set",
"keyActualValue": "azure_rm_storageaccount.network_acls.default_action is 'Allow'",
}
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/ansible/azure/security_group_is_not_configured/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.%s", [task.name, modules[m], fields[f]]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("azure_rm_subnet.%s is not empty", [fields[f]]),
"keyExpectedValue": sprintf("azure_rm_subnet.%s should not be empty", [fields[f]]),
"keyActualValue": sprintf("azure_rm_subnet.%s is empty", [fields[f]]),
}
}
2 changes: 1 addition & 1 deletion ...eries/ansible/azure/sql_server_predictable_active_directory_admin_account_name/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.ad_user", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "azure_ad_serviceprincipal.ad_user is not predictable",
"keyExpectedValue": "azure_ad_serviceprincipal.ad_user should not be predictable",
"keyActualValue": "azure_ad_serviceprincipal.ad_user is predictable",
}
}
Expand Down
4 changes: 2 additions & 2 deletions assets/queries/ansible/azure/sql_server_predictable_admin_account_name/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.admin_username", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "azure_rm_sqlserver.admin_username is not empty",
"keyExpectedValue": "azure_rm_sqlserver.admin_username should not be empty",
"keyActualValue": "azure_rm_sqlserver.admin_username is empty",
}
}
Expand All @@ -37,7 +37,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.admin_username", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "azure_rm_sqlserver.admin_username is not predictable",
"keyExpectedValue": "azure_rm_sqlserver.admin_username should not be predictable",
"keyActualValue": "azure_rm_sqlserver.admin_username is predictable",
}
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/ansible/azure/storage_container_is_publicly_accessible/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.public_access", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "azure_rm_storageblob.public_access is not set",
"keyExpectedValue": "azure_rm_storageblob.public_access should not be set",
"keyActualValue": "azure_rm_storageblob.public_access is equal to 'blob' or 'container'",
}
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/ansible/azure/trusted_microsoft_services_not_enabled/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.network_acls.bypass", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "azure_rm_storageaccount.network_acls.bypass is not set or contains 'AzureServices'",
"keyExpectedValue": "azure_rm_storageaccount.network_acls.bypass should not be set or contain 'AzureServices'",
"keyActualValue": "azure_rm_storageaccount.network_acls.bypass does not contain 'AzureServices' ",
}
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/ansible/gcp/bigquery_dataset_is_public/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.access", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "gcp_bigquery_dataset.access.special_group is not equal to 'allAuthenticatedUsers'",
"keyExpectedValue": "gcp_bigquery_dataset.access.special_group should not be equal to 'allAuthenticatedUsers'",
"keyActualValue": "gcp_bigquery_dataset.access.special_group is equal to 'allAuthenticatedUsers'",
}
}
2 changes: 1 addition & 1 deletion assets/queries/ansible/gcp/cluster_labels_disabled/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.resource_labels", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("%s is not empty", [modules[m]]),
"keyExpectedValue": sprintf("%s should not be empty", [modules[m]]),
"keyActualValue": sprintf("%s is empty", [modules[m]]),
}
}
2 changes: 1 addition & 1 deletion assets/queries/ansible/gcp/cluster_master_authentication_disabled/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.master_auth.%s", [task.name, modules[m], fields[f]]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("gcp_container_cluster.master_auth.%s is not empty", [field]),
"keyExpectedValue": sprintf("gcp_container_cluster.master_auth.%s should not be empty", [field]),
"keyActualValue": sprintf("gcp_container_cluster.master_auth.%s is empty", [field]),
}
}
2 changes: 1 addition & 1 deletion assets/queries/ansible/gcp/compute_instance_is_publicly_accessible/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.network_interfaces.access_configs", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "gcp_compute_instance.network_interfaces.access_configs is not defined",
"keyExpectedValue": "gcp_compute_instance.network_interfaces.access_configs should not be defined",
"keyActualValue": "gcp_compute_instance.network_interfaces.access_configs is defined",
}
}
2 changes: 1 addition & 1 deletion assets/queries/ansible/gcp/disk_encryption_disabled/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.disk_encryption_key.%s", [task.name, modules[m], key]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("gcp_compute_disk.disk_encryption_key.%s is not empty", [key]),
"keyExpectedValue": sprintf("gcp_compute_disk.disk_encryption_key.%s should not be empty", [key]),
"keyActualValue": sprintf("gcp_compute_disk.disk_encryption_key.%s is empty", [key]),
}
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/ansible/gcp/dnssec_using_rsasha1/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.dnssec_config.defaultKeySpecs.algorithm", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "gcp_dns_managed_zone.dnssec_config.defaultKeySpecs.algorithm is not equal to 'rsasha1'",
"keyExpectedValue": "gcp_dns_managed_zone.dnssec_config.defaultKeySpecs.algorithm should not be equal to 'rsasha1'",
"keyActualValue": "gcp_dns_managed_zone.dnssec_config.defaultKeySpecs.algorithm is equal to 'rsasha1'",
}
}
4 changes: 2 additions & 2 deletions assets/queries/ansible/gcp/gke_using_default_service_account/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.node_config", [task.name, modules[m]]),
"issueType": "MissingAttribute",
"keyExpectedValue": "'service_account' is not default",
"keyExpectedValue": "'service_account' should not be default",
"keyActualValue": "'service_account' is missing",
"searchLine": common_lib.build_search_line(["playbooks", t, modules[m], "node_config"], []),
}
Expand All @@ -37,7 +37,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.node_config.service_account", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "'service_account' is not default",
"keyExpectedValue": "'service_account' should not be default",
"keyActualValue": "'service_account' is default",
"searchLine": common_lib.build_search_line(["playbooks", t, modules[m], "node_config", "service_account"], []),
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/ansible/gcp/google_compute_network_using_default_firewall_rule/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ CxPolicy[result] {
"resourceName": tk.name,
"searchKey": sprintf("name={{%s}}.{{%s}}", [tk.name, modulesCompute[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("'%s' is not using a default firewall rule", [modulesCompute[m]]),
"keyExpectedValue": sprintf("'%s' should not be using a default firewall rule", [modulesCompute[m]]),
"keyActualValue": sprintf("'%s' is using a default firewall rule", [modulesCompute[m]]),
"searchLine": common_lib.build_search_line(["playbooks", t, modulesCompute[m]], []),
}
Expand Down
2 changes: 1 addition & 1 deletion ...ts/queries/ansible/gcp/google_compute_network_using_firewall_allows_port_range/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ CxPolicy[result] {
"resourceName": tk.name,
"searchKey": sprintf("name={{%s}}.{{%s}}", [tk.name, modulesCompute[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("'%s' is not using a firewall rule that allows access to port range", [modulesCompute[m]]),
"keyExpectedValue": sprintf("'%s' should not be using a firewall rule that allows access to port range", [modulesCompute[m]]),
"keyActualValue": sprintf("'%s' is using a firewall rule that allows access to port range", [modulesCompute[m]]),
"searchLine": common_lib.build_search_line(["playbooks", t, modulesCompute[m]], []),
}
Expand Down
2 changes: 1 addition & 1 deletion ...ueries/ansible/gcp/google_compute_network_using_firewall_rule_allows_all_ports/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ CxPolicy[result] {
"resourceName": tk.name,
"searchKey": sprintf("name={{%s}}.{{%s}}", [tk.name, modulesCompute[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("'%s' is not using a firewall rule that allows access to all ports", [modulesCompute[m]]),
"keyExpectedValue": sprintf("'%s' should not be using a firewall rule that allows access to all ports", [modulesCompute[m]]),
"keyActualValue": sprintf("'%s' is using a firewall rule that allows access to all ports", [modulesCompute[m]]),
"searchLine": common_lib.build_search_line(["playbooks", t, modulesCompute[m]], []),
}
Expand Down
4 changes: 2 additions & 2 deletions assets/queries/ansible/gcp/using_default_service_account/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.service_account_email", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "gcp_compute_instance.service_account_email is not empty",
"keyExpectedValue": "gcp_compute_instance.service_account_email should not be empty",
"keyActualValue": "gcp_compute_instance.service_account_email is empty",
}
}
Expand Down Expand Up @@ -82,7 +82,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.service_account_email", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "gcp_compute_instance.service_account_email is not a default Google Compute Engine service account",
"keyExpectedValue": "gcp_compute_instance.service_account_email should not be a default Google Compute Engine service account",
"keyActualValue": "gcp_compute_instance.service_account_email is a default Google Compute Engine service account",
}
}
2 changes: 1 addition & 1 deletion assets/queries/azureResourceManager/aks_dashboard_enabled/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ CxPolicy[result] {
"resourceName": value.name,
"searchKey": sprintf("%s.name=%s.apiVersion", [common_lib.concat_path(path), value.name]),
"issueType": "IncorrectValue",
"keyExpectedValue": "'apiVersion' is not '2017-08-03'",
"keyExpectedValue": "'apiVersion' should not be '2017-08-03'",
"keyActualValue": "'apiVersion' is '2017-08-03'",
"searchLine": common_lib.build_search_line(path, ["apiVersion"]),
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/azureResourceManager/aks_logging_azure_monitoring_disabled/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ CxPolicy[result] {
"resourceName": value.name,
"searchKey": sprintf("%s.name=%s.apiVersion", [common_lib.concat_path(path), value.name]),
"issueType": "IncorrectValue",
"keyExpectedValue": "'apiVersion' is not '2017-08-03'",
"keyExpectedValue": "'apiVersion' should not be '2017-08-03'",
"keyActualValue": "'apiVersion' is '2017-08-03'",
"searchLine": common_lib.build_search_line(path, ["apiVersion"]),
}
Expand Down
2 changes: 1 addition & 1 deletion ...ts/queries/azureResourceManager/hardcoded_securestring_parameter_default_value/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ CxPolicy[result] {
"resourceName": "n/a",
"searchKey": sprintf("parameters.%s.defaultValue", [p]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("parameters.%s.defaultValue is not hardcoded", [p]),
"keyExpectedValue": sprintf("parameters.%s.defaultValue should not be hardcoded", [p]),
"keyActualValue": sprintf("parameters.%s.defaultValue is hardcoded", [p]),
"searchLine": common_lib.build_search_line(["parameters", p, "defaultValue"], []),
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/azureResourceManager/sql_database_server_firewall_allows_all_ips/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ CxPolicy[result] {
"resourceName": value.name,
"searchKey": sprintf("%s.name={{%s}}.properties.endIpAddress", [common_lib.concat_path(path), value.name]),
"issueType": "IncorrectValue",
"keyExpectedValue": "endIpAddress is not '255.255.255.255' when startIpAddress is '0.0.0.0'",
"keyExpectedValue": "endIpAddress should not be '255.255.255.255' when startIpAddress is '0.0.0.0'",
"keyActualValue": sprintf("endIpAddress is '%s' and startIpAddress is '%s'", [properties.endIpAddress, properties.startIpAddress]),
"searchLine": common_lib.build_search_line(path, ["properties", "endIpAddress"]),
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/cloudFormation/aws/api_gateway_without_security_policy/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Properties.SecurityPolicy", [name]),
"issueType": "MissingAttribute",
"keyExpectedValue": sprintf("Resources.%s.Properties.SecurityPolicy is not defined", [name]),
"keyExpectedValue": sprintf("Resources.%s.Properties.SecurityPolicy should not be defined", [name]),
"keyActualValue": sprintf("Resources.%s.Properties.SecurityPolicy is defined", [name]),
}
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/cloudFormation/aws/auto_scaling_group_with_no_associated_elb/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ CxPolicy[result] {
"resourceName": cf_lib.get_resource_name(resource, name),
"searchKey": sprintf("Resources.%s.Properties.LoadBalancerNames", [name]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("'Resources.%s.Properties.LoadBalancerNames' is not empty", [name]),
"keyExpectedValue": sprintf("'Resources.%s.Properties.LoadBalancerNames' should not be empty", [name]),
"keyActualValue": sprintf("'Resources.%s.Properties.LoadBalancerNames' is empty", [name]),
}
}
Expand Down
Loading