Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(keyExpectedValue): ansible-azure queries convert to a recommendation rather than a current status #5590

Merged
merged 1 commit into from
Jul 13, 2022
Merged

fix(keyExpectedValue): ansible-azure queries convert to a recommendation rather than a current status #5590

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion assets/queries/ansible/azure/ad_admin_not_configured_for_sql_server/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
"issueType": "MissingAttribute",
"keyExpectedValue": "azure_rm_sqlserver.ad_user is defined",
"keyExpectedValue": "azure_rm_sqlserver.ad_user should be defined",
"keyActualValue": "azure_rm_sqlserver.ad_user is undefined",
}
}
8 changes: 4 additions & 4 deletions assets/queries/ansible/azure/aks_monitoring_logging_disabled/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
"issueType": "MissingAttribute",
"keyExpectedValue": "azure_rm_aks.addon is set",
"keyExpectedValue": "azure_rm_aks.addon should be set",
"keyActualValue": "azure_rm_aks.addon is undefined",
}
}
Expand All @@ -36,7 +36,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.addon", [task.name, modules[m]]),
"issueType": "MissingAttribute",
"keyExpectedValue": "azure_rm_aks.addon.monitoring is set",
"keyExpectedValue": "azure_rm_aks.addon.monitoring should be set",
"keyActualValue": "azure_rm_aks.addon.monitoring is undefined",
}
}
Expand All @@ -56,7 +56,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.addon.monitoring", [task.name, modules[m]]),
"issueType": "MissingAttribute",
"keyExpectedValue": sprintf("azure_rm_aks.addon.monitoring.%s is set", [attr]),
"keyExpectedValue": sprintf("azure_rm_aks.addon.monitoring.%s should be set", [attr]),
"keyActualValue": sprintf("azure_rm_aks.addon.monitoring.%s is undefined", [attr]),
}
}
Expand All @@ -74,7 +74,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.addon.monitoring.enabled", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "azure_rm_aks.addon.monitoring.enabled is set to 'yes' or 'false'",
"keyExpectedValue": "azure_rm_aks.addon.monitoring.enabled should be set to 'yes' or 'false'",
"keyActualValue": "azure_rm_aks.addon.monitoring.enabled is not set to 'yes' or 'false'",
}
}
4 changes: 2 additions & 2 deletions assets/queries/ansible/azure/aks_rbac_disabled/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
"issueType": "MissingAttribute",
"keyExpectedValue": "azure_rm_aks.enable_rbac is defined",
"keyExpectedValue": "azure_rm_aks.enable_rbac should be defined",
"keyActualValue": "azure_rm_aks.enable_rbac is undefined",
}
}
Expand All @@ -36,7 +36,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.enable_rbac", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "azure_rm_aks.enable_rbac is set to 'yes' or 'true'",
"keyExpectedValue": "azure_rm_aks.enable_rbac should be set to 'yes' or 'true'",
"keyActualValue": "azure_rm_aks.enable_rbac is not set to 'yes' or 'true'",
}
}
2 changes: 1 addition & 1 deletion assets/queries/ansible/azure/azure_container_registry_with_no_locks/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("'%s' is referenced by an existing lock", [modules[m]]),
"keyExpectedValue": sprintf("'%s' should be referenced by an existing lock", [modules[m]]),
"keyActualValue": sprintf("'%s' is not referenced by an existing lock", [modules[m]]),
"searchLine": common_lib.build_search_line(["playbooks", task, modules[m]], []),
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/ansible/azure/cosmosdb_account_ip_range_filter_not_set/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
"issueType": "MissingAttribute",
"keyExpectedValue": "'azurerm_cosmosdb_account.ip_range_filter' is defined",
"keyExpectedValue": "'azurerm_cosmosdb_account.ip_range_filter' should be defined",
"keyActualValue": "'azurerm_cosmosdb_account.ip_range_filter' is undefined",
}
}
2 changes: 1 addition & 1 deletion assets/queries/ansible/azure/cosmosdb_account_without_tags/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.tags", [task.name, modules[m]]),
"issueType": "MissingAttribute",
"keyExpectedValue": "azure_rm_cosmosdbaccount.tags is defined",
"keyExpectedValue": "azure_rm_cosmosdbaccount.tags should be defined",
"keyActualValue": "azure_rm_cosmosdbaccount.tags is undefined",
}
}
2 changes: 1 addition & 1 deletion assets/queries/ansible/azure/default_network_access_is_allowed/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.network_acls.default_action", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "azure_rm_storageaccount.network_acls.default_action is 'Deny'",
"keyExpectedValue": "azure_rm_storageaccount.network_acls.default_action should be set to 'Deny'",
"keyActualValue": "azure_rm_storageaccount.network_acls.default_action is 'Allow'",
}
}
2 changes: 1 addition & 1 deletion ...ueries/ansible/azure/firewall_rule_allows_too_many_hosts_to_access_redis_cache/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.start_ip_address", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "azure_rm_rediscachefirewallrule.start_ip_address and end_ip_address allow up to 255 hosts",
"keyExpectedValue": "azure_rm_rediscachefirewallrule.start_ip_address and end_ip_address should allow up to 255 hosts",
"keyActualValue": sprintf("azure_rm_rediscachefirewallrule.start_ip_address and end_ip_address allow %d hosts", [available]),
}
}
4 changes: 2 additions & 2 deletions assets/queries/ansible/azure/key_vault_soft_delete_is_disabled/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.enable_soft_delete", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "azure_rm_keyvault.enable_soft_delete is true",
"keyExpectedValue": "azure_rm_keyvault.enable_soft_delete should be true",
"keyActualValue": "azure_rm_keyvault.enable_soft_delete is false",
}
}
Expand All @@ -36,7 +36,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
"issueType": "MissingAttribute",
"keyExpectedValue": "azure_rm_keyvault.enable_soft_delete is defined",
"keyExpectedValue": "azure_rm_keyvault.enable_soft_delete should be defined",
"keyActualValue": "azure_rm_keyvault.enable_soft_delete is undefined",
}
}
2 changes: 1 addition & 1 deletion assets/queries/ansible/azure/log_retention_is_not_set/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.value", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "azure_rm_postgresqlconfiguration.value is equal to 'on'",
"keyExpectedValue": "azure_rm_postgresqlconfiguration.value should be equal to 'on'",
"keyActualValue": "azure_rm_postgresqlconfiguration.value is not equal to 'on'",
}
}
2 changes: 1 addition & 1 deletion assets/queries/ansible/azure/monitoring_log_profile_without_all_activities/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
"issueType": "MissingAttribute",
"keyExpectedValue": "azure_rm_monitorlogprofile.categories is defined",
"keyExpectedValue": "azure_rm_monitorlogprofile.categories should be defined",
"keyActualValue": "azure_rm_monitorlogprofile.categories is undefined",
}
}
2 changes: 1 addition & 1 deletion assets/queries/ansible/azure/public_storage_account/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.network_acls.ip_rules", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "azure_rm_storageaccount.network_acls.default_action is 'Deny' and azure_rm_storageaccount.network_acls.ip_rules does not contain value '0.0.0.0/0' ",
"keyExpectedValue": "azure_rm_storageaccount.network_acls.default_action should be set to 'Deny' and azure_rm_storageaccount.network_acls.ip_rules should not contain value '0.0.0.0/0' ",
"keyActualValue": "azure_rm_storageaccount.network_acls.default_action is 'Deny' and azure_rm_storageaccount.network_acls.ip_rules contains value '0.0.0.0/0'",
}
}
2 changes: 1 addition & 1 deletion assets/queries/ansible/azure/redis_entirely_accessible/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.start_ip_address", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "azure_rm_rediscachefirewallrule start_ip and end_ip are not equal to '0.0.0.0'",
"keyExpectedValue": "azure_rm_rediscachefirewallrule start_ip and end_ip should not equal to '0.0.0.0'",
"keyActualValue": "azure_rm_rediscachefirewallrule start_ip and end_ip are equal to '0.0.0.0'",
}
}
2 changes: 1 addition & 1 deletion assets/queries/ansible/azure/redis_publicly_accessible/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.start_ip_address", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "azure_rm_rediscachefirewallrule ip range is private",
"keyExpectedValue": "azure_rm_rediscachefirewallrule ip range should be private",
"keyActualValue": "azure_rm_rediscachefirewallrule ip range is public",
}
}
2 changes: 1 addition & 1 deletion assets/queries/ansible/azure/role_definition_allows_custom_role_creation/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.permissions.actions", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("%s.permissions[%d].actions does not allow custom role creation", [modules[m], p]),
"keyExpectedValue": sprintf("%s.permissions[%d].actions should not allow custom role creation", [modules[m], p]),
"keyActualValue": sprintf("%s.permissions[%d].actions allows custom role creation", [modules[m], p]),
"searchLine": common_lib.build_search_line(["playbooks", t, modules[m], "permissions", p, "actions"], []),
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/ansible/azure/security_group_is_not_configured/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
"issueType": "MissingAttribute",
"keyExpectedValue": "azure_rm_subnet.security_group is defined and not null",
"keyExpectedValue": "azure_rm_subnet.security_group should be defined and not null",
"keyActualValue": "azure_rm_subnet.security_group is undefined or null",
}
}
Expand Down
6 changes: 3 additions & 3 deletions assets/queries/ansible/azure/small_activity_log_retention_period/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.retention_policy.enabled", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "azure_rm_monitorlogprofile.retention_policy.enabled is true or yes",
"keyExpectedValue": "azure_rm_monitorlogprofile.retention_policy.enabled should be true or yes",
"keyActualValue": "azure_rm_monitorlogprofile.retention_policy.enabled is false or no",
}
}
Expand All @@ -38,7 +38,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.retention_policy.days", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "azure_rm_monitorlogprofile.retention_policy.days is greater than or equal to 365 days or 0 (indefinitely)",
"keyExpectedValue": "azure_rm_monitorlogprofile.retention_policy.days should be greater than or equal to 365 days or 0 (indefinitely)",
"keyActualValue": "azure_rm_monitorlogprofile.retention_policy.days is lesser than 365 days or different than 0 (indefinitely)",
}
}
Expand All @@ -56,7 +56,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
"issueType": "MissingAttribute",
"keyExpectedValue": "azure_rm_monitorlogprofile.retention_policy is defined",
"keyExpectedValue": "azure_rm_monitorlogprofile.retention_policy should be defined",
"keyActualValue": "azure_rm_monitorlogprofile.retention_policy is undefined",
}
}
2 changes: 1 addition & 1 deletion assets/queries/ansible/azure/sql_server_ingress_from_any_ip/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.end_ip_address", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "azure_rm_sqlfirewallrule should allows all IPs",
"keyExpectedValue": "azure_rm_sqlfirewallrule should allow all IPs",
"keyActualValue": "azure_rm_sqlfirewallrule should not allow all IPs (range from start_ip_address to end_ip_address)",
}
}
Expand Down
2 changes: 1 addition & 1 deletion ...eries/ansible/azure/sql_server_predictable_active_directory_admin_account_name/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.ad_user", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "azure_ad_serviceprincipal.ad_user is neither empty nor null",
"keyExpectedValue": "azure_ad_serviceprincipal.ad_user should be neither empty nor null",
"keyActualValue": "azure_ad_serviceprincipal.ad_user is empty or null",
}
}
Expand Down
2 changes: 1 addition & 1 deletion assets/queries/ansible/azure/storage_account_not_forcing_https/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[index]]),
"issueType": "MissingAttribute",
"keyExpectedValue": "azure_rm_storageaccount.https_only is defined",
"keyExpectedValue": "azure_rm_storageaccount.https_only should be defined",
"keyActualValue": "azure_rm_storageaccount.https_only is undefined (defaults to false)",
}
}
Expand Down
4 changes: 2 additions & 2 deletions .../queries/ansible/azure/storage_account_not_using_latest_tls_encryption_version/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
"issueType": "MissingAttribute",
"keyExpectedValue": "azure_rm_storageaccount.minimum_tls_version is defined",
"keyExpectedValue": "azure_rm_storageaccount.minimum_tls_version should be defined",
"keyActualValue": "azure_rm_storageaccount.minimum_tls_version is undefined",
}
}
Expand All @@ -36,7 +36,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.minimum_tls_version", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "azure_rm_storageaccount is using the latest version of TLS encryption",
"keyExpectedValue": "azure_rm_storageaccount should be using the latest version of TLS encryption",
"keyActualValue": sprintf("azure_rm_storageaccount is using version %s of TLS encryption", [storage.minimum_tls_version]),
}
}
2 changes: 1 addition & 1 deletion assets/queries/ansible/azure/unrestricted_sql_server_acess/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "The difference between the value of azure_rm_sqlfirewallrule end_ip_address and start_ip_address is lesser than 256",
"keyExpectedValue": "The difference between the value of azure_rm_sqlfirewallrule end_ip_address and start_ip_address should be lesser than 256",
"keyActualValue": "The difference between the value of azure_rm_sqlfirewallrule end_ip_address and start_ip_address is greater than or equal to 256",
}
}
2 changes: 1 addition & 1 deletion assets/queries/ansible/azure/vm_not_attached_to_network/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
"issueType": "MissingAttribute",
"keyExpectedValue": "azure_rm_virtualmachine.network_interface_names is defined",
"keyExpectedValue": "azure_rm_virtualmachine.network_interface_names should be defined",
"keyActualValue": "azure_rm_virtualmachine.network_interface_names is undefined",
}
}
4 changes: 2 additions & 2 deletions assets/queries/ansible/azure/web_app_accepting_traffic_other_than_https/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}.https_only", [task.name, modules[m]]),
"issueType": "IncorrectValue",
"keyExpectedValue": "azure_rm_webapp.https_only is set to true or 'yes'",
"keyExpectedValue": "azure_rm_webapp.https_only should be set to true or 'yes'",
"keyActualValue": sprintf("azure_rm_webapp.https_only value is '%s'", [webapp.https_only]),
}
}
Expand All @@ -36,7 +36,7 @@ CxPolicy[result] {
"resourceName": task.name,
"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
"issueType": "MissingAttribute",
"keyExpectedValue": "azure_rm_webapp.https_only is defined",
"keyExpectedValue": "azure_rm_webapp.https_only should be defined",
"keyActualValue": "azure_rm_webapp.https_only is undefined",
}
}