feat(query): add new query for tencentcloud CLB resource

assets/queries/terraform/tencentcloud/clb_instance_log_setting_disabled/metadata.json

@@ -0,0 +1,12 @@
+{
+  "id": "ada01ed1-b10c-4f2a-b110-b20fa4f9baa6",
+  "queryName": "(Beta) CLB Instance Log Setting Disabled",
+  "severity": "MEDIUM",
+  "category": "Encryption",
+  "descriptionText": "CLB Instance should set log enabled",
+  "descriptionUrl": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud/latest/docs/resources/clb_instance#log_set_id",
+  "platform": "Terraform",
+  "descriptionID": "86f56f55",
+  "cloudProvider": "tencentcloud",
+  "cwe": ""
+}

assets/queries/terraform/tencentcloud/clb_instance_log_setting_disabled/query.rego

@@ -0,0 +1,21 @@
+package Cx
+
+import data.generic.common as common_lib
+import data.generic.terraform as tf_lib
+
+CxPolicy[result] {
+	resource := input.document[i].resource.tencentcloud_clb_instance[name]
+    not common_lib.valid_key(resource, "log_set_id")
+    not common_lib.valid_key(resource, "log_topic_id")
+
+	result := {
+		"documentId": input.document[i].id,
+		"resourceType": "tencentcloud_clb_instance",
+		"resourceName": tf_lib.get_resource_name(resource, name),
+		"searchKey": sprintf("tencentcloud_clb_instance[%s]", [name]),
+		"issueType": "MissingAttribute",
+		"keyExpectedValue": sprintf("tencentcloud_clb_instance[%s] should set 'log_set_id' and 'log_topic_id'", [name]),
+		"keyActualValue": sprintf("tencentcloud_clb_instance[%s] not set 'log_set_id' and 'log_topic_id'", [name]),
+        "searchLine":common_lib.build_search_line(["resource", "tencentcloud_clb_instance", name], []),
+	}
+}

assets/queries/terraform/tencentcloud/clb_instance_log_setting_disabled/test/negative1.tf

@@ -0,0 +1,41 @@
+resource "tencentcloud_vpc" "vpc_test" {
+  name       = "clb-test"
+  cidr_block = "10.0.0.0/16"
+}
+
+resource "tencentcloud_route_table" "rtb_test" {
+  name   = "clb-test"
+  vpc_id = tencentcloud_vpc.vpc_test.id
+}
+
+resource "tencentcloud_subnet" "subnet_test" {
+  name              = "clb-test"
+  cidr_block        = "10.0.1.0/24"
+  availability_zone = "ap-guangzhou-3"
+  vpc_id            = tencentcloud_vpc.vpc_test.id
+  route_table_id    = tencentcloud_route_table.rtb_test.id
+}
+
+resource "tencentcloud_clb_log_set" "set" {
+  period = 7
+}
+
+resource "tencentcloud_clb_log_topic" "topic" {
+  log_set_id = tencentcloud_clb_log_set.set.id
+  topic_name = "clb-topic"
+}
+
+resource "tencentcloud_clb_instance" "internal_clb" {
+  network_type                 = "INTERNAL"
+  clb_name                     = "clb_example"
+  project_id                   = 0
+  vpc_id                       = tencentcloud_vpc.vpc_test.id
+  subnet_id                    = tencentcloud_subnet.subnet_test.id
+  load_balancer_pass_to_target = true
+  log_set_id                   = tencentcloud_clb_log_set.set.id
+  log_topic_id                 = tencentcloud_clb_log_topic.topic.id
+
+  tags = {
+    test = "tf"
+  }
+}

assets/queries/terraform/tencentcloud/clb_instance_log_setting_disabled/test/positive1.tf

@@ -0,0 +1,30 @@
+resource "tencentcloud_vpc" "vpc_test" {
+  name       = "clb-test"
+  cidr_block = "10.0.0.0/16"
+}
+
+resource "tencentcloud_route_table" "rtb_test" {
+  name   = "clb-test"
+  vpc_id = tencentcloud_vpc.vpc_test.id
+}
+
+resource "tencentcloud_subnet" "subnet_test" {
+  name              = "clb-test"
+  cidr_block        = "10.0.1.0/24"
+  availability_zone = "ap-guangzhou-3"
+  vpc_id            = tencentcloud_vpc.vpc_test.id
+  route_table_id    = tencentcloud_route_table.rtb_test.id
+}
+
+resource "tencentcloud_clb_instance" "internal_clb" {
+  network_type                 = "INTERNAL"
+  clb_name                     = "clb_example"
+  project_id                   = 0
+  vpc_id                       = tencentcloud_vpc.vpc_test.id
+  subnet_id                    = tencentcloud_subnet.subnet_test.id
+  load_balancer_pass_to_target = true
+
+  tags = {
+    test = "tf"
+  }
+}

assets/queries/terraform/tencentcloud/clb_instance_log_setting_disabled/test/positive_expected_result.json

@@ -0,0 +1,8 @@
+[
+  {
+    "queryName": "(Beta) CLB Instance Log Setting Disabled",
+    "severity": "MEDIUM",
+    "line": 19,
+    "fileName": "positive1.tf"
+  }
+]

assets/queries/terraform/tencentcloud/clb_listener_using_insecure_protocols/metadata.json

@@ -0,0 +1,12 @@
+{
+  "id": "fe08b81c-12e9-4b5e-9006-4218fca750fd",
+  "queryName": "(Beta) CLB Listener Using Insecure Protocols",
+  "severity": "HIGH",
+  "category": "Encryption",
+  "descriptionText": "CLB Listener protocol must not use insecure protocols",
+  "descriptionUrl": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud/latest/docs/resources/clb_listener#protocol",
+  "platform": "Terraform",
+  "descriptionID": "e129d0f1",
+  "cloudProvider": "tencentcloud",
+  "cwe": ""
+}

assets/queries/terraform/tencentcloud/clb_listener_using_insecure_protocols/query.rego

@@ -0,0 +1,23 @@
+package Cx
+
+import data.generic.common as common_lib
+import data.generic.terraform as tf_lib
+
+insecure_protocols := {"TCP", "UDP", "HTTP"}
+
+CxPolicy[result] {
+	resource := input.document[i].resource.tencentcloud_clb_listener[name]
+    protocolCheck := resource.protocol
+    insecure_protocols[protocolCheck]
+
+	result := {
+		"documentId": input.document[i].id,
+		"resourceType": "tencentcloud_clb_listener",
+		"resourceName": tf_lib.get_resource_name(resource, name),
+		"searchKey": sprintf("tencentcloud_clb_listener[%s].protocol", [name]),
+		"issueType": "IncorrectValue",
+		"keyExpectedValue": sprintf("tencentcloud_clb_listener[%s].protocol[%s] should not be an insecure protocol", [name, protocolCheck]),
+		"keyActualValue": sprintf("tencentcloud_clb_listener[%s].protocol[%s] is an insecure protocol", [name, protocolCheck]),
+        "searchLine":common_lib.build_search_line(["resource", "tencentcloud_clb_listener", name, "protocol"], []),
+	}
+}

assets/queries/terraform/tencentcloud/clb_listener_using_insecure_protocols/test/negative1.tf

@@ -0,0 +1,6 @@
+resource "tencentcloud_clb_listener" "listener" {
+  clb_id        = "lb-0lh5au7v"
+  listener_name = "test_listener"
+  protocol      = "HTTPS"
+  port          = 443
+}

assets/queries/terraform/tencentcloud/clb_listener_using_insecure_protocols/test/positive1.tf

@@ -0,0 +1,6 @@
+resource "tencentcloud_clb_listener" "listener" {
+  clb_id        = "lb-0lh5au7v"
+  listener_name = "test_listener"
+  protocol      = "HTTP"
+  port          = 80
+}

assets/queries/terraform/tencentcloud/clb_listener_using_insecure_protocols/test/positive2.tf

@@ -0,0 +1,6 @@
+resource "tencentcloud_clb_listener" "listener" {
+  clb_id        = "lb-0lh5au7v"
+  listener_name = "test_listener"
+  protocol      = "TCP"
+  port          = 8080
+}

assets/queries/terraform/tencentcloud/clb_listener_using_insecure_protocols/test/positive3.tf

@@ -0,0 +1,6 @@
+resource "tencentcloud_clb_listener" "listener" {
+  clb_id        = "lb-0lh5au7v"
+  listener_name = "test_listener"
+  protocol      = "UDP"
+  port          = 8090
+}

assets/queries/terraform/tencentcloud/clb_listener_using_insecure_protocols/test/positive_expected_result.json

@@ -0,0 +1,20 @@
+[
+  {
+    "queryName": "(Beta) CLB Listener Using Insecure Protocols",
+    "severity": "HIGH",
+    "line": 4,
+    "fileName": "positive1.tf"
+  },
+  {
+    "queryName": "(Beta) CLB Listener Using Insecure Protocols",
+    "severity": "HIGH",
+    "line": 4,
+    "fileName": "positive2.tf"
+  },
+  {
+    "queryName": "(Beta) CLB Listener Using Insecure Protocols",
+    "severity": "HIGH",
+    "line": 4,
+    "fileName": "positive3.tf"
+  }
+]