Merge pull request #6675 from Checkmarx/kics-767-crossplane

feat(query): crossplane ECS Cluster with Container Insights Disabled

assets/queries/crossplane/aws/ecs_cluster_with_container_insights_disabled/metadata.json

@@ -0,0 +1,11 @@
+{
+  "id": "0c7a76d9-7dc5-499e-81ac-9245839177cb",
+  "queryName": "ECS Cluster with Container Insights Disabled",
+  "severity": "LOW",
+  "category": "Observability",
+  "descriptionText": "ECS Cluster should enable container insights",
+  "descriptionUrl": "https://doc.crds.dev/github.com/crossplane/provider-aws/ecs.aws.crossplane.io/Cluster/[email protected]#spec-forProvider-settings",
+  "platform": "Crossplane",
+  "descriptionID": "a6911ebd",
+	"cloudProvider": "aws"
+}

assets/queries/crossplane/aws/ecs_cluster_with_container_insights_disabled/query.rego

@@ -0,0 +1,51 @@
+package Cx
+
+import data.generic.common as common_lib
+import data.generic.crossplane as cp_lib
+
+CxPolicy[result] {
+	docs := input.document[i]
+	[path, resource] := walk(docs)
+	startswith(resource.apiVersion, "ecs.aws.crossplane.io")
+	resource.kind == "Cluster"
+	forProvider := resource.spec.forProvider
+
+	not common_lib.valid_key(forProvider, "settings")
+
+	result := {
+		"documentId": input.document[i].id,
+		"resourceType": resource.kind,
+		"resourceName": cp_lib.getResourceName(resource),
+		"searchKey": sprintf("%smetadata.name={{%s}}.spec.forProvider", [cp_lib.getPath(path), resource.metadata.name]),
+		"issueType": "MissingAttribute",
+		"keyExpectedValue": "Cluster.spec.forProvider.settings should be defined and have a ClusterSetting which name is 'containerInsights' with 'enabled' value",
+		"keyActualValue": "Cluster.spec.forProvider.settings is not defined",
+		"searchLine": common_lib.build_search_line(path, ["spec", "forProvider"]),
+	}
+}
+
+CxPolicy[result] {
+	docs := input.document[i]
+	[path, resource] := walk(docs)
+	startswith(resource.apiVersion, "ecs.aws.crossplane.io")
+	resource.kind == "Cluster"
+	forProvider := resource.spec.forProvider
+
+	not container_insights(forProvider.settings)
+
+	result := {
+		"documentId": input.document[i].id,
+		"resourceType": resource.kind,
+		"resourceName": cp_lib.getResourceName(resource),
+		"searchKey": sprintf("%smetadata.name={{%s}}.spec.forProvider.settings", [cp_lib.getPath(path), resource.metadata.name]),
+		"issueType": "MissingAttribute",
+		"keyExpectedValue": "Cluster.spec.forProvider.settings should have a ClusterSetting which name is 'containerInsights' with 'enabled' value",
+		"keyActualValue": "Cluster.spec.forProvider.settings doesn't have a ClusterSetting which name is 'containerInsights' with 'enabled' value",
+		"searchLine": common_lib.build_search_line(path, ["spec", "forProvider", "settings"]),
+	}
+}
+
+container_insights(settings){
+	settings[0].name == "containerInsights"
+	settings[0].value == "enabled"
+}

assets/queries/crossplane/aws/ecs_cluster_with_container_insights_disabled/test/negative1.yaml

@@ -0,0 +1,10 @@
+apiVersion: ecs.aws.crossplane.io/v1alpha1
+kind: Cluster
+metadata:
+  name: example
+spec:
+  forProvider:
+    region: us-east-1
+    settings:
+      - name: "containerInsights"
+        value: "enabled"

assets/queries/crossplane/aws/ecs_cluster_with_container_insights_disabled/test/positive1.yaml

@@ -0,0 +1,7 @@
+apiVersion: ecs.aws.crossplane.io/v1alpha1
+kind: Cluster
+metadata:
+  name: example
+spec:
+  forProvider:
+    region: us-east-1

assets/queries/crossplane/aws/ecs_cluster_with_container_insights_disabled/test/positive2.yaml

@@ -0,0 +1,8 @@
+apiVersion: ecs.aws.crossplane.io/v1alpha1
+kind: Cluster
+metadata:
+  name: example
+spec:
+  forProvider:
+    region: us-east-1
+    settings: []

assets/queries/crossplane/aws/ecs_cluster_with_container_insights_disabled/test/positive3.yaml

@@ -0,0 +1,10 @@
+apiVersion: ecs.aws.crossplane.io/v1alpha1
+kind: Cluster
+metadata:
+  name: example
+spec:
+  forProvider:
+    region: us-east-1
+    settings:
+      - name: "containerInsights"
+        value: "disabled"

assets/queries/crossplane/aws/ecs_cluster_with_container_insights_disabled/test/positive_expected_result.json

@@ -0,0 +1,20 @@
+[
+  {
+    "queryName": "ECS Cluster with Container Insights Disabled",
+    "severity": "LOW",
+    "line": 6,
+    "fileName": "positive1.yaml"
+  },
+  {
+    "queryName": "ECS Cluster with Container Insights Disabled",
+    "severity": "LOW",
+    "line": 8,
+    "fileName": "positive2.yaml"
+  },
+  {
+    "queryName": "ECS Cluster with Container Insights Disabled",
+    "severity": "LOW",
+    "line": 8,
+    "fileName": "positive3.yaml"
+  } 
+]