-
Notifications
You must be signed in to change notification settings - Fork 307
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #6675 from Checkmarx/kics-767-crossplane
feat(query): crossplane ECS Cluster with Container Insights Disabled
- Loading branch information
Showing
7 changed files
with
117 additions
and
0 deletions.
There are no files selected for viewing
11 changes: 11 additions & 0 deletions
11
assets/queries/crossplane/aws/ecs_cluster_with_container_insights_disabled/metadata.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,11 @@ | ||
{ | ||
"id": "0c7a76d9-7dc5-499e-81ac-9245839177cb", | ||
"queryName": "ECS Cluster with Container Insights Disabled", | ||
"severity": "LOW", | ||
"category": "Observability", | ||
"descriptionText": "ECS Cluster should enable container insights", | ||
"descriptionUrl": "https://doc.crds.dev/github.com/crossplane/provider-aws/ecs.aws.crossplane.io/Cluster/[email protected]#spec-forProvider-settings", | ||
"platform": "Crossplane", | ||
"descriptionID": "a6911ebd", | ||
"cloudProvider": "aws" | ||
} |
51 changes: 51 additions & 0 deletions
51
assets/queries/crossplane/aws/ecs_cluster_with_container_insights_disabled/query.rego
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,51 @@ | ||
package Cx | ||
|
||
import data.generic.common as common_lib | ||
import data.generic.crossplane as cp_lib | ||
|
||
CxPolicy[result] { | ||
docs := input.document[i] | ||
[path, resource] := walk(docs) | ||
startswith(resource.apiVersion, "ecs.aws.crossplane.io") | ||
resource.kind == "Cluster" | ||
forProvider := resource.spec.forProvider | ||
|
||
not common_lib.valid_key(forProvider, "settings") | ||
|
||
result := { | ||
"documentId": input.document[i].id, | ||
"resourceType": resource.kind, | ||
"resourceName": cp_lib.getResourceName(resource), | ||
"searchKey": sprintf("%smetadata.name={{%s}}.spec.forProvider", [cp_lib.getPath(path), resource.metadata.name]), | ||
"issueType": "MissingAttribute", | ||
"keyExpectedValue": "Cluster.spec.forProvider.settings should be defined and have a ClusterSetting which name is 'containerInsights' with 'enabled' value", | ||
"keyActualValue": "Cluster.spec.forProvider.settings is not defined", | ||
"searchLine": common_lib.build_search_line(path, ["spec", "forProvider"]), | ||
} | ||
} | ||
|
||
CxPolicy[result] { | ||
docs := input.document[i] | ||
[path, resource] := walk(docs) | ||
startswith(resource.apiVersion, "ecs.aws.crossplane.io") | ||
resource.kind == "Cluster" | ||
forProvider := resource.spec.forProvider | ||
|
||
not container_insights(forProvider.settings) | ||
|
||
result := { | ||
"documentId": input.document[i].id, | ||
"resourceType": resource.kind, | ||
"resourceName": cp_lib.getResourceName(resource), | ||
"searchKey": sprintf("%smetadata.name={{%s}}.spec.forProvider.settings", [cp_lib.getPath(path), resource.metadata.name]), | ||
"issueType": "MissingAttribute", | ||
"keyExpectedValue": "Cluster.spec.forProvider.settings should have a ClusterSetting which name is 'containerInsights' with 'enabled' value", | ||
"keyActualValue": "Cluster.spec.forProvider.settings doesn't have a ClusterSetting which name is 'containerInsights' with 'enabled' value", | ||
"searchLine": common_lib.build_search_line(path, ["spec", "forProvider", "settings"]), | ||
} | ||
} | ||
|
||
container_insights(settings){ | ||
settings[0].name == "containerInsights" | ||
settings[0].value == "enabled" | ||
} |
10 changes: 10 additions & 0 deletions
10
...s/queries/crossplane/aws/ecs_cluster_with_container_insights_disabled/test/negative1.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,10 @@ | ||
apiVersion: ecs.aws.crossplane.io/v1alpha1 | ||
kind: Cluster | ||
metadata: | ||
name: example | ||
spec: | ||
forProvider: | ||
region: us-east-1 | ||
settings: | ||
- name: "containerInsights" | ||
value: "enabled" |
7 changes: 7 additions & 0 deletions
7
...s/queries/crossplane/aws/ecs_cluster_with_container_insights_disabled/test/positive1.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,7 @@ | ||
apiVersion: ecs.aws.crossplane.io/v1alpha1 | ||
kind: Cluster | ||
metadata: | ||
name: example | ||
spec: | ||
forProvider: | ||
region: us-east-1 |
8 changes: 8 additions & 0 deletions
8
...s/queries/crossplane/aws/ecs_cluster_with_container_insights_disabled/test/positive2.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,8 @@ | ||
apiVersion: ecs.aws.crossplane.io/v1alpha1 | ||
kind: Cluster | ||
metadata: | ||
name: example | ||
spec: | ||
forProvider: | ||
region: us-east-1 | ||
settings: [] |
10 changes: 10 additions & 0 deletions
10
...s/queries/crossplane/aws/ecs_cluster_with_container_insights_disabled/test/positive3.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,10 @@ | ||
apiVersion: ecs.aws.crossplane.io/v1alpha1 | ||
kind: Cluster | ||
metadata: | ||
name: example | ||
spec: | ||
forProvider: | ||
region: us-east-1 | ||
settings: | ||
- name: "containerInsights" | ||
value: "disabled" |
20 changes: 20 additions & 0 deletions
20
...plane/aws/ecs_cluster_with_container_insights_disabled/test/positive_expected_result.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,20 @@ | ||
[ | ||
{ | ||
"queryName": "ECS Cluster with Container Insights Disabled", | ||
"severity": "LOW", | ||
"line": 6, | ||
"fileName": "positive1.yaml" | ||
}, | ||
{ | ||
"queryName": "ECS Cluster with Container Insights Disabled", | ||
"severity": "LOW", | ||
"line": 8, | ||
"fileName": "positive2.yaml" | ||
}, | ||
{ | ||
"queryName": "ECS Cluster with Container Insights Disabled", | ||
"severity": "LOW", | ||
"line": 8, | ||
"fileName": "positive3.yaml" | ||
} | ||
] |