fix(query): added support for database resources to 2 queries - terraform/azure

assets/queries/terraform/azure/function_app_client_certificates_unrequired/query.rego

@@ -3,43 +3,60 @@ package Cx
 import data.generic.common as common_lib
 import data.generic.terraform as tf_lib
 
+types := {"azurerm_function_app", "azurerm_linux_function_app", "azurerm_windows_function_app"}
+
 CxPolicy[result] {
-	function := input.document[i].resource.azurerm_function_app[name]
+    function := input.document[i].resource[types[t]][name]
 
-	not common_lib.valid_key(function, "client_cert_mode")
+	results := client_certificate_not_required(function,name,types[t])
+	results != ""
 
 	result := {
 		"documentId": input.document[i].id,
-		"resourceType": "azurerm_function_app",
-		"resourceName": tf_lib.get_resource_name(function, name),
-		"searchKey": sprintf("azurerm_function_app[%s]", [name]),
-		"issueType": "MissingAttribute",
-		"keyExpectedValue": sprintf("'azurerm_function_app[%s].client_cert_mode' should be defined and not null", [name]),
-		"keyActualValue": sprintf("'azurerm_function_app[%s].client_cert_mode' is undefined or null", [name]),
-		"searchLine": common_lib.build_search_line(["resource", "azurerm_function_app", name], []),
-		"remediation": "client_cert_mode = \"Required\"",
-		"remediationType": "addition",
+		"resourceType": types[t],
+		"resourceName": tf_lib.get_resource_name(function, name), 
+		"searchKey": results.searchKey,
+		"issueType": results.issueType,
+		"keyExpectedValue": results.keyExpectedValue,
+		"keyActualValue": results.keyActualValue,
+		"searchLine": results.searchLine,
+		"remediation": results.remediation,
+		"remediationType": results.remediationType,
 	}
 }
 
-CxPolicy[result] {
-	function := input.document[i].resource.azurerm_function_app[name]
+client_certificate_not_required(function,name,type) = results { 
+	field_name = get_field(type)
+	not common_lib.valid_key(function, field_name)
 
-	function.client_cert_mode != "Required"
+	results := {
+		"searchKey": sprintf("%s[%s]", [type, name]),
+		"issueType": "MissingAttribute",
+		"keyExpectedValue": sprintf("'%s[%s].%s' should be defined and not null", [type, name, field_name]),
+		"keyActualValue": sprintf("'%s[%s].%s' is undefined or null", [type, name, field_name]),
+		"searchLine": common_lib.build_search_line(["resource", field_name, name], []),
+		"remediation": sprintf("%s = \"Required\"",[field_name]),
+		"remediationType": "addition",
+	}
+
+} else = results { 
+	field_name = get_field(type)
+	function[field_name] != "Required"
 
-	result := {
-		"documentId": input.document[i].id,
-		"resourceType": "azurerm_function_app",
-		"resourceName": tf_lib.get_resource_name(function, name),
-		"searchKey": sprintf("azurerm_function_app[%s].client_cert_mode", [name]),
+	results := {
+		"searchKey": sprintf("%s[%s].%s", [type, name, field_name]),
 		"issueType": "IncorrectValue",
-		"keyExpectedValue": sprintf("'azurerm_function_app[%s].client_cert_mode' should be set to 'Required'", [name]),
-		"keyActualValue": sprintf("'azurerm_function_app[%s].client_cert_mode' is not set to 'Required'", [name]),
-		"searchLine": common_lib.build_search_line(["resource", "azurerm_function_app", name, "client_cert_mode"], []),
+		"keyExpectedValue": sprintf("'%s[%s].%s' should be set to 'Required'", [type, name, field_name]),
+		"keyActualValue": sprintf("'%s[%s].%s' is not set to 'Required'", [type, name, field_name]),
+		"searchLine": common_lib.build_search_line(["resource", field_name, name, "client_cert_mode"], []),
 		"remediation": json.marshal({
-			"before": sprintf("%s", [function.client_cert_mode]),
+			"before": sprintf("%s", [function[field_name]]),
 			"after": "Required"
 		}),
 		"remediationType": "replacement",
 	}
-}
+} else = ""
+
+get_field("azurerm_function_app")     = "client_cert_mode" 
+get_field("azurerm_linux_function_app")   = "client_certificate_mode"
+get_field("azurerm_windows_function_app") = "client_certificate_mode"

assets/queries/terraform/azure/sql_server_ingress_from_any_ip/query.rego

@@ -4,7 +4,7 @@ import data.generic.common as common_lib
 import data.generic.terraform as tf_lib
 
 CxPolicy[result] {
-	types := ["azurerm_mssql_firewall_rule","azurerm_sql_firewall_rule"]
+	types := ["azurerm_mssql_firewall_rule","azurerm_sql_firewall_rule", "azurerm_mariadb_firewall_rule", "azurerm_postgresql_firewall_rule", "azurerm_postgresql_flexible_server_firewall_rule", "azurerm_mysql_flexible_server_firewall_rule"]
 	firewall := input.document[i].resource[types[i2]][name]
 	firewall.start_ip_address = "0.0.0.0"
 	checkEndIP(firewall.end_ip_address)

assets/queries/terraform/azure/sql_server_ingress_from_any_ip/test/negative1.tf

@@ -1,7 +1,23 @@
-resource "azurerm_sql_firewall_rule" "negative1" {
+resource "azurerm_sql_firewall_rule" "negative1-1" {
   name                = "FirewallRule1"
   resource_group_name = azurerm_resource_group.example.name
   server_name         = azurerm_sql_server.example.name
   start_ip_address    = "10.0.17.62"
   end_ip_address      = "10.0.17.62"
+}
+
+resource "azurerm_sql_firewall_rule" "negative1-2" {
+  name                = "FirewallRule1"
+  resource_group_name = azurerm_resource_group.example.name
+  server_name         = azurerm_sql_server.example.name
+  start_ip_address    = "10.0.17.62"
+  end_ip_address      = "255.255.255.255"
+}
+
+resource "azurerm_sql_firewall_rule" "negative1-3" {
+  name                = "FirewallRule1"
+  resource_group_name = azurerm_resource_group.example.name
+  server_name         = azurerm_sql_server.example.name
+  start_ip_address    = "0.0.0.0"
+  end_ip_address      = "10.0.17.62"
 }

assets/queries/terraform/azure/sql_server_ingress_from_any_ip/test/negative2.tf

@@ -1,6 +1,20 @@
-resource "azurerm_mssql_firewall_rule" "negative1" {
+resource "azurerm_mssql_firewall_rule" "negative1-1" {
   name              = "FirewallRule1"
   server_id         = azurerm_mssql_server.example.id
   start_ip_address  = "10.0.17.62"
   end_ip_address    = "10.0.17.62"
 }
+
+resource "azurerm_mssql_firewall_rule" "negative1-2" {
+  name              = "FirewallRule1"
+  server_id         = azurerm_mssql_server.example.id
+  start_ip_address  = "10.0.17.62"
+  end_ip_address    = "255.255.255.255"
+}
+
+resource "azurerm_mssql_firewall_rule" "negative1-3" {
+  name              = "FirewallRule1"
+  server_id         = azurerm_mssql_server.example.id
+  start_ip_address  = "0.0.0.0"
+  end_ip_address    = "10.0.17.62"
+}

assets/queries/terraform/azure/sql_server_ingress_from_any_ip/test/negative3.tf

@@ -0,0 +1,20 @@
+resource "azurerm_mariadb_firewall_rule" "negative3-1" {
+  name                = "test-rule"
+  server_name         = "test-server"
+  start_ip_address    = "10.0.17.62"
+  end_ip_address      = "10.0.17.62"
+}
+
+resource "azurerm_mariadb_firewall_rule" "negative3-2" {
+  name                = "test-rule"
+  server_name         = "test-server"
+  start_ip_address    = "0.0.0.0"
+  end_ip_address      = "10.0.17.62"
+}
+
+resource "azurerm_mariadb_firewall_rule" "negative3-3" {
+  name                = "test-rule"
+  server_name         = "test-server"
+  start_ip_address    = "10.0.17.62"
+  end_ip_address      = "255.255.255"
+}

assets/queries/terraform/azure/sql_server_ingress_from_any_ip/test/negative4.tf

@@ -0,0 +1,23 @@
+resource "azurerm_postgresql_firewall_rule" "negative4-1" {
+  name     = "office"
+  resource_group_name = azurerm_resource_group.example.name
+  server_name         = azurerm_postgresql_server.example.name
+  start_ip_address    = "10.0.17.62"
+  end_ip_address      = "10.0.17.62"
+}
+
+resource "azurerm_postgresql_firewall_rule" "negative4-2" {
+  name     = "office"
+  resource_group_name = azurerm_resource_group.example.name
+  server_name         = azurerm_postgresql_server.example.name
+  start_ip_address    = "0.0.0.0"
+  end_ip_address      = "10.0.17.62"
+}
+
+resource "azurerm_postgresql_firewall_rule" "negative4-3" {
+  name     = "office"
+  resource_group_name = azurerm_resource_group.example.name
+  server_name         = azurerm_postgresql_server.example.name
+  start_ip_address    = "10.0.17.62"
+  end_ip_address      = "255.255.255"
+}

assets/queries/terraform/azure/sql_server_ingress_from_any_ip/test/negative5.tf

@@ -0,0 +1,20 @@
+resource "azurerm_postgresql_flexible_server_firewall_rule" "negative5-1" {
+  name = "example-fw"
+  server_id        = azurerm_postgresql_flexible_server.example.id
+  start_ip_address    = "10.0.17.62"
+  end_ip_address      = "10.0.17.62"
+}
+
+resource "azurerm_postgresql_flexible_server_firewall_rule" "negative5-2" {
+  name = "example-fw"
+  server_id        = azurerm_postgresql_flexible_server.example.id
+  start_ip_address    = "0.0.0.0"
+  end_ip_address      = "10.0.17.62"
+}
+
+resource "azurerm_postgresql_flexible_server_firewall_rule" "negative5-3" {
+  name = "example-fw"
+  server_id        = azurerm_postgresql_flexible_server.example.id
+  start_ip_address    = "10.0.17.62"
+  end_ip_address      = "255.255.255.255"
+}

assets/queries/terraform/azure/sql_server_ingress_from_any_ip/test/negative6.tf

@@ -0,0 +1,23 @@
+resource "azurerm_mysql_flexible_server_firewall_rule" "negative6-1" {
+  name                = "office"
+  resource_group_name = azurerm_resource_group.example.name
+  server_name         = azurerm_mysql_flexible_server.example.name
+  start_ip_address    = "10.0.17.62"
+  end_ip_address      = "10.0.17.62"
+}
+
+resource "azurerm_mysql_flexible_server_firewall_rule" "negative6-2" {
+  name                = "office"
+  resource_group_name = azurerm_resource_group.example.name
+  server_name         = azurerm_mysql_flexible_server.example.name
+  start_ip_address    = "0.0.0.0"
+  end_ip_address      = "10.0.17.62"
+}
+
+resource "azurerm_mysql_flexible_server_firewall_rule" "negative6-3" {
+  name                = "office"
+  resource_group_name = azurerm_resource_group.example.name
+  server_name         = azurerm_mysql_flexible_server.example.name
+  start_ip_address    = "10.0.17.62"
+  end_ip_address      = "255.255.255.255"
+}

assets/queries/terraform/azure/sql_server_ingress_from_any_ip/test/positive3.tf

@@ -0,0 +1,6 @@
+resource "azurerm_mariadb_firewall_rule" "example" {
+  name                = "test-rule"
+  server_name         = "test-server"
+  start_ip_address    = "0.0.0.0"
+  end_ip_address      = "255.255.255.255"
+}

assets/queries/terraform/azure/sql_server_ingress_from_any_ip/test/positive4.tf

@@ -0,0 +1,7 @@
+resource "azurerm_postgresql_firewall_rule" "example" {
+  name     = "office"
+  resource_group_name = azurerm_resource_group.example.name
+  server_name         = azurerm_postgresql_server.example.name
+  start_ip_address    = "0.0.0.0"
+  end_ip_address      = "255.255.255.255"
+}

assets/queries/terraform/azure/sql_server_ingress_from_any_ip/test/positive5.tf

@@ -0,0 +1,6 @@
+resource "azurerm_postgresql_flexible_server_firewall_rule" "example" {
+  name = "example-fw"
+  server_id        = azurerm_postgresql_flexible_server.example.id
+  start_ip_address    = "0.0.0.0"
+  end_ip_address      = "255.255.255.255"
+}

assets/queries/terraform/azure/sql_server_ingress_from_any_ip/test/positive6.tf

@@ -0,0 +1,7 @@
+resource "azurerm_mysql_flexible_server_firewall_rule" "example" {
+  name                = "office"
+  resource_group_name = azurerm_resource_group.example.name
+  server_name         = azurerm_mysql_flexible_server.example.name
+  start_ip_address    = "0.0.0.0"
+  end_ip_address      = "255.255.255.255"
+}

assets/queries/terraform/azure/sql_server_ingress_from_any_ip/test/positive_expected_result.json

@@ -10,5 +10,29 @@
     "severity": "CRITICAL",
     "line": 1,
     "fileName": "positive2.tf"
+  },
+  {
+    "queryName": "SQLServer Ingress From Any IP",
+    "severity": "CRITICAL",
+    "line": 1,
+    "fileName": "positive3.tf"
+  },
+  {
+    "queryName": "SQLServer Ingress From Any IP",
+    "severity": "CRITICAL",
+    "line": 1,
+    "fileName": "positive4.tf"
+  },
+  {
+    "queryName": "SQLServer Ingress From Any IP",
+    "severity": "CRITICAL",
+    "line": 1,
+    "fileName": "positive5.tf"
+  },
+  {
+    "queryName": "SQLServer Ingress From Any IP",
+    "severity": "CRITICAL",
+    "line": 1,
+    "fileName": "positive6.tf"
   }
 ]

assets/queries/terraform/azure/unrestricted_sql_server_access/query.rego

@@ -4,7 +4,7 @@ import data.generic.common as common_lib
 import data.generic.terraform as tf_lib
 
 CxPolicy[result] {
-	types := ["azurerm_mssql_firewall_rule","azurerm_sql_firewall_rule"]
+	types := ["azurerm_mssql_firewall_rule","azurerm_sql_firewall_rule", "azurerm_mariadb_firewall_rule", "azurerm_postgresql_firewall_rule", "azurerm_postgresql_flexible_server_firewall_rule", "azurerm_mysql_flexible_server_firewall_rule"]
 	resource := input.document[i].resource[types[i2]][name]
 	results := low_abs_difference_or_both_unspecified(resource.start_ip_address ,resource.end_ip_address)
 	results != ""

assets/queries/terraform/azure/unrestricted_sql_server_access/test/negative2.tf

@@ -18,4 +18,4 @@ resource "azurerm_mssql_firewall_rule" "negative3" {
   server_id         = azurerm_mssql_server.negative2.id
   start_ip_address  = "10.0.17.62"
   end_ip_address    = "10.0.17.62"
-}
+}

assets/queries/terraform/azure/unrestricted_sql_server_access/test/negative3.tf

@@ -0,0 +1,27 @@
+resource "azurerm_resource_group" "mariadb_negative_rg" {
+  name     = "acceptanceTestResourceGroup1"
+  location = "West US"
+}
+
+resource "azurerm_mariadb_server" "mariadb_negative_server" {
+  name                = "negativemariadbserver"
+  location            = azurerm_resource_group.mariadb_negative_rg.location
+  resource_group_name = azurerm_resource_group.mariadb_negative_rg.name
+  administrator_login = "mariadbadmin"
+  administrator_login_password = "MyS3cureP4ss!"
+  sku_name            = "B_Gen5_2"
+  storage_mb          = 5120
+  version             = "10.2"
+  auto_grow_enabled   = true
+  backup_retention_days = 7
+  geo_redundant_backup_enabled = false
+  ssl_enforcement_enabled = true
+}
+
+resource "azurerm_mariadb_firewall_rule" "mariadb_negative_fw" {
+  name                = "FirewallRule1"
+  resource_group_name = azurerm_resource_group.mariadb_negative_rg.name
+  server_name         = azurerm_mariadb_server.mariadb_negative_server.name
+  start_ip_address    = "10.0.17.62"
+  end_ip_address      = "10.0.17.62"
+}

assets/queries/terraform/azure/unrestricted_sql_server_access/test/negative4.tf

@@ -0,0 +1,27 @@
+resource "azurerm_resource_group" "psql_negative_rg" {
+  name     = "acceptanceTestResourceGroup1"
+  location = "West US"
+}
+
+resource "azurerm_postgresql_server" "psql_negative_server" {
+  name                = "negativepostgresqlserver"
+  location            = azurerm_resource_group.psql_negative_rg.location
+  resource_group_name = azurerm_resource_group.psql_negative_rg.name
+  administrator_login = "psqladmin"
+  administrator_login_password = "MyS3cureP4ss!"
+  sku_name            = "B_Gen5_2"
+  storage_mb          = 5120
+  version             = "11"
+  auto_grow_enabled   = true
+  backup_retention_days = 7
+  geo_redundant_backup_enabled = false
+  ssl_enforcement_enabled = true
+}
+
+resource "azurerm_postgresql_firewall_rule" "psql_negative_fw" {
+  name                = "FirewallRule1"
+  resource_group_name = azurerm_resource_group.psql_negative_rg.name
+  server_name         = azurerm_postgresql_server.psql_negative_server.name
+  start_ip_address    = "10.0.17.62"
+  end_ip_address      = "10.0.17.62"
+}