Merge pull request #6678 from Checkmarx/kics-767-pulumi

feat(query): pulumi ECS Cluster with Container Insights Disabled

assets/queries/pulumi/aws/ecs_cluster_container_insights_disabled/metadata.json

@@ -0,0 +1,11 @@
+{
+  "id": "abcefee4-a0c1-4245-9f82-a473f79a9e2f",
+  "queryName": "ECS Cluster with Container Insights Disabled",
+  "severity": "LOW",
+  "category": "Observability",
+  "descriptionText": "ECS Cluster should enable container insights",
+  "descriptionUrl": "https://www.pulumi.com/registry/packages/aws/api-docs/ecs/cluster/#settings_yaml",
+  "platform": "Pulumi",
+  "descriptionID": "6fd99865",
+  "cloudProvider": "aws"
+}

assets/queries/pulumi/aws/ecs_cluster_container_insights_disabled/query.rego

@@ -0,0 +1,45 @@
+package Cx
+
+import data.generic.common as common_lib
+import data.generic.pulumi as plm_lib
+
+CxPolicy[result] {
+	resource := input.document[i].resources[name]
+	resource.type == "aws:ecs:Cluster"
+
+	not common_lib.valid_key(resource.properties, "settings")
+
+	result := {
+		"documentId": input.document[i].id,
+		"resourceType": resource.type,
+		"resourceName": plm_lib.getResourceName(resource, name),
+		"searchKey": sprintf("resources[%s].properties", [name]),
+		"issueType": "MissingAttribute",
+		"keyExpectedValue": "Attribute 'settings' should be defined and have a ClusterSetting named 'containerInsights' which value is 'enabled'",
+		"keyActualValue": "Attribute 'settings' is not defined",
+		"searchLine": common_lib.build_search_line(["resources", name, "properties"], []),
+	}
+}
+
+CxPolicy[result] {
+	resource := input.document[i].resources[name]
+	resource.type == "aws:ecs:Cluster"
+
+	not containerInsights(resource.properties.settings)
+
+	result := {
+		"documentId": input.document[i].id,
+		"resourceType": resource.type,
+		"resourceName": plm_lib.getResourceName(resource, name),
+		"searchKey": sprintf("resources[%s].properties.settings", [name]),
+		"issueType": "IncorrectValue",
+		"keyExpectedValue": "Attribute 'settings' should have a ClusterSetting named 'containerInsights' which value is 'enabled'",
+		"keyActualValue": "Attribute 'settings' doesn't have a ClusterSetting named 'containerInsights' which value is 'enabled'",
+		"searchLine": common_lib.build_search_line(["resources", name, "properties","settings"], []),
+	}
+}
+
+containerInsights(settings){
+	settings[0].name == "containerInsights"
+	settings[0].value == "enabled"
+}

assets/queries/pulumi/aws/ecs_cluster_container_insights_disabled/test/negative1.yaml

@@ -0,0 +1,10 @@
+name: aws-eks
+runtime: yaml
+description: An EKS cluster
+resources:
+  foo:
+    type: aws:ecs:Cluster
+    properties:
+      settings:
+        - name: containerInsights
+          value: enabled

assets/queries/pulumi/aws/ecs_cluster_container_insights_disabled/test/positive1.yaml

@@ -0,0 +1,10 @@
+name: aws-eks
+runtime: yaml
+description: An EKS cluster
+resources:
+  foo:
+    type: aws:ecs:Cluster
+    properties:
+      settings:
+        - name: containerInsights
+          value: disabled

assets/queries/pulumi/aws/ecs_cluster_container_insights_disabled/test/positive2.yaml

@@ -0,0 +1,8 @@
+name: aws-eks
+runtime: yaml
+description: An EKS cluster
+resources:
+  foo:
+    type: aws:ecs:Cluster
+    properties:
+      settings: []

assets/queries/pulumi/aws/ecs_cluster_container_insights_disabled/test/positive3.yaml

@@ -0,0 +1,8 @@
+name: aws-eks
+runtime: yaml
+description: An EKS cluster
+resources:
+  foo:
+    type: aws:ecs:Cluster
+    properties:
+      description: example

assets/queries/pulumi/aws/ecs_cluster_container_insights_disabled/test/positive_expected_result.json

@@ -0,0 +1,20 @@
+[
+	{
+		"queryName": "ECS Cluster with Container Insights Disabled",
+		"severity": "LOW",
+		"line": 8,
+		"fileName": "positive1.yaml"
+	},
+	{
+		"queryName": "ECS Cluster with Container Insights Disabled",
+		"severity": "LOW",
+		"line": 8,
+		"fileName": "positive2.yaml"
+	},
+	{
+		"queryName": "ECS Cluster with Container Insights Disabled",
+		"severity": "LOW",
+		"line": 7,
+		"fileName": "positive3.yaml"
+	}
+]