diff --git a/assets/queries/serverlessFW/serverless_function_without_unique_iam_role/query.rego b/assets/queries/serverlessFW/serverless_function_without_unique_iam_role/query.rego index 70916a4acef..a7aefe3f136 100644 --- a/assets/queries/serverlessFW/serverless_function_without_unique_iam_role/query.rego +++ b/assets/queries/serverlessFW/serverless_function_without_unique_iam_role/query.rego @@ -6,6 +6,7 @@ import data.generic.serverlessfw as sfw_lib CxPolicy[result] { document := input.document[i] functions := document.functions + is_object(functions) function := functions[fname] not common_lib.valid_key(function, "role") @@ -21,3 +22,23 @@ CxPolicy[result] { "searchLine": common_lib.build_search_line(["functions", fname], []), } } + +CxPolicy[result] { + document := input.document[i] + functions := document.functions + is_array(functions) + function := functions[k][fname] + + not common_lib.valid_key(function, "role") + + result := { + "documentId": input.document[i].id, + "resourceType": sfw_lib.resourceTypeMapping("function", document.provider.name), + "resourceName": fname, + "searchKey": sprintf("functions[%s].%s", [k,fname]), + "issueType": "MissingAttribute", + "keyExpectedValue": "'role' should be defined inside the function", + "keyActualValue": "'role' is not defined", + "searchLine": common_lib.build_search_line(["functions",k ,fname], []), + } +} diff --git a/assets/queries/serverlessFW/serverless_function_without_unique_iam_role/test/negative2.yml b/assets/queries/serverlessFW/serverless_function_without_unique_iam_role/test/negative2.yml new file mode 100644 index 00000000000..2cf964b57e7 --- /dev/null +++ b/assets/queries/serverlessFW/serverless_function_without_unique_iam_role/test/negative2.yml @@ -0,0 +1,13 @@ +service: service +frameworkVersion: '2' +provider: + name: aws + runtime: nodejs12.x + +functions: + - hello: + handler: handler.hello + onError: arn:aws:sns:us-east-1:XXXXXX:test + tags: + foo: bar + role: arn:aws:iam::XXXXXX:role/role \ No newline at end of file diff --git a/assets/queries/serverlessFW/serverless_function_without_unique_iam_role/test/positive2.yml b/assets/queries/serverlessFW/serverless_function_without_unique_iam_role/test/positive2.yml new file mode 100644 index 00000000000..f39f77c0332 --- /dev/null +++ b/assets/queries/serverlessFW/serverless_function_without_unique_iam_role/test/positive2.yml @@ -0,0 +1,12 @@ +service: service +frameworkVersion: '2' +provider: + name: aws + runtime: nodejs12.x + +functions: + - hello: + handler: handler.hello + onError: arn:aws:sns:us-east-1:XXXXXX:test + tags: + foo: bar \ No newline at end of file diff --git a/assets/queries/serverlessFW/serverless_function_without_unique_iam_role/test/positive_expected_result.json b/assets/queries/serverlessFW/serverless_function_without_unique_iam_role/test/positive_expected_result.json index 3ff18b2a79a..893651176a2 100644 --- a/assets/queries/serverlessFW/serverless_function_without_unique_iam_role/test/positive_expected_result.json +++ b/assets/queries/serverlessFW/serverless_function_without_unique_iam_role/test/positive_expected_result.json @@ -4,5 +4,11 @@ "severity": "MEDIUM", "line": 8, "fileName": "positive1.yml" + }, + { + "queryName": "Serverless Function Without Unique IAM Role", + "severity": "MEDIUM", + "line": 8, + "fileName": "positive2.yml" } ]