feat(parser): support ssl certificates and swagger files set as attri…

…butes for Ansible and Terraform (#2958) (#2960)

.github/scripts/samples-linters/ignore-list/terraform

@@ -8,3 +8,5 @@ assets/queries/terraform/aws/hardcoded_aws_access_key/test/positive.tf
 assets/queries/terraform/aws/hardcoded_aws_access_key/test/negative.tf
 assets/queries/terraform/aws/iam_role_allows_all_principals_to_assume/test/positive.tf
 assets/queries/terraform/aws/iam_role_allows_all_principals_to_assume/test/negative.tf
+assets/queries/terraform/aws/certificate_rsa_key_bytes_lower_than_128/test/positive2.tf
+assets/queries/terraform/aws/certificate_rsa_key_bytes_lower_than_128/test/negative2.tf

assets/queries/ansible/aws/api_gateway_without_configured_authorizer/metadata.json

@@ -0,0 +1,9 @@
+{
+  "id": "b16cdb37-ce15-4ab2-8401-d42b05d123fc",
+  "queryName": "API Gateway Without Configured Authorizer",
+  "severity": "MEDIUM",
+  "category": "Access Control",
+  "descriptionText": "API Gateway REST API should have an API Gateway Authorizer",
+  "descriptionUrl": "https://docs.ansible.com/ansible/latest/collections/community/aws/aws_api_gateway_module.html",
+  "platform": "Ansible"
+}

assets/queries/ansible/aws/api_gateway_without_configured_authorizer/query.rego

@@ -0,0 +1,74 @@
+package Cx
+
+import data.generic.ansible as ansLib
+
+modules := {"community.aws.aws_api_gateway", "aws_api_gateway"}
+
+CxPolicy[result] {
+	task := ansLib.tasks[id][t]
+
+	apiGateway := task[modules[m]]
+	ansLib.checkState(apiGateway)
+
+	content_info := get_content(apiGateway)
+
+	object.get(content_info.content.components.securitySchemes[x], "x-amazon-apigateway-authorizer", "undefined") == "undefined"
+
+	result := {
+		"documentId": id,
+		"searchKey": sprintf("name={{%s}}.{{%s}}.%s", [task.name, modules[m], content_info.attribute]),
+		"issueType": "IncorrectValue",
+		"keyExpectedValue": sprintf("'%s.%s' has a authorizer set", [modules[m], content_info.attribute]),
+		"keyActualValue": sprintf("'%s.%s' does not have a authorizer set", [modules[m], content_info.attribute]),
+	}
+}
+
+CxPolicy[result] {
+	task := ansLib.tasks[id][t]
+
+	apiGateway := task[modules[m]]
+	ansLib.checkState(apiGateway)
+
+	text := apiGateway.swagger_text
+
+	not contains(text, "x-amazon-apigateway-authorizer")
+
+	result := {
+		"documentId": id,
+		"searchKey": sprintf("name={{%s}}.{{%s}}.swagger_text", [task.name, modules[m]]),
+		"issueType": "IncorrectValue",
+		"keyExpectedValue": sprintf("'%s.swagger_text' has a authorizer set", [modules[m]]),
+		"keyActualValue": sprintf("'%s.swagger_text' does not have a authorizer set", [modules[m]]),
+	}
+}
+
+CxPolicy[result] {
+	task := ansLib.tasks[id][t]
+
+	apiGateway := task[modules[m]]
+	ansLib.checkState(apiGateway)
+
+	without_authorizer(apiGateway)
+
+	result := {
+		"documentId": id,
+		"searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]),
+		"issueType": "IncorrectValue",
+		"keyExpectedValue": sprintf("'%s' has swagger_file, swagger_text or swagger_dict set", [modules[m]]),
+		"keyActualValue": sprintf("'%s' does not have swagger_file, swagger_text or swagger_dict set", [modules[m]]),
+	}
+}
+
+without_authorizer(apiGateway) {
+	object.get(apiGateway, "swagger_file", "undefined") == "undefined"
+	object.get(apiGateway, "swagger_text", "undefined") == "undefined"
+	object.get(apiGateway, "swagger_dict", "undefined") == "undefined"
+}
+
+get_content(apiGateway) = content_info {
+	content := apiGateway.swagger_file.content
+	content_info := {"content": content, "attribute": "swagger_file"}
+} else = content_info {
+	content := apiGateway.swagger_dict
+	content_info := {"content": content, "attribute": "swagger_dict"}
+}

assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/negative1.yaml

@@ -0,0 +1,9 @@
+- name: Setup AWS API Gateway setup on AWS and deploy API definition3
+  community.aws.aws_api_gateway:
+    swagger_file: swaggerFile.yaml
+    stage: production
+    cache_enabled: true
+    cache_size: "1.6"
+    tracing_enabled: true
+    endpoint_type: EDGE
+    state: present

assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/negative2.yaml

@@ -0,0 +1,39 @@
+- name: Setup AWS API Gateway setup on AWS and deploy API definition22222
+  community.aws.aws_api_gateway:
+    swagger_dict:
+      {
+        "openapi": "3.0.0",
+        "info":
+          {
+            "title": "Simple API Overview",
+            "version": "1.0.0",
+            "contact": { "name": "contact", "email": "[email protected]" },
+          },
+        "components":
+          {
+            "securitySchemes":
+              {
+                "request_authorizer_single_stagevar":
+                  {
+                    "type": "apiKey",
+                    "name": "Unused",
+                    "in": "header",
+                    "x-amazon-apigateway-authtype": "custom",
+                    "x-amazon-apigateway-authorizer":
+                      {
+                        "type": "request",
+                        "identitySource": "stageVariables.stage",
+                        "authorizerCredentials": "arn:aws:iam::123456789012:role/AWSepIntegTest-CS-LambdaRole",
+                        "authorizerUri": "arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:123456789012:function:APIGateway-Request-Authorizer:vtwo/invocations",
+                        "authorizerResultTtlInSeconds": 300,
+                      },
+                  },
+              },
+          },
+      }
+    stage: production
+    cache_enabled: true
+    cache_size: "1.6"
+    tracing_enabled: true
+    endpoint_type: EDGE
+    state: present

assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/negative3.yaml

@@ -0,0 +1,27 @@
+- name: Setup AWS API Gateway setup on AWS and deploy API 222
+  aws_api_gateway:
+    swagger_text: |
+      openapi: 3.0.0
+      info:
+        title: Sample API
+        description: Optional multiline or single-line description
+        version: 0.1.9
+      components:
+        securitySchemes:
+          request_authorizer_single_stagevar:
+            type: apiKey
+            name: Unused
+            in: header
+            x-amazon-apigateway-authtype: custom
+            x-amazon-apigateway-authorizer:
+              type: request
+              identitySource: stageVariables.stage
+              authorizerCredentials: arn:aws:iam::123456789012:role/AWSepIntegTest-CS-LambdaRole
+              authorizerUri: arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:123456789012:function:APIGateway-Request-Authorizer:vtwo/invocations
+              authorizerResultTtlInSeconds: 300
+          stage: production
+    cache_enabled: true
+    cache_size: "1.6"
+    tracing_enabled: true
+    endpoint_type: EDGE
+    state: present

assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/positive1.yaml

@@ -0,0 +1,31 @@
+- name: Setup AWS API Gateway setup on AWS and deploy API definition
+  community.aws.aws_api_gateway:
+    swagger_dict:
+      {
+        "openapi": "3.0.0",
+        "info":
+          {
+            "title": "Simple API Overview",
+            "version": "1.0.0",
+            "contact": { "name": "contact", "email": "[email protected]" },
+          },
+        "components":
+          {
+            "securitySchemes":
+              {
+                "request_authorizer_single_stagevar":
+                  {
+                    "type": "apiKey",
+                    "name": "Unused",
+                    "in": "header",
+                    "x-amazon-apigateway-authtype": "custom",
+                  },
+              },
+          },
+      }
+    stage: production
+    cache_enabled: true
+    cache_size: "1.6"
+    tracing_enabled: true
+    endpoint_type: EDGE
+    state: present

assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/positive2.yaml

@@ -0,0 +1,8 @@
+- name: Setup AWS API Gateway setup on AWS and deploy API definition2
+  aws_api_gateway:
+    stage: production
+    cache_enabled: true
+    cache_size: "1.6"
+    tracing_enabled: true
+    endpoint_type: EDGE
+    state: present

assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/positive3.yaml

@@ -0,0 +1,9 @@
+- name: Setup AWS API Gateway setup on AWS and deploy API 222
+  aws_api_gateway:
+    swagger_file: swaggerFileWithoutAuthorizer.json
+    stage: production
+    cache_enabled: true
+    cache_size: "1.6"
+    tracing_enabled: true
+    endpoint_type: EDGE
+    state: present

assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/positive4.yaml

@@ -0,0 +1,21 @@
+- name: Setup AWS API Gateway setup on AWS and deploy API 222
+  aws_api_gateway:
+    swagger_text: |
+      openapi: 3.0.0
+      info:
+        title: Sample API
+        description: Optional multiline or single-line description
+        version: 0.1.9
+      components:
+        ssecuritySchemes:
+          request_authorizer_single_stagevar:
+            type: apiKey
+            name: Unused
+            in: header
+            x-amazon-apigateway-authtype: custom
+    stage: production
+    cache_enabled: true
+    cache_size: "1.6"
+    tracing_enabled: true
+    endpoint_type: EDGE
+    state: present

assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/positive_expected_result.json

@@ -0,0 +1,26 @@
+[
+  {
+    "queryName": "API Gateway Without Configured Authorizer",
+    "severity": "MEDIUM",
+    "line": 3,
+    "fileName": "positive1.yaml"
+  },
+  {
+    "queryName": "API Gateway Without Configured Authorizer",
+    "severity": "MEDIUM",
+    "line": 2,
+    "fileName": "positive2.yaml"
+  },
+  {
+    "queryName": "API Gateway Without Configured Authorizer",
+    "severity": "MEDIUM",
+    "line": 3,
+    "fileName": "positive3.yaml"
+  },
+  {
+    "queryName": "API Gateway Without Configured Authorizer",
+    "severity": "MEDIUM",
+    "line": 3,
+    "fileName": "positive4.yaml"
+  }
+]

assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/swaggerFile.json

@@ -0,0 +1,28 @@
+{
+  "openapi": "3.0.0",
+  "info": {
+    "title": "Simple API Overview",
+    "version": "1.0.0",
+    "contact": {
+      "name": "contact",
+      "email": "[email protected]"
+    }
+  },
+  "components": {
+    "securitySchemes": {
+      "request_authorizer_single_stagevar": {
+        "type": "apiKey",
+        "name": "Unused",
+        "in": "header",
+        "x-amazon-apigateway-authtype": "custom",
+        "x-amazon-apigateway-authorizer": {
+          "type": "request",
+          "identitySource": "stageVariables.stage",
+          "authorizerCredentials": "arn:aws:iam::123456789012:role/AWSepIntegTest-CS-LambdaRole",
+          "authorizerUri": "arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:123456789012:function:APIGateway-Request-Authorizer:vtwo/invocations",
+          "authorizerResultTtlInSeconds": 300
+        }
+      }
+    }
+  }
+}

assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/swaggerFile.yaml

@@ -0,0 +1,20 @@
+openapi: 3.0.0
+info:
+  title: Simple API Overview
+  version: 1.0.0
+  contact:
+    name: contact
+    email: [email protected]
+components:
+  securitySchemes:
+    request_authorizer_single_stagevar:
+      type: apiKey
+      name: Unused
+      in: header
+      x-amazon-apigateway-authtype: custom
+      x-amazon-apigateway-authorizer:
+        type: request
+        identitySource: stageVariables.stage
+        authorizerCredentials: arn:aws:iam::123456789012:role/AWSepIntegTest-CS-LambdaRole
+        authorizerUri: arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:123456789012:function:APIGateway-Request-Authorizer:vtwo/invocations
+        authorizerResultTtlInSeconds: 300

assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/swaggerFileWithoutAuthorizer.json

@@ -0,0 +1,21 @@
+{
+  "openapi": "3.0.0",
+  "info": {
+    "title": "Simple API Overview",
+    "version": "1.0.0",
+    "contact": {
+      "name": "contact",
+      "email": "[email protected]"
+    }
+  },
+  "components": {
+    "securitySchemes": {
+      "request_authorizer_single_stagevar": {
+        "type": "apiKey",
+        "name": "Unused",
+        "in": "header",
+        "x-amazon-apigateway-authtype": "custom"
+      }
+    }
+  }
+}

assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/swaggerFileWithoutAuthorizer.yaml

@@ -0,0 +1,14 @@
+openapi: 3.0.0
+info:
+  title: Simple API Overview
+  version: 1.0.0
+  contact:
+    name: contact
+    email: [email protected]
+components:
+  securitySchemes:
+    request_authorizer_single_stagevar:
+      type: apiKey
+      name: Unused
+      in: header
+      x-amazon-apigateway-authtype: custom

assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/metadata.json

@@ -0,0 +1,9 @@
+{
+  "id": "d5ec2080-340a-4259-b885-f833c4ea6a31",
+  "queryName": "Certificate RSA Key Bytes Lower Than 128",
+  "severity": "MEDIUM",
+  "category": "Insecure Configurations",
+  "descriptionText": "The certificate should use a RSA key with length higher than 128 bytes",
+  "descriptionUrl": "https://docs.ansible.com/ansible/2.10/collections/community/aws/aws_acm_module.html",
+  "platform": "Ansible"
+}

assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/query.rego

@@ -0,0 +1,20 @@
+package Cx
+
+import data.generic.ansible as ansLib
+
+CxPolicy[result] {
+	task := ansLib.tasks[id][t]
+
+	acm := task["community.aws.aws_acm"]
+	ansLib.checkState(acm)
+
+	acm.certificate.rsa_key_bytes <= 128
+
+	result := {
+		"documentId": id,
+		"searchKey": sprintf("name={{%s}}.community.aws.aws_acm.certificate", [task.name]),
+		"issueType": "IncorrectValue",
+		"keyExpectedValue": "'community.aws.aws_acm.certificate' uses a RSA key with length higher than 128 bytes",
+		"keyActualValue": "'community.aws.aws_acm.certificate' does not use a RSA key with length higher than 128 bytes",
+	}
+}

assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/test/negative.yaml

@@ -0,0 +1,6 @@
+- name: upload a self-signed certificate2
+  community.aws.aws_acm:
+    certificate: "{{ lookup('file', 'rsa4096.pem' ) }}"
+    privateKey: "{{ lookup('file', 'key.pem' ) }}"
+    name_tag: my_cert
+    region: ap-southeast-2