diff --git a/.github/scripts/samples-linters/ignore-list/terraform b/.github/scripts/samples-linters/ignore-list/terraform index c6627976e1f..eeec02f3fcf 100644 --- a/.github/scripts/samples-linters/ignore-list/terraform +++ b/.github/scripts/samples-linters/ignore-list/terraform @@ -8,3 +8,5 @@ assets/queries/terraform/aws/hardcoded_aws_access_key/test/positive.tf assets/queries/terraform/aws/hardcoded_aws_access_key/test/negative.tf assets/queries/terraform/aws/iam_role_allows_all_principals_to_assume/test/positive.tf assets/queries/terraform/aws/iam_role_allows_all_principals_to_assume/test/negative.tf +assets/queries/terraform/aws/certificate_rsa_key_bytes_lower_than_128/test/positive2.tf +assets/queries/terraform/aws/certificate_rsa_key_bytes_lower_than_128/test/negative2.tf diff --git a/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/metadata.json b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/metadata.json new file mode 100644 index 00000000000..95e1fd20fff --- /dev/null +++ b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/metadata.json @@ -0,0 +1,9 @@ +{ + "id": "b16cdb37-ce15-4ab2-8401-d42b05d123fc", + "queryName": "API Gateway Without Configured Authorizer", + "severity": "MEDIUM", + "category": "Access Control", + "descriptionText": "API Gateway REST API should have an API Gateway Authorizer", + "descriptionUrl": "https://docs.ansible.com/ansible/latest/collections/community/aws/aws_api_gateway_module.html", + "platform": "Ansible" +} diff --git a/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/query.rego b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/query.rego new file mode 100644 index 00000000000..8f2aba41a68 --- /dev/null +++ b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/query.rego @@ -0,0 +1,74 @@ +package Cx + +import data.generic.ansible as ansLib + +modules := {"community.aws.aws_api_gateway", "aws_api_gateway"} + +CxPolicy[result] { + task := ansLib.tasks[id][t] + + apiGateway := task[modules[m]] + ansLib.checkState(apiGateway) + + content_info := get_content(apiGateway) + + object.get(content_info.content.components.securitySchemes[x], "x-amazon-apigateway-authorizer", "undefined") == "undefined" + + result := { + "documentId": id, + "searchKey": sprintf("name={{%s}}.{{%s}}.%s", [task.name, modules[m], content_info.attribute]), + "issueType": "IncorrectValue", + "keyExpectedValue": sprintf("'%s.%s' has a authorizer set", [modules[m], content_info.attribute]), + "keyActualValue": sprintf("'%s.%s' does not have a authorizer set", [modules[m], content_info.attribute]), + } +} + +CxPolicy[result] { + task := ansLib.tasks[id][t] + + apiGateway := task[modules[m]] + ansLib.checkState(apiGateway) + + text := apiGateway.swagger_text + + not contains(text, "x-amazon-apigateway-authorizer") + + result := { + "documentId": id, + "searchKey": sprintf("name={{%s}}.{{%s}}.swagger_text", [task.name, modules[m]]), + "issueType": "IncorrectValue", + "keyExpectedValue": sprintf("'%s.swagger_text' has a authorizer set", [modules[m]]), + "keyActualValue": sprintf("'%s.swagger_text' does not have a authorizer set", [modules[m]]), + } +} + +CxPolicy[result] { + task := ansLib.tasks[id][t] + + apiGateway := task[modules[m]] + ansLib.checkState(apiGateway) + + without_authorizer(apiGateway) + + result := { + "documentId": id, + "searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]), + "issueType": "IncorrectValue", + "keyExpectedValue": sprintf("'%s' has swagger_file, swagger_text or swagger_dict set", [modules[m]]), + "keyActualValue": sprintf("'%s' does not have swagger_file, swagger_text or swagger_dict set", [modules[m]]), + } +} + +without_authorizer(apiGateway) { + object.get(apiGateway, "swagger_file", "undefined") == "undefined" + object.get(apiGateway, "swagger_text", "undefined") == "undefined" + object.get(apiGateway, "swagger_dict", "undefined") == "undefined" +} + +get_content(apiGateway) = content_info { + content := apiGateway.swagger_file.content + content_info := {"content": content, "attribute": "swagger_file"} +} else = content_info { + content := apiGateway.swagger_dict + content_info := {"content": content, "attribute": "swagger_dict"} +} diff --git a/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/negative1.yaml b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/negative1.yaml new file mode 100644 index 00000000000..bbbf5f2e87c --- /dev/null +++ b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/negative1.yaml @@ -0,0 +1,9 @@ +- name: Setup AWS API Gateway setup on AWS and deploy API definition3 + community.aws.aws_api_gateway: + swagger_file: swaggerFile.yaml + stage: production + cache_enabled: true + cache_size: "1.6" + tracing_enabled: true + endpoint_type: EDGE + state: present diff --git a/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/negative2.yaml b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/negative2.yaml new file mode 100644 index 00000000000..b7dd522761f --- /dev/null +++ b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/negative2.yaml @@ -0,0 +1,39 @@ +- name: Setup AWS API Gateway setup on AWS and deploy API definition22222 + community.aws.aws_api_gateway: + swagger_dict: + { + "openapi": "3.0.0", + "info": + { + "title": "Simple API Overview", + "version": "1.0.0", + "contact": { "name": "contact", "email": "user@gmail.com" }, + }, + "components": + { + "securitySchemes": + { + "request_authorizer_single_stagevar": + { + "type": "apiKey", + "name": "Unused", + "in": "header", + "x-amazon-apigateway-authtype": "custom", + "x-amazon-apigateway-authorizer": + { + "type": "request", + "identitySource": "stageVariables.stage", + "authorizerCredentials": "arn:aws:iam::123456789012:role/AWSepIntegTest-CS-LambdaRole", + "authorizerUri": "arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:123456789012:function:APIGateway-Request-Authorizer:vtwo/invocations", + "authorizerResultTtlInSeconds": 300, + }, + }, + }, + }, + } + stage: production + cache_enabled: true + cache_size: "1.6" + tracing_enabled: true + endpoint_type: EDGE + state: present diff --git a/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/negative3.yaml b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/negative3.yaml new file mode 100644 index 00000000000..a3c62e5567f --- /dev/null +++ b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/negative3.yaml @@ -0,0 +1,27 @@ +- name: Setup AWS API Gateway setup on AWS and deploy API 222 + aws_api_gateway: + swagger_text: | + openapi: 3.0.0 + info: + title: Sample API + description: Optional multiline or single-line description + version: 0.1.9 + components: + securitySchemes: + request_authorizer_single_stagevar: + type: apiKey + name: Unused + in: header + x-amazon-apigateway-authtype: custom + x-amazon-apigateway-authorizer: + type: request + identitySource: stageVariables.stage + authorizerCredentials: arn:aws:iam::123456789012:role/AWSepIntegTest-CS-LambdaRole + authorizerUri: arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:123456789012:function:APIGateway-Request-Authorizer:vtwo/invocations + authorizerResultTtlInSeconds: 300 + stage: production + cache_enabled: true + cache_size: "1.6" + tracing_enabled: true + endpoint_type: EDGE + state: present diff --git a/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/positive1.yaml b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/positive1.yaml new file mode 100644 index 00000000000..a11620fd9fe --- /dev/null +++ b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/positive1.yaml @@ -0,0 +1,31 @@ +- name: Setup AWS API Gateway setup on AWS and deploy API definition + community.aws.aws_api_gateway: + swagger_dict: + { + "openapi": "3.0.0", + "info": + { + "title": "Simple API Overview", + "version": "1.0.0", + "contact": { "name": "contact", "email": "user@gmail.com" }, + }, + "components": + { + "securitySchemes": + { + "request_authorizer_single_stagevar": + { + "type": "apiKey", + "name": "Unused", + "in": "header", + "x-amazon-apigateway-authtype": "custom", + }, + }, + }, + } + stage: production + cache_enabled: true + cache_size: "1.6" + tracing_enabled: true + endpoint_type: EDGE + state: present diff --git a/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/positive2.yaml b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/positive2.yaml new file mode 100644 index 00000000000..02bda10e03c --- /dev/null +++ b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/positive2.yaml @@ -0,0 +1,8 @@ +- name: Setup AWS API Gateway setup on AWS and deploy API definition2 + aws_api_gateway: + stage: production + cache_enabled: true + cache_size: "1.6" + tracing_enabled: true + endpoint_type: EDGE + state: present diff --git a/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/positive3.yaml b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/positive3.yaml new file mode 100644 index 00000000000..bbafe30800f --- /dev/null +++ b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/positive3.yaml @@ -0,0 +1,9 @@ +- name: Setup AWS API Gateway setup on AWS and deploy API 222 + aws_api_gateway: + swagger_file: swaggerFileWithoutAuthorizer.json + stage: production + cache_enabled: true + cache_size: "1.6" + tracing_enabled: true + endpoint_type: EDGE + state: present diff --git a/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/positive4.yaml b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/positive4.yaml new file mode 100644 index 00000000000..78b8705b6a3 --- /dev/null +++ b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/positive4.yaml @@ -0,0 +1,21 @@ +- name: Setup AWS API Gateway setup on AWS and deploy API 222 + aws_api_gateway: + swagger_text: | + openapi: 3.0.0 + info: + title: Sample API + description: Optional multiline or single-line description + version: 0.1.9 + components: + ssecuritySchemes: + request_authorizer_single_stagevar: + type: apiKey + name: Unused + in: header + x-amazon-apigateway-authtype: custom + stage: production + cache_enabled: true + cache_size: "1.6" + tracing_enabled: true + endpoint_type: EDGE + state: present diff --git a/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/positive_expected_result.json b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/positive_expected_result.json new file mode 100644 index 00000000000..9be124eee7b --- /dev/null +++ b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/positive_expected_result.json @@ -0,0 +1,26 @@ +[ + { + "queryName": "API Gateway Without Configured Authorizer", + "severity": "MEDIUM", + "line": 3, + "fileName": "positive1.yaml" + }, + { + "queryName": "API Gateway Without Configured Authorizer", + "severity": "MEDIUM", + "line": 2, + "fileName": "positive2.yaml" + }, + { + "queryName": "API Gateway Without Configured Authorizer", + "severity": "MEDIUM", + "line": 3, + "fileName": "positive3.yaml" + }, + { + "queryName": "API Gateway Without Configured Authorizer", + "severity": "MEDIUM", + "line": 3, + "fileName": "positive4.yaml" + } +] diff --git a/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/swaggerFile.json b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/swaggerFile.json new file mode 100644 index 00000000000..14250814e2d --- /dev/null +++ b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/swaggerFile.json @@ -0,0 +1,28 @@ +{ + "openapi": "3.0.0", + "info": { + "title": "Simple API Overview", + "version": "1.0.0", + "contact": { + "name": "contact", + "email": "user@gmail.com" + } + }, + "components": { + "securitySchemes": { + "request_authorizer_single_stagevar": { + "type": "apiKey", + "name": "Unused", + "in": "header", + "x-amazon-apigateway-authtype": "custom", + "x-amazon-apigateway-authorizer": { + "type": "request", + "identitySource": "stageVariables.stage", + "authorizerCredentials": "arn:aws:iam::123456789012:role/AWSepIntegTest-CS-LambdaRole", + "authorizerUri": "arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:123456789012:function:APIGateway-Request-Authorizer:vtwo/invocations", + "authorizerResultTtlInSeconds": 300 + } + } + } + } +} diff --git a/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/swaggerFile.yaml b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/swaggerFile.yaml new file mode 100644 index 00000000000..3b39968fb2d --- /dev/null +++ b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/swaggerFile.yaml @@ -0,0 +1,20 @@ +openapi: 3.0.0 +info: + title: Simple API Overview + version: 1.0.0 + contact: + name: contact + email: user@gmail.com +components: + securitySchemes: + request_authorizer_single_stagevar: + type: apiKey + name: Unused + in: header + x-amazon-apigateway-authtype: custom + x-amazon-apigateway-authorizer: + type: request + identitySource: stageVariables.stage + authorizerCredentials: arn:aws:iam::123456789012:role/AWSepIntegTest-CS-LambdaRole + authorizerUri: arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:123456789012:function:APIGateway-Request-Authorizer:vtwo/invocations + authorizerResultTtlInSeconds: 300 diff --git a/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/swaggerFileWithoutAuthorizer.json b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/swaggerFileWithoutAuthorizer.json new file mode 100644 index 00000000000..53ff6fafe27 --- /dev/null +++ b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/swaggerFileWithoutAuthorizer.json @@ -0,0 +1,21 @@ +{ + "openapi": "3.0.0", + "info": { + "title": "Simple API Overview", + "version": "1.0.0", + "contact": { + "name": "contact", + "email": "user@gmail.com" + } + }, + "components": { + "securitySchemes": { + "request_authorizer_single_stagevar": { + "type": "apiKey", + "name": "Unused", + "in": "header", + "x-amazon-apigateway-authtype": "custom" + } + } + } +} diff --git a/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/swaggerFileWithoutAuthorizer.yaml b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/swaggerFileWithoutAuthorizer.yaml new file mode 100644 index 00000000000..bad729ab3a4 --- /dev/null +++ b/assets/queries/ansible/aws/api_gateway_without_configured_authorizer/test/swaggerFileWithoutAuthorizer.yaml @@ -0,0 +1,14 @@ +openapi: 3.0.0 +info: + title: Simple API Overview + version: 1.0.0 + contact: + name: contact + email: user@gmail.com +components: + securitySchemes: + request_authorizer_single_stagevar: + type: apiKey + name: Unused + in: header + x-amazon-apigateway-authtype: custom diff --git a/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/metadata.json b/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/metadata.json new file mode 100644 index 00000000000..75458eb863a --- /dev/null +++ b/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/metadata.json @@ -0,0 +1,9 @@ +{ + "id": "d5ec2080-340a-4259-b885-f833c4ea6a31", + "queryName": "Certificate RSA Key Bytes Lower Than 128", + "severity": "MEDIUM", + "category": "Insecure Configurations", + "descriptionText": "The certificate should use a RSA key with length higher than 128 bytes", + "descriptionUrl": "https://docs.ansible.com/ansible/2.10/collections/community/aws/aws_acm_module.html", + "platform": "Ansible" +} diff --git a/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/query.rego b/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/query.rego new file mode 100644 index 00000000000..1ba1252bcad --- /dev/null +++ b/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/query.rego @@ -0,0 +1,20 @@ +package Cx + +import data.generic.ansible as ansLib + +CxPolicy[result] { + task := ansLib.tasks[id][t] + + acm := task["community.aws.aws_acm"] + ansLib.checkState(acm) + + acm.certificate.rsa_key_bytes <= 128 + + result := { + "documentId": id, + "searchKey": sprintf("name={{%s}}.community.aws.aws_acm.certificate", [task.name]), + "issueType": "IncorrectValue", + "keyExpectedValue": "'community.aws.aws_acm.certificate' uses a RSA key with length higher than 128 bytes", + "keyActualValue": "'community.aws.aws_acm.certificate' does not use a RSA key with length higher than 128 bytes", + } +} diff --git a/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/test/negative.yaml b/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/test/negative.yaml new file mode 100644 index 00000000000..362aa36b09d --- /dev/null +++ b/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/test/negative.yaml @@ -0,0 +1,6 @@ +- name: upload a self-signed certificate2 + community.aws.aws_acm: + certificate: "{{ lookup('file', 'rsa4096.pem' ) }}" + privateKey: "{{ lookup('file', 'key.pem' ) }}" + name_tag: my_cert + region: ap-southeast-2 diff --git a/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/test/positive.yaml b/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/test/positive.yaml new file mode 100644 index 00000000000..69f4a0951d2 --- /dev/null +++ b/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/test/positive.yaml @@ -0,0 +1,6 @@ +- name: upload a self-signed certificate + community.aws.aws_acm: + certificate: "{{ lookup('file', 'rsa1024.pem' ) }}" + privateKey: "{{ lookup('file', 'key.pem' ) }}" + name_tag: my_cert + region: ap-southeast-2 diff --git a/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/test/positive_expected_result.json b/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/test/positive_expected_result.json new file mode 100644 index 00000000000..ed87502888b --- /dev/null +++ b/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/test/positive_expected_result.json @@ -0,0 +1,7 @@ +[ + { + "queryName": "Certificate RSA Key Bytes Lower Than 128", + "severity": "MEDIUM", + "line": 3 + } +] diff --git a/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/test/rsa1024.pem b/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/test/rsa1024.pem new file mode 100644 index 00000000000..c9a7d7130a7 --- /dev/null +++ b/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/test/rsa1024.pem @@ -0,0 +1,13 @@ +-----BEGIN CERTIFICATE----- +MIIB/TCCAWYCCQDK5QPVVgU3jzANBgkqhkiG9w0BAQUFADBDMQswCQYDVQQGEwJV +UzETMBEGA1UECBMKQ2FsaWZvcm5pYTESMBAGA1UEBxMJU2FuIE1hdGVvMQswCQYD +VQQKEwJTTDAeFw0xNDAxMzExODQzNTFaFw0xNDAzMDIxODQzNTFaMEMxCzAJBgNV +BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRIwEAYDVQQHEwlTYW4gTWF0ZW8x +CzAJBgNVBAoTAlNMMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+kN7aXyge +Op2/bB+GrER7AiTQuizpwK19whemmFTtsu79JgWSADkdUfhPeJrmBPHJnhGWskLU +oWyqLYM1GCfDNAyojmyW9ZFwCCiLaUuHn+Usg7+vdcKIGV8MKWrjojtlQatsLa2K +01v9CWbaJz9p0VNLUw1l9yh5TZQCroo87QIDAQABMA0GCSqGSIb3DQEBBQUAA4GB +AKAEe950tCwT7ysq6KvlEDLrYu9wqjgd/VaXub6TX/HOT5n5naxoOJJpDDuTfUhX +KmBl3hpm6zvSDCr4X40LIZJVIoKvLmJwkVZ8Ywk10v6qRRRx9djycB2AYPBmXUIX +IaVfh2k2z6Kg191s7BKZREw0xRQh4giNKls9FsiZeM8E +-----END CERTIFICATE----- diff --git a/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/test/rsa4096.pem b/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/test/rsa4096.pem new file mode 100644 index 00000000000..b933f0af2fb --- /dev/null +++ b/assets/queries/ansible/aws/certificate_rsa_key_bytes_lower_than_128/test/rsa4096.pem @@ -0,0 +1,35 @@ +-----BEGIN CERTIFICATE----- +MIIGATCCA+mgAwIBAgIUb+H4vxoPrTBNHrxhUNBE0kyE0r4wDQYJKoZIhvcNAQEL +BQAwgY8xCzAJBgNVBAYTAlBUMQ4wDAYDVQQIDAVCUkFHQTEOMAwGA1UEBwwFQlJB +R0ExEjAQBgNVBAoMCUNoZWNrbWFyeDENMAsGA1UECwwEU0FTVDEQMA4GA1UEAwwH +UmFmYWVsYTErMCkGCSqGSIb3DQEJARYccmFmYWVsYS5zb2FyZXNAY2hlY2ttYXJ4 +LmNvbTAeFw0yMTAzMjcxMzU3MjJaFw0yMjAzMjcxMzU3MjJaMIGPMQswCQYDVQQG +EwJQVDEOMAwGA1UECAwFQlJBR0ExDjAMBgNVBAcMBUJSQUdBMRIwEAYDVQQKDAlD +aGVja21hcngxDTALBgNVBAsMBFNBU1QxEDAOBgNVBAMMB1JhZmFlbGExKzApBgkq +hkiG9w0BCQEWHHJhZmFlbGEuc29hcmVzQGNoZWNrbWFyeC5jb20wggIiMA0GCSqG +SIb3DQEBAQUAA4ICDwAwggIKAoICAQDD7P/FAvEi5vkA7CJdZrlCvNPDxmOUkAsZ +foxcxtiJcjyN8CVIC2QMrnsn6aW1DQRGCq8BufhrE7NxsoZ9eLTXJjzra1ceWaIf +hT8RcWZ9uphCDsPTEddJWhwROWzXUOZXABYRHoi/d+yXkX/GlYin+ioO4OIMTvtq +/s/kr/R/7kKIclcY9fDzAGuql/IvhtTq5SQuPKfuR6xL5CTqZ5k6M5p6jlxgLEro +xH5TtWhR7MBtpBWNM13JlfHg8rQ3Q9KyzIwH1rUPSraCOHK6xEupCU4jQV9kowME +TY7vi6o5ozhQUYMdxpYCRDQh+9V6LYHNiGvWnGckA+aJb3mZ7oVv4skjuVlrKxg1 +2O+QxlNKMzJfEybb4Hnehrhgol+LbbyqJ5NwQo1BS5bKzEYeli2azxt8NbOFvCX3 +h+EDQzCaXChUbqoOLOXCMYdYmbv/pMr1EoZy+H7OUO4CzUOG070Hz7yyXu78YMRu +DWR+9yUw/JBsxN/I+yI054Qk5jy4/dgGdFPkZQTGfIdt3LpqXEMQAgKUO8uqHzKP +Tnkpz9PMCmL7ew69dWdJvg+Af4uo8JsosTGsAxK0u1c6attX4XMCBohtgnSvS/we +kc7v2iOVnhTF7thuiKgz4n7CTlrGI9wqH54BaW1QoNEpJhQFXER2qv32a+OJ2zjg +zmHeOwgeVwIDAQABo1MwUTAdBgNVHQ4EFgQUaH9p5gXeST//dYggU1u25At5kzMw +HwYDVR0jBBgwFoAUaH9p5gXeST//dYggU1u25At5kzMwDwYDVR0TAQH/BAUwAwEB +/zANBgkqhkiG9w0BAQsFAAOCAgEAUWMl402fIXS+l67cD3PSoT+75QNnG3rnHCRr +KNo4tR/7ePujWujdsfSk3BAl/jueSU903EtLI87Y8AV9AK/WF6ZtP51vGyc9fHbK +FjavZ3Vxqzr2Cq9c/AAnybhQpoQ/4ksXTw/QaNYBKttVSmoAK3bJI748lM6vqU4N +53pYZu4i4Znt6EqvHoWX+Zx3Vj+xVzvZOd6+T+/eAkeSQQF9aUXVZs/emGVgSCSd +eT4RETMm21cQqNSkjVA+kkGCOfkAxESfTyp47UVKVY/OLERg1E8y7RihnpFIdMHc +tow2S/DHJzIdILw4dTvK4oCKyZ9bkQvrWWqyGR+TYtnqOgExKbXRUi5JjsYPuVp+ +XDC2NdFwIlo2oG6xlfaXRegyx5xwF8Yv8N5gD7IepN7RQrQq8Go+eO7PW9sDdni1 +EQEvJJ6CrnPQq9y2PTCO+D9CsQYBJp+fw075upi6yqty/jTqvov/oYqlsiOH9B47 +g9MKsgUeihfhJElTttAm7rMZRIX/pSE7i+2/aismp7mK7zMz0TbS+6oJEcRzUs9u +V3CzIce6cV02dB91okjhXWtDpvfCg8rfHpWqk5kTLKnp5rqXYFqkgy2m4KaynCNN +iCqYgdedrTmiNMoUCmf8XOfEZkxO7d0XS3NF89uwhrWwGeu+oFu9N7hX8f8QMq3m +By4xx50= +-----END CERTIFICATE----- diff --git a/assets/queries/terraform/aws/certificate_rsa_key_bytes_lower_than_128/metadata.json b/assets/queries/terraform/aws/certificate_rsa_key_bytes_lower_than_128/metadata.json new file mode 100644 index 00000000000..5ac4b80b23d --- /dev/null +++ b/assets/queries/terraform/aws/certificate_rsa_key_bytes_lower_than_128/metadata.json @@ -0,0 +1,9 @@ +{ + "id": "874d68a3-bfbe-4a4b-aaa0-9e74d7da634b", + "queryName": "Certificate RSA Key Bytes Lower Than 128", + "severity": "MEDIUM", + "category": "Insecure Configurations", + "descriptionText": "The certificate should use a RSA key with length higher than 128 bytes", + "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_rest_api", + "platform": "Terraform" +} diff --git a/assets/queries/terraform/aws/certificate_rsa_key_bytes_lower_than_128/query.rego b/assets/queries/terraform/aws/certificate_rsa_key_bytes_lower_than_128/query.rego new file mode 100644 index 00000000000..1f2af7a969b --- /dev/null +++ b/assets/queries/terraform/aws/certificate_rsa_key_bytes_lower_than_128/query.rego @@ -0,0 +1,19 @@ +package Cx + +CxPolicy[result] { + resource := input.document[i].resource[resourceType] + + services := {"aws_api_gateway_domain_name", "aws_iam_server_certificate", "aws_acm_certificate"} + + resourceType == services[_] + + resource[name].certificate_body.rsa_key_bytes <= 128 + + result := { + "documentId": input.document[i].id, + "searchKey": sprintf("%s[%s].certificate_body", [resourceType, name]), + "issueType": "IncorrectValue", + "keyExpectedValue": sprintf("%s[%s].certificate_body uses a RSA key with length higher than 128 bytes", [resourceType, name]), + "keyActualValue": sprintf("%s[%s].certificate_body does not use a RSA key with length higher than 128 bytes", [resourceType, name]), + } +} diff --git a/assets/queries/terraform/aws/certificate_rsa_key_bytes_lower_than_128/test/negative1.tf b/assets/queries/terraform/aws/certificate_rsa_key_bytes_lower_than_128/test/negative1.tf new file mode 100644 index 00000000000..7b6bb0f0217 --- /dev/null +++ b/assets/queries/terraform/aws/certificate_rsa_key_bytes_lower_than_128/test/negative1.tf @@ -0,0 +1,4 @@ +resource "aws_api_gateway_domain_name" "example3" { + certificate_body = file("./rsa4096.pem") + domain_name = "api.example.com" +} diff --git a/assets/queries/terraform/aws/certificate_rsa_key_bytes_lower_than_128/test/negative2.tf b/assets/queries/terraform/aws/certificate_rsa_key_bytes_lower_than_128/test/negative2.tf new file mode 100644 index 00000000000..902e0ee3fa6 --- /dev/null +++ b/assets/queries/terraform/aws/certificate_rsa_key_bytes_lower_than_128/test/negative2.tf @@ -0,0 +1,10 @@ +resource "aws_iam_server_certificate" "test_cert22" { + name = "some_test_cert" + certificate_body = file("./rsa4096.pem") + private_key = <