Merge branch 'master' of https://github.com/Checkmarx/kics into chang…

…e_cloud_provider

assets/queries/crossplane/aws/rds_db_instance_publicly_accessible/metadata.json

@@ -0,0 +1,11 @@
+{
+    "id": "d9dc6429-5140-498a-8f55-a10daac5f000",
+    "queryName": "RDS DB Instance Publicly Accessible",
+    "severity": "HIGH",
+    "category": "Insecure Configurations",
+    "descriptionText": "RDS must not be defined with public interface, which means the attribute 'PubliclyAccessible' must be set to false and neither dbSubnetGroupName' subnets being part of a VPC that has an Internet gateway attached to it",
+    "descriptionUrl": "https://doc.crds.dev/github.com/crossplane/provider-aws/database.aws.crossplane.io/RDSInstance/v1beta1@v0.17.0",
+    "platform": "Crossplane",
+    "descriptionID": "d7566b63",
+    "cloudProvider": "aws"
+  }

assets/queries/crossplane/aws/rds_db_instance_publicly_accessible/query.rego

@@ -0,0 +1,80 @@
+package Cx
+
+import data.generic.common as common_lib
+import data.generic.crossplane as cp_lib
+
+getForProvider(apiVersion, kind, name, docs) = forProvider {
+	doc := docs[_]
+	[_, resource] := walk(doc)
+	startswith(resource.apiVersion, apiVersion)
+	resource.kind == kind
+	resource.metadata.name == name
+    forProvider := resource.spec.forProvider
+}
+
+existsInternetGateway(dbSubnetGroupName) {
+    DBSGforProvider := getForProvider("database.aws.crossplane.io", "DBSubnetGroup", dbSubnetGroupName, input.document)
+    subnetIds := DBSGforProvider.subnetIds
+
+    count(subnetIds) > 0
+    subnetId := subnetIds[s]
+
+    EC2SforProvider := getForProvider("ec2.aws.crossplane.io", "Subnet", subnetId, input.document)
+
+    vpcId := EC2SforProvider.vpcId
+
+    IGdocs := input.document[_]
+    [_, IGresource] := walk(IGdocs)
+	startswith(IGresource.apiVersion, "network.aws.crossplane.io")
+    IGresource.kind == "InternetGateway"
+
+    IGforProvider := IGresource.spec.forProvider
+
+    common_lib.valid_key(IGforProvider, "vpcId")
+	vpcId == IGforProvider.vpcId
+} 
+
+CxPolicy[result] {
+    docs := input.document[i]
+	[path, resource] := walk(docs)
+	startswith(resource.apiVersion, "database.aws.crossplane.io")
+    resource.kind == "RDSInstance"
+
+    forProvider := resource.spec.forProvider
+
+    not common_lib.valid_key(forProvider, "publiclyAccessible")
+
+    dbSubnetGroupName := forProvider.dbSubnetGroupName
+
+    existsInternetGateway(dbSubnetGroupName) == true
+
+    result := {
+		"documentId": input.document[i].id,
+		"resourceType": resource.kind,
+		"resourceName": cp_lib.getResourceName(resource),
+		"searchKey": sprintf("metadata.name={{%s}}.spec.forProvider.dbSubnetGroupName", [resource.metadata.name]),
+		"issueType": "MissingAttribute",
+		"keyActualValue": "dbSubnetGroupName' subnets are part of a VPC that has an Internet gateway attached to it",
+		"keyExpectedValue": "dbSubnetGroupName' subnets not being part of a VPC that has an Internet gateway attached to it",
+	}
+}
+
+CxPolicy[result] {
+    docs := input.document[i]
+	[path, resource] := walk(docs)
+	startswith(resource.apiVersion, "database.aws.crossplane.io")
+    resource.kind == "RDSInstance"
+
+    forProvider := resource.spec.forProvider
+    forProvider.publiclyAccessible == true
+
+    result := {
+		"documentId": input.document[i].id,
+		"resourceType": resource.kind,
+		"resourceName": cp_lib.getResourceName(resource),
+		"searchKey": sprintf("metadata.name={{%s}}.spec.forProvider.publiclyAccessible", [resource.metadata.name]),
+		"issueType": "MissingAttribute",
+		"keyExpectedValue": "publiclyAccessible should be set to false",
+		"keyActualValue": "publiclyAccessible is set to true",
+	}
+}

assets/queries/crossplane/aws/rds_db_instance_publicly_accessible/test/negative1.yaml

@@ -0,0 +1,20 @@
+apiVersion: database.aws.crossplane.io/v1beta1
+kind: RDSInstance
+metadata:
+  name: sample-cluster3
+spec: 
+  forProvider:
+    publiclyAccessible: false
+
+---
+
+apiVersion: database.aws.crossplane.io/v1alpha3
+kind: DBSubnetGroup
+metadata:
+  name: my-db-subnet-group
+spec:
+  forProvider:
+    description: "My DB Subnet Group"
+    subnetIds:
+      - subnet-12345678
+      - subnet-87654321

assets/queries/crossplane/aws/rds_db_instance_publicly_accessible/test/negative2.yaml

@@ -0,0 +1,60 @@
+apiVersion: database.aws.crossplane.io/v1beta1
+kind: RDSInstance
+metadata:
+  name: my-rds-instance
+spec:
+  forProvider:
+    engine: mysql
+    engineVersion: "8.0"
+    instanceClass: db.t2.micro
+    allocatedStorage: 20
+    dbSubnetGroupName: my-db-subnet-group
+  writeConnectionSecretToRef:
+    name: my-rds-instance-connection
+
+---
+
+apiVersion: database.aws.crossplane.io/v1alpha3
+kind: DBSubnetGroup
+metadata:
+  name: my-db-subnet-group
+spec:
+  forProvider:
+    description: "My DB Subnet Group"
+    subnetIds:
+      - subnet-12345678
+      - subnet-87654321
+
+---
+
+apiVersion: ec2.aws.crossplane.io/v1beta1
+kind: Subnet
+metadata:
+  name: subnet-12345678
+spec:
+  forProvider:
+    cidrBlock: "10.0.0.0/24"
+    vpcId: vpc-abcdef12
+    availabilityZone: us-west-2a
+
+---
+
+apiVersion: ec2.aws.crossplane.io/v1beta1
+kind: Subnet
+metadata:
+  name: subnet-87654321
+spec:
+  forProvider:
+    cidrBlock: "10.0.0.1/24"
+    vpcId: vpc-abcdef12
+    availabilityZone: us-west-2a
+
+---
+
+apiVersion: network.aws.crossplane.io/v1alpha3
+kind: InternetGateway
+metadata:
+  name: my-internet-gateway
+spec:
+  forProvider:
+    vpcId: vpc-abcdef12345

assets/queries/crossplane/aws/rds_db_instance_publicly_accessible/test/positive1.yaml

@@ -0,0 +1,20 @@
+apiVersion: database.aws.crossplane.io/v1beta1
+kind: RDSInstance
+metadata:
+  name: sample-cluster3
+spec: 
+  forProvider:
+    publiclyAccessible: true
+
+---
+
+apiVersion: database.aws.crossplane.io/v1alpha3
+kind: DBSubnetGroup
+metadata:
+  name: my-db-subnet-group
+spec:
+  forProvider:
+    description: "My DB Subnet Group"
+    subnetIds:
+      - subnet-12345678
+      - subnet-87654321

assets/queries/crossplane/aws/rds_db_instance_publicly_accessible/test/positive2.yaml

@@ -0,0 +1,60 @@
+apiVersion: database.aws.crossplane.io/v1beta1
+kind: RDSInstance
+metadata:
+  name: my-rds-instance
+spec:
+  forProvider:
+    engine: mysql
+    engineVersion: "8.0"
+    instanceClass: db.t2.micro
+    allocatedStorage: 20
+    dbSubnetGroupName: my-db-subnet-group
+  writeConnectionSecretToRef:
+    name: my-rds-instance-connection
+
+---
+
+apiVersion: database.aws.crossplane.io/v1alpha3
+kind: DBSubnetGroup
+metadata:
+  name: my-db-subnet-group
+spec:
+  forProvider:
+    description: "My DB Subnet Group"
+    subnetIds:
+      - subnet-12345678
+      - subnet-87654321
+
+---
+
+apiVersion: ec2.aws.crossplane.io/v1beta1
+kind: Subnet
+metadata:
+  name: subnet-12345678
+spec:
+  forProvider:
+    cidrBlock: "10.0.0.0/24"
+    vpcId: vpc-abcdef12
+    availabilityZone: us-west-2a
+
+---
+
+apiVersion: ec2.aws.crossplane.io/v1beta1
+kind: Subnet
+metadata:
+  name: subnet-87654321
+spec:
+  forProvider:
+    cidrBlock: "10.0.0.1/24"
+    vpcId: vpc-abcdef12
+    availabilityZone: us-west-2a
+
+---
+
+apiVersion: network.aws.crossplane.io/v1alpha3
+kind: InternetGateway
+metadata:
+  name: my-internet-gateway
+spec:
+  forProvider:
+    vpcId: vpc-abcdef12

assets/queries/crossplane/aws/rds_db_instance_publicly_accessible/test/positive_expected_result.json

@@ -0,0 +1,15 @@
+[
+    {
+      "queryName": "RDS DB Instance Publicly Accessible",
+      "severity": "HIGH",
+      "line": 7,
+      "fileName": "positive1.yaml"
+    },
+    {
+      "queryName": "RDS DB Instance Publicly Accessible",
+      "severity": "HIGH",
+      "line": 11,
+      "fileName": "positive2.yaml"
+    }
+  ]
+

assets/queries/terraform/aws/db_instance_publicly_accessible/metadata.json → assets/queries/terraform/aws/rds_db_instance_publicly_accessible/metadata.json

@@ -1,6 +1,6 @@
 {
   "id": "35113e6f-2c6b-414d-beec-7a9482d3b2d1",
-  "queryName": "DB Instance Publicly Accessible",
+  "queryName": "RDS DB Instance Publicly Accessible",
   "severity": "HIGH",
   "category": "Insecure Configurations",
   "descriptionText": "RDS must not be defined with public interface, which means the field 'publicly_accessible' should not be set to 'true' (default is 'false').",

assets/queries/terraform/aws/db_instance_publicly_accessible/test/positive_expected_result.json → assets/queries/terraform/aws/rds_db_instance_publicly_accessible/test/positive_expected_result.json

@@ -1,12 +1,12 @@
 [
 	{
-		"queryName": "DB Instance Publicly Accessible",
+		"queryName": "RDS DB Instance Publicly Accessible",
 		"severity": "HIGH",
 		"line": 10,
 		"fileName": "positive1.tf"
 	},
 	{
-		"queryName": "DB Instance Publicly Accessible",
+		"queryName": "RDS DB Instance Publicly Accessible",
 		"severity": "HIGH",
 		"line": 11,
 		"fileName": "positive2.tf"