add rule for ckv_azure_115

Azure · Mar 6, 2025 · 1653673 · 1653673
1 parent 414c3db
commit 1653673
Show file tree

Hide file tree

Showing 13 changed files with 147 additions and 257 deletions.
diff --git a/policy/checkov/AKSEnablesPrivateClusters.azapi.mock.json b/policy/checkov/AKSEnablesPrivateClusters.azapi.mock.json
@@ -0,0 +1,78 @@
+{
+    "mock" : {
+        "default": {
+            "resource_changes": [{
+                "address": "azurerm_kubernetes_cluster.example",
+                "mode": "managed",
+                "type": "azapi_resource",
+                "change": {
+                    "actions": ["create"],
+                    "after": {
+                        "type": "Microsoft.ContainerService/managedClusters@2024-05-01",
+                        "body": {
+                            "properties": {
+                                "apiServerAccessProfile": {
+                                    "enablePrivateCluster": true
+                                }
+                            }
+                        }
+                    }
+                }
+            }]
+        },
+        "invalid_false": {
+            "resource_changes": [{
+                "address": "azurerm_kubernetes_cluster.example",
+                "mode": "managed",
+                "type": "azapi_resource",
+                "change": {
+                    "actions": ["create"],
+                    "after": {
+                        "type": "Microsoft.ContainerService/managedClusters@2024-05-01",
+                        "body": {
+                            "properties": {
+                                "apiServerAccessProfile": {
+                                    "enablePrivateCluster": false
+                                }
+                            }
+                        }
+                    }
+                }
+            }]
+        },
+        "invalid_omitted": {
+            "resource_changes": [{
+                "address": "azurerm_kubernetes_cluster.example",
+                "mode": "managed",
+                "type": "azapi_resource",
+                "change": {
+                    "actions": ["create"],
+                    "after": {
+                        "type": "Microsoft.ContainerService/managedClusters@2024-05-01",
+                        "body": {
+                            "properties": {
+                                "apiServerAccessProfile": {
+                                }
+                            }
+                        }
+                    }
+                }
+            }]
+        },
+        "invalid_omitted2": {
+            "resource_changes": [{
+                "address": "azurerm_kubernetes_cluster.example",
+                "mode": "managed",
+                "type": "azapi_resource",
+                "change": {
+                    "actions": ["create"],
+                    "after": {
+                        "type": "Microsoft.ContainerService/managedClusters@2024-05-01",
+                        "body": {
+                        }
+                    }
+                }
+            }]
+        }
+    }
+}
diff --git a/policy/checkov/AKSEnablesPrivateClusters.azapi.rego b/policy/checkov/AKSEnablesPrivateClusters.azapi.rego
@@ -0,0 +1,16 @@
+package checkov
+
+import rego.v1
+
+
+valid_azapi_kubernetes_cluster_private_cluster_enabled(resource) if {
+    resource.values.body.properties.apiServerAccessProfile.enablePrivateCluster == true
+}
+
+deny_CKV_AZURE_115 contains reason if {
+    resource := data.utils.resource(input, "azapi_resource")[_]
+    data.utils.is_azure_type(resource.values, "Microsoft.ContainerService/managedClusters")
+    not valid_azapi_kubernetes_cluster_private_cluster_enabled(resource)
+
+    reason := sprintf("checkov/CKV_AZURE_115: Ensure that AKS enables private clusters %s https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSEnablesPrivateClusters.py", [resource.address])
+}
diff --git a/policy/checkov/AKSEnablesPrivateClusters.mock.json b/policy/checkov/AKSEnablesPrivateClusters.mock.json
@@ -0,0 +1,53 @@
+{
+    "mock": {
+        "default": {
+            "resource_changes": [
+                {
+                    "address": "azurerm_kubernetes_cluster.example",
+                    "mode": "managed",
+                    "type": "azurerm_kubernetes_cluster",
+                    "change": {
+                        "actions": [
+                            "create"
+                        ],
+                        "after": {
+                            "private_cluster_enabled": true
+                        }
+                    }
+                }
+            ]
+        },
+        "invalid_false": {
+            "resource_changes": [
+                {
+                    "address": "azurerm_kubernetes_cluster.example",
+                    "mode": "managed",
+                    "type": "azurerm_kubernetes_cluster",
+                    "change": {
+                        "actions": [
+                            "create"
+                        ],
+                        "after": {
+                            "private_cluster_enabled": false
+                        }
+                    }
+                }
+            ]
+        },
+        "invalid_omitted": {
+            "resource_changes": [
+                {
+                    "address": "azurerm_kubernetes_cluster.example",
+                    "mode": "managed",
+                    "type": "azurerm_kubernetes_cluster",
+                    "change": {
+                        "actions": [
+                            "create"
+                        ],
+                        "after": {}
+                    }
+                }
+            ]
+        }
+    }
+}
diff --git a/...zurerm/AKSEnablesPrivateClusters.rego.bak → ...cy/checkov/AKSEnablesPrivateClusters.rego b/...zurerm/AKSEnablesPrivateClusters.rego.bak → ...cy/checkov/AKSEnablesPrivateClusters.rego
diff --git a/policy/checkov/azurerm/AKSDashboardDisabled.azapi.rego.bak b/policy/checkov/azurerm/AKSDashboardDisabled.azapi.rego.bak
diff --git a/policy/checkov/azurerm/AKSDashboardDisabled.mock.json.bak b/policy/checkov/azurerm/AKSDashboardDisabled.mock.json.bak
diff --git a/policy/checkov/azurerm/AKSDashboardDisabled.py.bak b/policy/checkov/azurerm/AKSDashboardDisabled.py.bak
diff --git a/policy/checkov/azurerm/AKSDashboardDisabled.rego.bak b/policy/checkov/azurerm/AKSDashboardDisabled.rego.bak
diff --git a/policy/checkov/azurerm/AKSDashboardDisabled.tf.bak b/policy/checkov/azurerm/AKSDashboardDisabled.tf.bak
diff --git a/policy/checkov/azurerm/AKSEnablesPrivateClusters.azapi.rego.bak b/policy/checkov/azurerm/AKSEnablesPrivateClusters.azapi.rego.bak
diff --git a/policy/checkov/azurerm/AKSEnablesPrivateClusters.mock.json.bak b/policy/checkov/azurerm/AKSEnablesPrivateClusters.mock.json.bak
diff --git a/policy/checkov/azurerm/AKSEnablesPrivateClusters.py.bak b/policy/checkov/azurerm/AKSEnablesPrivateClusters.py.bak