add rule ckv_azure_143

Azure · Mar 7, 2025 · 260db8c · 260db8c
1 parent eb2a7c3
commit 260db8c
Show file tree

Hide file tree

Showing 6 changed files with 219 additions and 74 deletions.
diff --git a/policy/checkov/AKSNodePublicIpDisabled.azapi.mock.json b/policy/checkov/AKSNodePublicIpDisabled.azapi.mock.json
@@ -0,0 +1,84 @@
+{
+  "mock": {
+    "disabled": {
+      "resource_changes": [
+        {
+          "address": "azurerm_kubernetes_cluster.example",
+          "mode": "managed",
+          "name": "res",
+          "type": "azapi_resource",
+          "changes": {
+            "actions": [
+              "create"
+            ],
+            "after": {
+              "body": {
+                "properties": {
+                  "agentPoolProfiles": [
+                    {
+                      "enableNodePublicIP": false
+                    }
+                  ]
+                }
+              },
+              "type": "Microsoft.ContainerService/managedClusters/2024-05-01"
+            }
+          }
+        }
+      ]
+    },
+    "omitted": {
+      "resource_changes": [
+        {
+          "address": "azurerm_kubernetes_cluster.example",
+          "mode": "managed",
+          "name": "res",
+          "type": "azapi_resource",
+          "changes": {
+            "actions": [
+              "create"
+            ],
+            "after": {
+              "body": {
+                "properties": {
+                  "agentPoolProfiles": [
+                    {
+                    }
+                  ]
+                }
+              },
+              "type": "Microsoft.ContainerService/managedClusters/2024-05-01"
+            }
+          }
+        }
+      ]
+    },
+    "invalid_enabled": {
+      "resource_changes": [
+        {
+          "address": "azurerm_kubernetes_cluster.example",
+          "mode": "managed",
+          "name": "res",
+          "type": "azapi_resource",
+          "changes": {
+            "actions": [
+              "create"
+            ],
+            "after": {
+              "body": {
+                "properties": {
+                  "agentPoolProfiles": [
+                    {
+                      "enableNodePublicIP": true
+                    }
+                  ]
+                }
+              },
+              "type": "Microsoft.ContainerService/managedClusters/2024-05-01"
+            }
+          }
+        }
+      ]
+    }
+  }
+}
diff --git a/policy/checkov/AKSNodePublicIpDisabled.azapi.rego b/policy/checkov/AKSNodePublicIpDisabled.azapi.rego
@@ -0,0 +1,15 @@
+package checkov
+
+import rego.v1
+
+valid_azapi_kubernetes_cluster_node_public_ip_disabled(resource) if {
+    resource.values.body.properties.agentPoolProfiles.enableNodePublicIP != true
+}
+
+deny_CKV_AZURE_143 contains reason if {
+    resource := data.utils.resource(input, "azapi_resource")[_]
+    data.utils.is_azure_type(resource.values, "Microsoft.ContainerService/managedClusters")
+    not valid_azapi_kubernetes_cluster_node_public_ip_disabled(resource)
+
+    reason := sprintf("checkov/CKV_AZURE_143: Ensure AKS cluster nodes do not have public IP addresses %s: https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSNodePublicIpDisabled.py", [resource.address])
+}
diff --git a/policy/checkov/AKSNodePublicIpDisabled.mock.json b/policy/checkov/AKSNodePublicIpDisabled.mock.json
@@ -0,0 +1,118 @@
+{
+  "mock": {
+    "disabled": {
+      "resource_changes": [
+        {
+          "address": "azurerm_kubernetes_cluster.example",
+          "mode": "managed",
+          "type": "azurerm_kubernetes_cluster",
+          "name": "example",
+          "provider_name": "registry.terraform.io/hashicorp/azurerm",
+          "change": {
+            "actions": [
+              "create"
+            ],
+            "after": {
+              "default_node_pool": [
+                {
+                  "node_public_ip_enabled": false
+                }
+              ]
+            }
+          }
+        }
+      ]
+    },
+    "disabled_v3": {
+      "resource_changes": [
+        {
+          "address": "azurerm_kubernetes_cluster.example",
+          "mode": "managed",
+          "type": "azurerm_kubernetes_cluster",
+          "name": "example",
+          "provider_name": "registry.terraform.io/hashicorp/azurerm",
+          "change": {
+            "actions": [
+              "create"
+            ],
+            "after": {
+              "default_node_pool": [
+                {
+                  "enable_node_public_ip": false
+                }
+              ]
+            }
+          }
+        }
+      ]
+    },
+    "omitted": {
+      "resource_changes": [
+        {
+          "address": "azurerm_kubernetes_cluster.example",
+          "mode": "managed",
+          "type": "azurerm_kubernetes_cluster",
+          "name": "example",
+          "provider_name": "registry.terraform.io/hashicorp/azurerm",
+          "change": {
+            "actions": [
+              "create"
+            ],
+            "after": {
+              "default_node_pool": [
+                {
+                }
+              ]
+            }
+          }
+        }
+      ]
+    },
+    "invalid_enabled": {
+      "resource_changes": [
+        {
+          "address": "azurerm_kubernetes_cluster.example",
+          "mode": "managed",
+          "type": "azurerm_kubernetes_cluster",
+          "name": "example",
+          "provider_name": "registry.terraform.io/hashicorp/azurerm",
+          "change": {
+            "actions": [
+              "create"
+            ],
+            "after": {
+              "default_node_pool": [
+                {
+                  "node_public_ip_enabled": true
+                }
+              ]
+            }
+          }
+        }
+      ]
+    },
+    "invalid_enabled_v3": {
+      "resource_changes": [
+        {
+          "address": "azurerm_kubernetes_cluster.example",
+          "mode": "managed",
+          "type": "azurerm_kubernetes_cluster",
+          "name": "example",
+          "provider_name": "registry.terraform.io/hashicorp/azurerm",
+          "change": {
+            "actions": [
+              "create"
+            ],
+            "after": {
+              "default_node_pool": [
+                {
+                  "enable_node_public_ip": true
+                }
+              ]
+            }
+          }
+        }
+      ]
+    }
+  }
+}
diff --git a/.../azurerm/AKSNodePublicIpDisabled.rego.bak → policy/checkov/AKSNodePublicIpDisabled.rego b/.../azurerm/AKSNodePublicIpDisabled.rego.bak → policy/checkov/AKSNodePublicIpDisabled.rego
@@ -3,12 +3,12 @@ package checkov
 import rego.v1
 
 valid_azurerm_kubernetes_cluster_node_public_ip_disabled(resource) if {
-    not resource.values.default_node_pool[0].enable_node_public_ip
+    resource.values.default_node_pool[0].enable_node_public_ip != true
 }
 
 deny_CKV_AZURE_143 contains reason if {
     resource := data.utils.resource(input, "azurerm_kubernetes_cluster")[_]
     not valid_azurerm_kubernetes_cluster_node_public_ip_disabled(resource)
 
-    reason := sprintf("checkov/CKV_AZURE_143: Ensure AKS cluster nodes do not have public IP addresses %s", ["https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSNodePublicIpDisabled.py"])
+    reason := sprintf("checkov/CKV_AZURE_143: Ensure AKS cluster nodes do not have public IP addresses %s: https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSNodePublicIpDisabled.py", [resource.address])
 }
diff --git a/policy/checkov/azurerm/AKSNodePublicIpDisabled.py.bak b/policy/checkov/azurerm/AKSNodePublicIpDisabled.py.bak
diff --git a/policy/checkov/azurerm/AKSNodePublicIpDisabled.tf.bak b/policy/checkov/azurerm/AKSNodePublicIpDisabled.tf.bak