add rule ckv_azure_7

Azure · Mar 7, 2025 · 672f061 · 672f061
1 parent 5c3ec59
commit 672f061
Show file tree

Hide file tree

Showing 8 changed files with 156 additions and 125 deletions.
diff --git a/policy/checkov/AKSNetworkPolicy.azapi.mock.json b/policy/checkov/AKSNetworkPolicy.azapi.mock.json
@@ -0,0 +1,69 @@
+{
+    "mock" : {
+        "default": {
+            "resource_changes": [{
+                "address": "azurerm_kubernetes_cluster.example",
+                "mode": "managed",
+                "type": "azapi_resource",
+                "change": {
+                    "actions": [
+                        "create"                        
+                    ],
+                    "after": {
+                        "type": "Microsoft.ContainerService/managedClusters@2024-05-01",
+                        "body": {
+                            "properties": {
+                                "networkProfile": {
+                                    "networkPolicy": "calico"
+                                }
+                            }
+                        }
+                    }
+                }
+            }]
+        },
+        "known_after_apply": {
+            "resource_changes": [{
+                "address": "azurerm_kubernetes_cluster.example",
+                "mode": "managed",
+                "type": "azapi_resource",
+                "change": {
+                    "actions": [
+                        "create"
+                    ],
+                    "after": {
+                        "type": "Microsoft.ContainerService/managedClusters@2024-05-01"
+                    },
+                    "after_unknown": {
+                        "body": {
+                            "properties": {
+                                "networkProfile": {
+                                    "networkPolicy": true
+                                }
+                            }
+                        }
+                    }
+                }
+            }]
+        },
+        "invalid_omitted": {
+            "resource_changes": [{
+                "address": "azurerm_kubernetes_cluster.example",
+                "mode": "managed",
+                "type": "azapi_resource",
+                "change": {
+                    "actions": [
+                        "create"
+                    ],
+                    "after": {
+                        "type": "Microsoft.ContainerService/managedClusters@2024-05-01",
+                        "body": {
+                            "properties": {
+                            }
+                        }
+                    }
+                }
+            }]
+        },
+    }
+}
diff --git a/policy/checkov/AKSNetworkPolicy.azapi.rego b/policy/checkov/AKSNetworkPolicy.azapi.rego
@@ -0,0 +1,20 @@
+package checkov
+
+import rego.v1
+
+
+valid_azapi_kubernetes_cluster_has_network_policy(resource) if {
+    resource.values.body.properties.networkProfile.networkPolicy == resource.values.body.properties.networkProfile.networkPolicy
+}
+
+valid_azapi_kubernetes_cluster_has_network_policy(resource) if {
+    resource.after_unknown.body.properties.networkProfile.networkPolicy == resource.after_unknown.body.properties.networkProfile.networkPolicy
+}
+
+deny_CKV_AZURE_7 contains reason if {
+    resource := data.utils.resource(input, "azapi_resource")[_]
+    data.utils.is_azure_type(resource.values, "Microsoft.ContainerService/managedClusters")
+    not valid_azapi_kubernetes_cluster_has_network_policy(resource)
+
+    reason := sprintf("checkov/CKV_AZURE_7: Ensure AKS cluster has Network Policy configured %s https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSNetworkPolicy.py", [resource.address])
+}
diff --git a/policy/checkov/AKSNetworkPolicy.mock.json b/policy/checkov/AKSNetworkPolicy.mock.json
@@ -0,0 +1,62 @@
+{
+    "mock": {
+        "default": {
+            "resource_changes": [
+                {
+                    "address": "azurerm_kubernetes_cluster.example",
+                    "mode": "managed",
+                    "type": "azurerm_kubernetes_cluster",
+                    "change": {
+                        "actions": [
+                            "create"
+                        ],
+                        "after": {
+                            "network_profile": [
+                                {
+                                    "network_policy": "calico"
+                                }
+                            ]
+                        }
+                    }
+                }
+            ]
+        },
+        "known_after_apply": {
+            "resource_changes": [
+                {
+                    "address": "azurerm_kubernetes_cluster.example",
+                    "mode": "managed",
+                    "type": "azurerm_kubernetes_cluster",
+                    "change": {
+                        "actions": [
+                            "create"
+                        ],
+                        "after": {},
+                        "after_unknown": {
+                            "network_profile": [
+                                {
+                                    "network_policy": true
+                                }
+                            ]
+                        }
+                    }
+                }
+            ]
+        },
+        "invalid_omitted": {
+            "resource_changes": [
+                {
+                    "address": "azurerm_kubernetes_cluster.example",
+                    "mode": "managed",
+                    "type": "azurerm_kubernetes_cluster",
+                    "change": {
+                        "actions": [
+                            "create"
+                        ],
+                        "after": {}
+                    }
+                }
+            ]
+        }
+    }
+}
diff --git a/...checkov/azurerm/AKSNetworkPolicy.rego.bak → policy/checkov/AKSNetworkPolicy.rego b/...checkov/azurerm/AKSNetworkPolicy.rego.bak → policy/checkov/AKSNetworkPolicy.rego
@@ -3,7 +3,11 @@ package checkov
 import rego.v1
 
 valid_azurerm_kubernetes_cluster_has_network_policy(resource) if {
-    resource.values.network_profile[0].network_policy != null
+    resource.values.network_profile[0].network_policy == resource.values.network_profile[0].network_policy
+}
+
+valid_azurerm_kubernetes_cluster_has_network_policy(resource) if {
+    resource.after_unknown.network_profile[0].network_policy == resource.after_unknown.network_profile[0].network_policy
 }
 
 deny_CKV_AZURE_7 contains reason if {

diff --git a/policy/checkov/azurerm/AKSNetworkPolicy.azapi.rego.bak b/policy/checkov/azurerm/AKSNetworkPolicy.azapi.rego.bak
diff --git a/policy/checkov/azurerm/AKSNetworkPolicy.mock.json.bak b/policy/checkov/azurerm/AKSNetworkPolicy.mock.json.bak
diff --git a/policy/checkov/azurerm/AKSNetworkPolicy.py.bak b/policy/checkov/azurerm/AKSNetworkPolicy.py.bak
diff --git a/policy/checkov/azurerm/AKSNetworkPolicy.tf.bak b/policy/checkov/azurerm/AKSNetworkPolicy.tf.bak