add rule ckv_azure_139

Azure · Mar 6, 2025 · ac64208 · ac64208
1 parent 42e2bd8
commit ac64208
Show file tree

Hide file tree

Showing 12 changed files with 133 additions and 221 deletions.
diff --git a/policy/checkov/ACRAdminAccountDisabled.py b/policy/checkov/ACRAdminAccountDisabled.py
diff --git a/policy/checkov/ACRAdminAccountDisabled.tf b/policy/checkov/ACRAdminAccountDisabled.tf
diff --git a/policy/checkov/ACRAnonymousPullDisabled.py b/policy/checkov/ACRAnonymousPullDisabled.py
diff --git a/policy/checkov/ACRAnonymousPullDisabled.tf b/policy/checkov/ACRAnonymousPullDisabled.tf
diff --git a/policy/checkov/ACRPublicNetworkAccessDisabled.azapi.mock.json b/policy/checkov/ACRPublicNetworkAccessDisabled.azapi.mock.json
@@ -0,0 +1,63 @@
+{
+    "mock": {
+        "default": {
+            "resource_changes": [{
+                "address": "azurerm_container_registry.acr",
+                "mode": "managed",
+                "type": "azapi_resource",
+                "change": {
+                    "actions": [
+                        "create"
+                    ],
+                    "after": {
+                        "type": "Microsoft.ContainerRegistry/registries@2023-11-01-preview",
+                        "body": {
+                            "properties": {
+                                "publicNetworkAccess": "Disabled"
+                            }
+                        }
+                    }
+                }
+            }]
+        },
+        "invalid_true": {
+            "resource_changes": [{
+                "address": "azurerm_container_registry.acr",
+                "mode": "managed",
+                "type": "azapi_resource",
+                "change": {
+                    "actions": [
+                        "create"
+                    ],
+                    "after": {
+                        "type": "Microsoft.ContainerRegistry/registries@2023-11-01-preview",
+                        "body": {
+                            "properties": {
+                                "publicNetworkAccess": "Enabled"
+                            }
+                        }
+                    }
+                }
+            }]
+        },
+        "invalid_omitted": {
+            "resource_changes": [{
+                "address": "azurerm_container_registry.acr",
+                "mode": "managed",
+                "type": "azapi_resource",
+                "change": {
+                    "actions": [
+                        "create"
+                    ],
+                    "after": {
+                        "type": "Microsoft.ContainerRegistry/registries@2023-11-01-preview",
+                        "body": {
+                            "properties": {
+                            }
+                        }
+                    }
+                }
+            }]
+        }
+    }
+}
diff --git a/policy/checkov/ACRPublicNetworkAccessDisabled.azapi.rego b/policy/checkov/ACRPublicNetworkAccessDisabled.azapi.rego
@@ -0,0 +1,15 @@
+package checkov
+
+import rego.v1
+
+valid_azapi_container_registry_public_network_access_disabled(resource) if {
+    resource.values.body.properties.publicNetworkAccess == "Disabled"
+}
+
+deny_CKV_AZURE_139 contains reason if {
+    resource := data.utils.resource(input, "azapi_resource")[_]
+    data.utils.is_azure_type(resource.values, "Microsoft.ContainerRegistry/registries")
+    not valid_azapi_container_registry_public_network_access_disabled(resource)
+
+    reason := sprintf("checkov/CKV_AZURE_139: Ensure ACR set to disable public networking: %s, https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACRPublicNetworkAccessDisabled.py", [resource.address])
+}
diff --git a/policy/checkov/ACRPublicNetworkAccessDisabled.mock.json b/policy/checkov/ACRPublicNetworkAccessDisabled.mock.json
@@ -0,0 +1,54 @@
+{
+    "mock": {
+        "default": {
+            "resource_changes": [
+                {
+                    "address": "azurerm_container_registry.acr",
+                    "mode": "managed",
+                    "type": "azurerm_container_registry",
+                    "change": {
+                        "actions": [
+                            "create"
+                        ],
+                        "after": {
+                            "public_network_access_enabled": false
+                        }
+                    }
+                }
+            ]
+        },
+        "invalid_true": {
+            "resource_changes": [
+                {
+                    "address": "azurerm_container_registry.acr",
+                    "mode": "managed",
+                    "type": "azurerm_container_registry",
+                    "change": {
+                        "actions": [
+                            "create"
+                        ],
+                        "after": {
+                            "public_network_access_enabled": true
+                        }
+                    }
+                }
+            ]
+        },
+        "invalid_omitted": {
+            "resource_changes": [
+                {
+                    "address": "azurerm_container_registry.acr",
+                    "mode": "managed",
+                    "type": "azurerm_container_registry",
+                    "change": {
+                        "actions": [
+                            "create"
+                        ],
+                        "after": {
+                        }
+                    }
+                }
+            ]
+        }
+    }
+}
diff --git a/...m/ACRPublicNetworkAccessDisabled.rego.bak → ...eckov/ACRPublicNetworkAccessDisabled.rego b/...m/ACRPublicNetworkAccessDisabled.rego.bak → ...eckov/ACRPublicNetworkAccessDisabled.rego
@@ -10,6 +10,5 @@ deny_CKV_AZURE_139 contains reason if {
     resource := data.utils.resource(input, "azurerm_container_registry")[_]
     not valid_azurerm_container_registry_public_network_access_disabled(resource)
 
-    reason := sprintf("checkov/CKV_AZURE_139: Ensure ACR set to disable public networking %s", [resource.address])
-    reason := sprintf("%s https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACRPublicNetworkAccessDisabled.py", [reason])
+    reason := sprintf("checkov/CKV_AZURE_139: Ensure ACR set to disable public networking: %s, https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACRPublicNetworkAccessDisabled.py", [resource.address])
 }
diff --git a/policy/checkov/azurerm/ACRPublicNetworkAccessDisabled.azapi.rego.bak b/policy/checkov/azurerm/ACRPublicNetworkAccessDisabled.azapi.rego.bak
diff --git a/policy/checkov/azurerm/ACRPublicNetworkAccessDisabled.mock.json.bak b/policy/checkov/azurerm/ACRPublicNetworkAccessDisabled.mock.json.bak
diff --git a/policy/checkov/azurerm/ACRPublicNetworkAccessDisabled.py.bak b/policy/checkov/azurerm/ACRPublicNetworkAccessDisabled.py.bak
diff --git a/policy/checkov/azurerm/ACRPublicNetworkAccessDisabled.tf.bak b/policy/checkov/azurerm/ACRPublicNetworkAccessDisabled.tf.bak