Skip to content

Commit

Permalink
add rule ckv_azure_6
Browse files Browse the repository at this point in the history
  • Loading branch information
@lonegunmanb
lonegunmanb committed Mar 6, 2025
1 parent 73b1615 commit b736fe4
Show file tree
Hide file tree
Showing 10 changed files with 250 additions and 84 deletions.
92 changes: 92 additions & 0 deletions policy/checkov/AKSApiServerAuthorizedIpRanges.azapi.mock.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,92 @@
{
"mock" : {
"default": {
"resource_changes": [{
"address": "azurerm_kubernetes_cluster.example",
"mode": "managed",
"type": "azapi_resource",
"change": {
"actions": [
"create"
],
"after": {
"type": "Microsoft.ContainerService/managedClusters@2024-05-01",
"body": {
"properties": {
"apiServerAccessProfile": {
"authorizedIPRanges": [
"10.0.0.0/24"
],
"enablePrivateCluster": false
}
}
}
}
}
}]
},
"private_cluster": {
"resource_changes": [{
"address": "azurerm_kubernetes_cluster.example",
"mode": "managed",
"type": "azapi_resource",
"change": {
"actions": [
"create"
],
"after": {
"type": "Microsoft.ContainerService/managedClusters@2024-05-01",
"body": {
"properties": {
"apiServerAccessProfile": {
"enablePrivateCluster": true
}
}
}
}
}
}]
},
"invalid_omitted": {
"resource_changes": [{
"address": "azurerm_kubernetes_cluster.example",
"mode": "managed",
"type": "azapi_resource",
"change": {
"actions": [
"create"
],
"after": {
"type": "Microsoft.ContainerService/managedClusters@2024-05-01",
"body": {
"properties": {
"apiServerAccessProfile": {
"enablePrivateCluster": false
}
}
}
}
}
}]
},
"invalid_omitted2": {
"resource_changes": [{
"address": "azurerm_kubernetes_cluster.example",
"mode": "managed",
"type": "azapi_resource",
"change": {
"actions": [
"create"
],
"after": {
"type": "Microsoft.ContainerService/managedClusters@2024-05-01",
"body": {
"properties": {
}
}
}
}
}]
}
}
}
19 changes: 19 additions & 0 deletions policy/checkov/AKSApiServerAuthorizedIpRanges.azapi.rego
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
package checkov

import rego.v1

valid_azapi_kubernetes_cluster_api_server_authorized_ip_ranges(resource) if {
resource.values.body.properties.apiServerAccessProfile.enablePrivateCluster == true
}

valid_azapi_kubernetes_cluster_api_server_authorized_ip_ranges(resource) if {
resource.values.body.properties.apiServerAccessProfile.authorizedIPRanges[_]
}

deny_CKV_AZURE_6 contains reason if {
resource := data.utils.resource(input, "azapi_resource")[_]
data.utils.is_azure_type(resource.values, "Microsoft.ContainerService/managedClusters")
not valid_azapi_kubernetes_cluster_api_server_authorized_ip_ranges(resource.changes.after)

reason := sprintf("checkov/CKV_AZURE_6: Ensure AKS has an API Server Authorized IP Ranges enabled %s: https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py", [resource.address])
}
116 changes: 116 additions & 0 deletions policy/checkov/AKSApiServerAuthorizedIpRanges.mock.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,116 @@
{
"mock": {
"default": {
"resource_changes": [
{
"address": "azurerm_kubernetes_cluster.example",
"mode": "managed",
"type": "azurerm_kubernetes_cluster",
"change": {
"actions": [
"create"
],
"after": {
"api_server_access_profile": [
{
"authorized_ip_ranges": [
"10.0.0.0/24"
]
}
],
"private_cluster_enabled": false
}
}
}
]
},
"default_v2": {
"resource_changes": [
{
"address": "azurerm_kubernetes_cluster.example",
"mode": "managed",
"type": "azurerm_kubernetes_cluster",
"change": {
"actions": [
"create"
],
"after": {
"api_server_authorized_ip_ranges": [
"10.0.0.0/24"
],
"private_cluster_enabled": false
}
}
}
]
},
"private_cluster": {
"resource_changes": [
{
"address": "azurerm_kubernetes_cluster.example",
"mode": "managed",
"type": "azurerm_kubernetes_cluster",
"change": {
"actions": [
"create"
],
"after": {
"private_cluster_enabled": true
}
}
}
]
},
"invalid_omitted": {
"resource_changes": [
{
"address": "azurerm_kubernetes_cluster.example",
"mode": "managed",
"type": "azurerm_kubernetes_cluster",
"change": {
"actions": [
"create"
],
"after": {}
}
}
]
},
"invalid_empty": {
"resource_changes": [
{
"address": "azurerm_kubernetes_cluster.example",
"mode": "managed",
"type": "azurerm_kubernetes_cluster",
"change": {
"actions": [
"create"
],
"after": {
"api_server_access_profile":{
"authorized_ip_ranges": []
}
}
}
}
]
},
"invalid_empty_v2": {
"resource_changes": [
{
"address": "azurerm_kubernetes_cluster.example",
"mode": "managed",
"type": "azurerm_kubernetes_cluster",
"change": {
"actions": [
"create"
],
"after": {
"api_server_authorized_ip_ranges": []
}
}
}
]
}
}
}
0 ...erm/AKSApiServerAuthorizedIpRanges.py.bak → ...checkov/AKSApiServerAuthorizedIpRanges.py
View file
File renamed without changes.
22 changes: 22 additions & 0 deletions policy/checkov/AKSApiServerAuthorizedIpRanges.rego
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
package checkov

import rego.v1

valid_azurerm_kubernetes_cluster_api_server_authorized_ip_ranges(resource) if {
resource.values.private_cluster_enabled == true
}

valid_azurerm_kubernetes_cluster_api_server_authorized_ip_ranges(resource) if {
resource.values.api_server_authorized_ip_ranges[0] == resource.values.api_server_authorized_ip_ranges[0]
}

valid_azurerm_kubernetes_cluster_api_server_authorized_ip_ranges(resource) if {
resource.values.api_server_access_profile[0].authorized_ip_ranges[0] == resource.values.api_server_access_profile[0].authorized_ip_ranges[0]
}

deny_CKV_AZURE_6 contains reason if {
resource := data.utils.resource(input, "azurerm_kubernetes_cluster")[_]
not valid_azurerm_kubernetes_cluster_api_server_authorized_ip_ranges(resource)

reason := sprintf("checkov/CKV_AZURE_6: Ensure AKS has an API Server Authorized IP Ranges enabled %s: https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py", [resource.address])
}
0 ...erm/AKSApiServerAuthorizedIpRanges.tf.bak → ...checkov/AKSApiServerAuthorizedIpRanges.tf
View file
File renamed without changes.
2 changes: 1 addition & 1 deletion policy/checkov/ActiveDirectoryUsedAuthenticationServiceFabric.azapi.rego
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ valid_azapi_service_fabric_cluster_has_active_directory(resource) if {
resource.after_unknown.body.properties.azureActiveDirectory.tenantId == resource.after_unknown.body.properties.azureActiveDirectory.tenantId
}

deny_CKV_AZURE_126_azapi contains reason if {
deny_CKV_AZURE_126 contains reason if {
resource := data.utils.resource(input, "azapi_resource")[_]
data.utils.is_azure_type(resource.values, "Microsoft.ServiceFabric/clusters")
not valid_azapi_service_fabric_cluster_has_active_directory(resource)
Expand Down
20 changes: 0 additions & 20 deletions policy/checkov/azurerm/AKSApiServerAuthorizedIpRanges.azapi.rego.bak
View file

This file was deleted.

44 changes: 0 additions & 44 deletions policy/checkov/azurerm/AKSApiServerAuthorizedIpRanges.mock.json.bak
View file

This file was deleted.

19 changes: 0 additions & 19 deletions policy/checkov/azurerm/AKSApiServerAuthorizedIpRanges.rego.bak
View file

This file was deleted.

0 comments on commit b736fe4

Please sign in to comment.