new rule for CKV_AZURE_138

Azure · Mar 6, 2025 · bf1a7f7 · bf1a7f7
1 parent a034653
commit bf1a7f7
Show file tree

Hide file tree

Showing 94 changed files with 213 additions and 2,080 deletions.
diff --git a/...m/ACRAdminAccountDisabled.azapi.mock.json → ...v/ACRAdminAccountDisabled.azapi.mock.json b/...m/ACRAdminAccountDisabled.azapi.mock.json → ...v/ACRAdminAccountDisabled.azapi.mock.json
diff --git a/...zurerm/ACRAdminAccountDisabled.azapi.rego → ...heckov/ACRAdminAccountDisabled.azapi.rego b/...zurerm/ACRAdminAccountDisabled.azapi.rego → ...heckov/ACRAdminAccountDisabled.azapi.rego
diff --git a/...azurerm/ACRAdminAccountDisabled.mock.json → ...checkov/ACRAdminAccountDisabled.mock.json b/...azurerm/ACRAdminAccountDisabled.mock.json → ...checkov/ACRAdminAccountDisabled.mock.json
diff --git a/...heckov/azurerm/ACRAdminAccountDisabled.py → policy/checkov/ACRAdminAccountDisabled.py b/...heckov/azurerm/ACRAdminAccountDisabled.py → policy/checkov/ACRAdminAccountDisabled.py
diff --git a/...ckov/azurerm/ACRAdminAccountDisabled.rego → policy/checkov/ACRAdminAccountDisabled.rego b/...ckov/azurerm/ACRAdminAccountDisabled.rego → policy/checkov/ACRAdminAccountDisabled.rego
diff --git a/...heckov/azurerm/ACRAdminAccountDisabled.tf → policy/checkov/ACRAdminAccountDisabled.tf b/...heckov/azurerm/ACRAdminAccountDisabled.tf → policy/checkov/ACRAdminAccountDisabled.tf
diff --git a/policy/checkov/ACRAnonymousPullDisabled.azapi.mock.json b/policy/checkov/ACRAnonymousPullDisabled.azapi.mock.json
@@ -0,0 +1,119 @@
+{
+    "mock": {
+        "basic": {
+            "resource_changes": [{
+                "address": "azurerm_container_registry.example",
+                "mode": "managed",
+                "type": "azapi_resource",
+                "change": {
+                    "actions": [
+                        "create"
+                    ],
+                    "after": {
+                        "type": "Microsoft.ContainerRegistry/registries@2023-11-01-preview",
+                        "body": {
+                            "properties": {
+                                "anonymousPullEnabled": false
+                            },
+                            "sku": {
+                                "name": "Basic"
+                            }
+                        }
+                    }
+                }
+            }]
+        },
+        "standard_without_anonymous_pull_enabled": {
+            "resource_changes": [{
+                "address": "azurerm_container_registry.example",
+                "mode": "managed",
+                "type": "azapi_resource",
+                "change": {
+                    "actions": [
+                        "create"
+                    ],
+                    "after": {
+                        "type": "Microsoft.ContainerRegistry/registries@2023-11-01-preview",
+                        "body": {
+                            "properties": {
+                                "anonymousPullEnabled": false
+                            },
+                            "sku": {
+                                "name": "Standard"
+                            }
+                        }
+                    }
+                }
+            }]
+        },
+        "premium_without_anonymous_pull_enabled_false": {
+            "resource_changes": [{
+                "address": "azurerm_container_registry.example",
+                "mode": "managed",
+                "type": "azapi_resource",
+                "change": {
+                    "actions": [
+                        "create"
+                    ],
+                    "after": {
+                        "type": "Microsoft.ContainerRegistry/registries@2023-11-01-preview",
+                        "body": {
+                            "properties": {
+                                "anonymousPullEnabled": false
+                            },
+                            "sku": {
+                                "name": "Premium"
+                            }
+                        }
+                    }
+                }
+            }]
+        },
+        "invalid_standard": {
+            "resource_changes": [{
+                "address": "azurerm_container_registry.example",
+                "mode": "managed",
+                "type": "azapi_resource",
+                "change": {
+                    "actions": [
+                        "create"
+                    ],
+                    "after": {
+                        "type": "Microsoft.ContainerRegistry/registries@2023-11-01-preview",
+                        "body": {
+                            "properties": {
+                                "anonymousPullEnabled": true
+                            },
+                            "sku": {
+                                "name": "Standard"
+                            }
+                        }
+                    }
+                }
+            }]
+        },
+        "invalid_premium": {
+            "resource_changes": [{
+                "address": "azurerm_container_registry.example",
+                "mode": "managed",
+                "type": "azapi_resource",
+                "change": {
+                    "actions": [
+                        "create"
+                    ],
+                    "after": {
+                        "type": "Microsoft.ContainerRegistry/registries@2023-11-01-preview",
+                        "body": {
+                            "properties": {
+                                "anonymousPullEnabled": true
+                            },
+                            "sku": {
+                                "name": "Premium"
+                            }
+                        }
+                    }
+                }
+            }]
+        }
+    }
+}
diff --git a/...m/ACRAnonymousPullDisabled.azapi.rego.bak → ...eckov/ACRAnonymousPullDisabled.azapi.rego b/...m/ACRAnonymousPullDisabled.azapi.rego.bak → ...eckov/ACRAnonymousPullDisabled.azapi.rego
@@ -16,9 +16,9 @@ valid_azapi_container_registry_anonymous_pull_disabled(resource) if {
     resource.body.properties.anonymousPullEnabled == false
 }
 
-deny_CKV_AZURE_138_azapi contains reason if {
+deny_CKV_AZURE_138 contains reason if {
     resource := data.utils.resource(input, "azapi_resource")[_]
-    resource.type == "Microsoft.ContainerRegistry/registries"
+    data.utils.is_azure_type(resource.values, "Microsoft.ContainerRegistry/registries")
     not valid_azapi_container_registry_anonymous_pull_disabled(resource)
     reason := sprintf("checkov/CKV_AZURE_138: Ensures that ACR disables anonymous pulling of images. https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACRAnonymousPullDisabled.py")
 }
diff --git a/policy/checkov/ACRAnonymousPullDisabled.mock.json b/policy/checkov/ACRAnonymousPullDisabled.mock.json
@@ -0,0 +1,92 @@
+{
+    "mock" : {
+        "basic": {
+            "resource_changes": [
+                {
+                    "address": "azurerm_container_registry.example",
+                    "mode": "managed",
+                    "type": "azurerm_container_registry",
+                    "change": {
+                        "actions": [
+                            "create"
+                        ],
+                        "after": {
+                            "sku": "Basic"
+                        }
+                    }
+                }
+            ]
+        },
+        "standard_without_anonymous_pull_enabled": {
+            "resource_changes": [
+                {
+                    "address": "azurerm_container_registry.example",
+                    "mode": "managed",
+                    "type": "azurerm_container_registry",
+                    "change": {
+                        "actions": [
+                            "create"
+                        ],
+                        "after": {
+                            "sku": "Standard"
+                        }
+                    }
+                }
+            ]
+        },
+        "premium_without_anonymous_pull_enabled_false": {
+            "resource_changes": [
+                {
+                    "address": "azurerm_container_registry.example",
+                    "mode": "managed",
+                    "type": "azurerm_container_registry",
+                    "change": {
+                        "actions": [
+                            "create"
+                        ],
+                        "after": {
+                            "anonymous_pull_enabled": false,
+                            "sku": "Premium"
+                        }
+                    }
+                }
+            ]
+        },
+        "invalid_standard": {
+            "resource_changes": [
+                {
+                    "address": "azurerm_container_registry.example",
+                    "mode": "managed",
+                    "type": "azurerm_container_registry",
+                    "change": {
+                        "actions": [
+                            "create"
+                        ],
+                        "after": {
+                            "anonymous_pull_enabled": true,
+                            "sku": "Standard"
+                        }
+                    }
+                }
+            ]
+        },
+        "invalid_premium": {
+            "resource_changes": [
+                {
+                    "address": "azurerm_container_registry.example",
+                    "mode": "managed",
+                    "type": "azurerm_container_registry",
+                    "change": {
+                        "actions": [
+                            "create"
+                        ],
+                        "after": {
+                            "anonymous_pull_enabled": true,
+                            "sku": "Premium"
+                        }
+                    }
+                }
+            ]
+        }
+    }
+}
diff --git a/...v/azurerm/ACRAnonymousPullDisabled.py.bak → policy/checkov/ACRAnonymousPullDisabled.py b/...v/azurerm/ACRAnonymousPullDisabled.py.bak → policy/checkov/ACRAnonymousPullDisabled.py
diff --git a/...azurerm/ACRAnonymousPullDisabled.rego.bak → policy/checkov/ACRAnonymousPullDisabled.rego b/...azurerm/ACRAnonymousPullDisabled.rego.bak → policy/checkov/ACRAnonymousPullDisabled.rego
diff --git a/...v/azurerm/ACRAnonymousPullDisabled.tf.bak → policy/checkov/ACRAnonymousPullDisabled.tf b/...v/azurerm/ACRAnonymousPullDisabled.tf.bak → policy/checkov/ACRAnonymousPullDisabled.tf
diff --git a/policy/checkov/azurerm/ACRAnonymousPullDisabled.azapi.mock.json.bak b/policy/checkov/azurerm/ACRAnonymousPullDisabled.azapi.mock.json.bak
diff --git a/policy/checkov/azurerm/ACRAnonymousPullDisabled.mock.json.bak b/policy/checkov/azurerm/ACRAnonymousPullDisabled.mock.json.bak
diff --git a/policy/checkov/azurerm/ACRPublicNetworkAccessDisabled.azapi.mock.json.bak b/policy/checkov/azurerm/ACRPublicNetworkAccessDisabled.azapi.mock.json.bak
diff --git a/policy/checkov/azurerm/AKSApiServerAuthorizedIpRanges.azapi.mock.json.bak b/policy/checkov/azurerm/AKSApiServerAuthorizedIpRanges.azapi.mock.json.bak
diff --git a/policy/checkov/azurerm/AKSDashboardDisabled.azapi.mock.json.bak b/policy/checkov/azurerm/AKSDashboardDisabled.azapi.mock.json.bak
diff --git a/policy/checkov/azurerm/AKSEnablesPrivateClusters.azapi.mock.json.bak b/policy/checkov/azurerm/AKSEnablesPrivateClusters.azapi.mock.json.bak