diff --git a/policy/checkov/AKSLocalAdminDisabled.azapi.mock.json b/policy/checkov/AKSLocalAdminDisabled.azapi.mock.json new file mode 100644 index 0000000..ea98b06 --- /dev/null +++ b/policy/checkov/AKSLocalAdminDisabled.azapi.mock.json @@ -0,0 +1,68 @@ +{ + "mock": { + "default": { + "resource_changes": [ + { + "address": "azurerm_kubernetes_cluster.example", + "mode": "managed", + "type": "azapi_resource", + "change": { + "actions": [ + "create" + ], + "after": { + "type": "Microsoft.ContainerService/managedClusters@2024-05-01", + "body": { + "properties": { + "disableLocalAccounts": true + } + } + } + } + } + ] + }, + "invalid_false": { + "resource_changes": [ + { + "address": "azurerm_kubernetes_cluster.example", + "mode": "managed", + "type": "azapi_resource", + "change": { + "actions": [ + "create" + ], + "after": { + "type": "Microsoft.ContainerService/managedClusters@2024-05-01", + "body": { + "properties": { + "disableLocalAccounts": false + } + } + } + } + } + ] + }, + "invalid_omitted": { + "resource_changes": [ + { + "address": "azurerm_kubernetes_cluster.example", + "mode": "managed", + "type": "azapi_resource", + "change": { + "actions": [ + "create" + ], + "after": { + "type": "Microsoft.ContainerService/managedClusters@2024-05-01", + "body": { + "properties": {} + } + } + } + } + ] + } + } +} \ No newline at end of file diff --git a/policy/checkov/AKSLocalAdminDisabled.azapi.rego b/policy/checkov/AKSLocalAdminDisabled.azapi.rego new file mode 100644 index 0000000..ae9b005 --- /dev/null +++ b/policy/checkov/AKSLocalAdminDisabled.azapi.rego @@ -0,0 +1,15 @@ +package checkov + +import rego.v1 + +valid_azapi_kubernetes_cluster_local_admin_disabled(resource) if { + resource.values.body.properties.disableLocalAccounts == true +} + +deny_CKV_AZURE_141 contains reason if { + resource := data.utils.resource(input, "azapi_resource")[_] + data.utils.is_azure_type(resource.values, "Microsoft.ContainerService/managedClusters") + not valid_azapi_kubernetes_cluster_local_admin_disabled(resource) + + reason := sprintf("checkov/CKV_AZURE_141: Ensure AKS local admin account is disabled %s: https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSLocalAdminDisabled.py", [resource.address]) +} diff --git a/policy/checkov/AKSLocalAdminDisabled.mock.json b/policy/checkov/AKSLocalAdminDisabled.mock.json new file mode 100644 index 0000000..93b68e2 --- /dev/null +++ b/policy/checkov/AKSLocalAdminDisabled.mock.json @@ -0,0 +1,53 @@ +{ + "mock": { + "default": { + "resource_changes": [ + { + "address": "azurerm_kubernetes_cluster.example", + "mode": "managed", + "type": "azurerm_kubernetes_cluster", + "change": { + "actions": [ + "create" + ], + "after": { + "local_account_disabled": true + } + } + } + ] + }, + "invalid_false": { + "resource_changes": [ + { + "address": "azurerm_kubernetes_cluster.example", + "mode": "managed", + "type": "azurerm_kubernetes_cluster", + "change": { + "actions": [ + "create" + ], + "after": { + "local_account_disabled": false + } + } + } + ] + }, + "invalid_omitted": { + "resource_changes": [ + { + "address": "azurerm_kubernetes_cluster.example", + "mode": "managed", + "type": "azurerm_kubernetes_cluster", + "change": { + "actions": [ + "create" + ], + "after": {} + } + } + ] + } + } +} \ No newline at end of file diff --git a/policy/checkov/azurerm/AKSLocalAdminDisabled.rego.bak b/policy/checkov/AKSLocalAdminDisabled.rego similarity index 71% rename from policy/checkov/azurerm/AKSLocalAdminDisabled.rego.bak rename to policy/checkov/AKSLocalAdminDisabled.rego index be4cda3..b2fa258 100644 --- a/policy/checkov/azurerm/AKSLocalAdminDisabled.rego.bak +++ b/policy/checkov/AKSLocalAdminDisabled.rego @@ -10,5 +10,5 @@ deny_CKV_AZURE_141 contains reason if { resource := data.utils.resource(input, "azurerm_kubernetes_cluster")[_] not valid_azurerm_kubernetes_cluster_local_admin_disabled(resource) - reason := sprintf("checkov/CKV_AZURE_141: Ensure AKS local admin account is disabled %s", ["https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSLocalAdminDisabled.py"]) + reason := sprintf("checkov/CKV_AZURE_141: Ensure AKS local admin account is disabled %s: https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSLocalAdminDisabled.py", [resource.address]) } diff --git a/policy/checkov/azurerm/AKSLocalAdminDisabled.azapi.rego.bak b/policy/checkov/azurerm/AKSLocalAdminDisabled.azapi.rego.bak deleted file mode 100644 index 33eee9e..0000000 --- a/policy/checkov/azurerm/AKSLocalAdminDisabled.azapi.rego.bak +++ /dev/null @@ -1,15 +0,0 @@ -package checkov - -import rego.v1 - -valid_azapi_kubernetes_cluster_local_admin_disabled(resource) if { - resource.body.properties.disableLocalAccounts == true -} - -deny_CKV_AZURE_141_azapi contains reason if { - resource := data.utils.resource(input, "azapi_resource")[_] - resource.type == "Microsoft.ContainerService/managedClusters/2024-05-01" - not valid_azapi_kubernetes_cluster_local_admin_disabled(resource) - - reason := sprintf("checkov/CKV_AZURE_141: Ensure AKS local admin account is disabled %s", ["https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSLocalAdminDisabled.py"]) -} diff --git a/policy/checkov/azurerm/AKSLocalAdminDisabled.mock.json.bak b/policy/checkov/azurerm/AKSLocalAdminDisabled.mock.json.bak deleted file mode 100644 index ba5a8e0..0000000 --- a/policy/checkov/azurerm/AKSLocalAdminDisabled.mock.json.bak +++ /dev/null @@ -1,36 +0,0 @@ -{ - "mock": { - "default": [ - { - "address": "azurerm_kubernetes_cluster.example", - "mode": "managed", - "type": "azurerm_kubernetes_cluster", - "change": { - "actions": [ - "create" - ], - "after": { - "local_account_disabled": true, - "location": "westeurope", - "name": "example-aks1", - "resource_group_name": "example-resources" - } - } - }, - { - "address": "azurerm_resource_group.example", - "mode": "managed", - "type": "azurerm_resource_group", - "change": { - "actions": [ - "create" - ], - "after": { - "location": "westeurope", - "name": "example-resources" - } - } - } - ] - } -} \ No newline at end of file diff --git a/policy/checkov/azurerm/AKSLocalAdminDisabled.py.bak b/policy/checkov/azurerm/AKSLocalAdminDisabled.py.bak deleted file mode 100644 index ef51751..0000000 --- a/policy/checkov/azurerm/AKSLocalAdminDisabled.py.bak +++ /dev/null @@ -1,20 +0,0 @@ -from checkov.common.models.enums import CheckCategories -from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck - - -class AKSLocalAdminDisabled(BaseResourceValueCheck): - def __init__(self): - name = "Ensure AKS local admin account is disabled" - id = "CKV_AZURE_141" - supported_resources = ['azurerm_kubernetes_cluster'] - categories = [CheckCategories.IAM] - super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) - - def get_inspected_key(self) -> str: - return "local_account_disabled" - - def get_expected_value(self): - return True - - -check = AKSLocalAdminDisabled() diff --git a/policy/checkov/azurerm/AKSLocalAdminDisabled.tf.bak b/policy/checkov/azurerm/AKSLocalAdminDisabled.tf.bak deleted file mode 100644 index f0c3832..0000000 --- a/policy/checkov/azurerm/AKSLocalAdminDisabled.tf.bak +++ /dev/null @@ -1,42 +0,0 @@ - -# This configuration has been generated by the Azure Terraform plugin which utilizes Generative AI which may result in unintended or inaccurate configuration code. A human must validate that this configuration accomplishes the desired goal before applying the configuration. - -provider "azurerm" { - features {} -} - -resource "azurerm_resource_group" "example" { - name = "example-resources" - location = "West Europe" -} - -resource "azurerm_kubernetes_cluster" "example" { - name = "example-aks1" - location = azurerm_resource_group.example.location - resource_group_name = azurerm_resource_group.example.name - dns_prefix = "exampleaks1" - local_account_disabled = true - - default_node_pool { - name = "default" - node_count = 1 - vm_size = "Standard_D2_v2" - } - - identity { - type = "SystemAssigned" - } - - tags = { - Environment = "Production" - } -} - -terraform { - required_providers { - azurerm = { - source = "hashicorp/azurerm" - version = "4.20.0" - } - } -}