-
Notifications
You must be signed in to change notification settings - Fork 1.3k
Open
Labels
checksCheck additions or changesCheck additions or changes
Description
Describe the issue
Terraform provisioners are sometimes passed in a "mangled" form to the scan_resource_conf
method.
Examples
Try running the following policy:
from typing import Dict, Any
from checkov.common.typing import _SkippedCheck, _CheckResult
from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
from checkov.common.models.enums import CheckResult, CheckCategories
CHECK_ID = "NO_LOCAL_EXEC_PROVISIONERS"
class ForbidLocalExecProvisioners(BaseResourceCheck):
def __init__(self):
id = CHECK_ID
name = "Forbid all local-exec provisioners"
supported_resources = ['*']
categories = [CheckCategories.SUPPLY_CHAIN, CheckCategories.GENERAL_SECURITY]
guideline = "https://some-docuementation.com/wiki/spaces/DE/pages/5409898650/Checkov#Forbid-all-local-exec-provisioners"
super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, guideline=guideline)
def scan_resource_conf(self, conf):
if 'provisioner' not in conf:
return CheckResult.PASSED
if not any('local-exec' in p for p in conf['provisioner']):
return CheckResult.PASSED
return CheckResult.FAILED
check = ForbidLocalExecProvisioners()
against the resource below.
terraform {
required_providers {
okta = {
source = "okta/okta"
version = "~> 4.0"
}
}
}
resource "okta_group_rule" "service_accounts" {
name = "Service Accounts"
status = "ACTIVE"
expression_type = "urn:okta:expression:1.0"
expression_value = "user.firstName == \"svc\""
group_assignments = [ 1234 ]
provisioner "local-exec" {
program = ["ls"]
}
}
The policy passes, when it should fail. Normally, we should be able to retrieve the provisioner with conf['provisoner']
but in this case it will be under the conf['provisioner/local-exec']
key.
Version (please complete the following information):
- Checkov Version: 3.2.471
Metadata
Metadata
Assignees
Labels
checksCheck additions or changesCheck additions or changes