Skip to content

Commit d5c1a1e

Browse files
rberlindrberlind
authored
Merge pull request hashicorp#280 from hashicorp/fix-conditions-order
fix order of filter conditions
2 parents ccc9f28 + 03d8b0d commit d5c1a1e

6 files changed

+55
-49
lines changed

‎governance/third-generation/aws/restrict-egress-sg-rule-cidr-blocks.sentinel

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,10 @@ forbidden_cidrs = ["0.0.0.0/0"]
1717
# Get all Security Group Egress Rules
1818
SGEgressRules = filter tfplan.resource_changes as address, rc {
1919
rc.type is "aws_security_group_rule" and
20-
rc.mode is "managed" and rc.change.after.type is "egress" and
20+
rc.mode is "managed" and
2121
(rc.change.actions contains "create" or rc.change.actions contains "update" or
22-
rc.change.actions contains "read" or rc.change.actions contains "no-op")
22+
rc.change.actions contains "read" or rc.change.actions contains "no-op") and
23+
rc.change.after.type is "egress"
2324
}
2425

2526
# Filter to Egress Security Group Rules with violations

‎governance/third-generation/aws/restrict-ingress-sg-rule-cidr-blocks.sentinel

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,10 @@ forbidden_cidrs = ["0.0.0.0/0"]
1717
# Get all Security Group Ingress Rules
1818
SGIngressRules = filter tfplan.resource_changes as address, rc {
1919
rc.type is "aws_security_group_rule" and
20-
rc.mode is "managed" and rc.change.after.type is "ingress" and
21-
(rc.change.actions contains "create" or rc.change.actions contains "update" or
22-
rc.change.actions contains "read" or rc.change.actions contains "no-op")
20+
rc.mode is "managed" and
21+
(rc.change.actions contains "create" or rc.change.actions contains "update" or
22+
rc.change.actions contains "read" or rc.change.actions contains "no-op") and
23+
rc.change.after.type is "ingress"
2324
}
2425

2526
# Filter to Ingress Security Group Rules with violations

‎governance/third-generation/aws/restrict-ingress-sg-rule-rdp.sentinel

Lines changed: 20 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,10 @@ forbidden_from_port = 3389
2626
# Get all Security Group Ingress Rules
2727
aws_security_group_rules = filter tfplan.resource_changes as address, rc {
2828
rc.type is "aws_security_group_rule" and
29-
rc.mode is "managed" and rc.change.after.type is "ingress" and
29+
rc.mode is "managed" and
3030
(rc.change.actions contains "create" or rc.change.actions contains "update" or
31-
rc.change.actions contains "read" or rc.change.actions contains "no-op")
31+
rc.change.actions contains "read" or rc.change.actions contains "no-op") and
32+
rc.change.after.type is "ingress"
3233
}
3334

3435
# Validate Security Group Rules
@@ -42,11 +43,11 @@ for aws_security_group_rules as address, sgr {
4243
if sgr.change.after.cidr_blocks else null is not null and
4344
types.type_of(sgr.change.after.cidr_blocks) is "list" and
4445
sgr.change.after.cidr_blocks contains "0.0.0.0/0" and
45-
sgr.change.after.from_port else null is null and
46-
sgr.change.after.to_port else null is not null and
46+
sgr.change.after.from_port else null is null and
47+
sgr.change.after.to_port else null is not null and
4748
sgr.change.after.to_port is forbidden_to_port{
4849
violatingSGRulesCount += 1
49-
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
50+
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
5051
"(RDP) open to", forbidden_cidrs, "that is not allowed")
5152
print(" Ingress Rule has from_port that is null or undefined")
5253
print(" and Ingress Rule has to_port with value", sgr.change.after.to_port)
@@ -57,10 +58,10 @@ for aws_security_group_rules as address, sgr {
5758
types.type_of(sgr.change.after.cidr_blocks) is "list" and
5859
sgr.change.after.cidr_blocks contains "0.0.0.0/0" and
5960
sgr.change.after.from_port else null is not null and
60-
sgr.change.after.from_port is forbidden_from_port and
61+
sgr.change.after.from_port is forbidden_from_port and
6162
sgr.change.after.to_port else null is null{
6263
violatingSGRulesCount += 1
63-
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
64+
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
6465
"(RDP) open to", forbidden_cidrs, "that is not allowed")
6566
print(" Ingress Rule has from_port with value", sgr.change.after.from_port)
6667
print(" and Ingress Rule has to_port that is null or undefined")
@@ -71,15 +72,15 @@ for aws_security_group_rules as address, sgr {
7172
types.type_of(sgr.change.after.cidr_blocks) is "list" and
7273
sgr.change.after.cidr_blocks contains "0.0.0.0/0" and
7374
sgr.change.after.from_port else null is not null and
74-
sgr.change.after.from_port <= forbidden_from_port and
75+
sgr.change.after.from_port <= forbidden_from_port and
7576
sgr.change.after.to_port else null is not null and
7677
sgr.change.after.to_port >= forbidden_to_port{
7778
violatingSGRulesCount += 1
78-
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
79+
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
7980
"(RDP) open to", forbidden_cidrs, "that is not allowed")
80-
print(" Ingress Rule has from_port with value", sgr.change.after.from_port,
81+
print(" Ingress Rule has from_port with value", sgr.change.after.from_port,
8182
"that is less than or equal to", forbidden_from_port)
82-
print(" and Ingress Rule has to_port with value", sgr.change.after.to_port,
83+
print(" and Ingress Rule has to_port with value", sgr.change.after.to_port,
8384
"that is greater than or equal to", forbidden_to_port)
8485
print(" The to_port and from_port both need to be set to an integer",
8586
"range or of equal")
@@ -90,7 +91,7 @@ for aws_security_group_rules as address, sgr {
9091
sgr.change.after.to_port else null is not null and
9192
sgr.change.after.to_port is forbidden_port{
9293
violatingSGRulesCount += 1
93-
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
94+
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
9495
"(RDP) open to", forbidden_cidrs, "that is not allowed")
9596
print(" Ingress Rule has to_port with value", sgr.change.after.to_port)
9697
print(" The to_port and from_port both need to be set to an integer",
@@ -108,27 +109,27 @@ for allSGs as address, sg {
108109

109110
# Find the ingress rules of the current SG
110111
ingressRules = plan.find_blocks(sg, "ingress")
111-
112+
112113
# Filter to violating CIDR blocks
113114
# Warnings will not be printed for violations since the last parameter is false
114115
violatingCidr = plan.filter_attribute_contains_items_from_list(ingressRules,
115116
"cidr_blocks", forbidden_cidrs, false)
116-
117+
117118
# Filter to violating Service port
118119
# Warnings will not be printed for violations since the last parameter is false
119120
violatingFromPortLess = plan.filter_attribute_less_than_equal_to_value(ingressRules,
120121
"from_port", forbidden_from_port, false)
121-
122+
122123
# Filter to violating Service port
123124
# Warnings will not be printed for violations since the last parameter is false
124125
violatingToPortGreater = plan.filter_attribute_greater_than_equal_to_value(ingressRules,
125126
"to_port", forbidden_to_port, false)
126-
127+
127128
# Print violation messages
128-
if length(violatingCidr["messages"]) > 0 and length(violatingFromPortLess["messages"]) > 0 and
129+
if length(violatingCidr["messages"]) > 0 and length(violatingFromPortLess["messages"]) > 0 and
129130
length(violatingToPortGreater["messages"]) > 0{
130131
violatingSGsCount += 1
131-
print("SG Ingress Violation:", address, "has port", forbidden_port,
132+
print("SG Ingress Violation:", address, "has port", forbidden_port,
132133
"(RDP) open to", forbidden_cidrs, "that is not allowed")
133134
###Uncomment below if you want to show the CIDRs as a separate message as well
134135
# plan.print_violations(violatingCidr["messages"], " Ingress Rule")
@@ -143,4 +144,4 @@ for allSGs as address, sg {
143144
validated = violatingSGsCount is 0 and violatingSGRulesCount is 0
144145
main = rule {
145146
validated is true
146-
}
147+
}

‎governance/third-generation/aws/restrict-ingress-sg-rule-ssh.sentinel

Lines changed: 20 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,10 @@ forbidden_from_port = 22
2626
# Get all Security Group Ingress Rules
2727
aws_security_group_rules = filter tfplan.resource_changes as address, rc {
2828
rc.type is "aws_security_group_rule" and
29-
rc.mode is "managed" and rc.change.after.type is "ingress" and
29+
rc.mode is "managed" and
3030
(rc.change.actions contains "create" or rc.change.actions contains "update" or
31-
rc.change.actions contains "read" or rc.change.actions contains "no-op")
31+
rc.change.actions contains "read" or rc.change.actions contains "no-op") and
32+
rc.change.after.type is "ingress"
3233
}
3334

3435
# Validate Security Group Rules
@@ -42,11 +43,11 @@ for aws_security_group_rules as address, sgr {
4243
if sgr.change.after.cidr_blocks else null is not null and
4344
types.type_of(sgr.change.after.cidr_blocks) is "list" and
4445
sgr.change.after.cidr_blocks contains "0.0.0.0/0" and
45-
sgr.change.after.from_port else null is null and
46-
sgr.change.after.to_port else null is not null and
46+
sgr.change.after.from_port else null is null and
47+
sgr.change.after.to_port else null is not null and
4748
sgr.change.after.to_port is forbidden_to_port{
4849
violatingSGRulesCount += 1
49-
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
50+
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
5051
"(SSH) open to", forbidden_cidrs, "that is not allowed")
5152
print(" Ingress Rule has from_port that is null or undefined")
5253
print(" and Ingress Rule has to_port with value", sgr.change.after.to_port)
@@ -57,10 +58,10 @@ for aws_security_group_rules as address, sgr {
5758
types.type_of(sgr.change.after.cidr_blocks) is "list" and
5859
sgr.change.after.cidr_blocks contains "0.0.0.0/0" and
5960
sgr.change.after.from_port else null is not null and
60-
sgr.change.after.from_port is forbidden_from_port and
61+
sgr.change.after.from_port is forbidden_from_port and
6162
sgr.change.after.to_port else null is null{
6263
violatingSGRulesCount += 1
63-
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
64+
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
6465
"(SSH) open to", forbidden_cidrs, "that is not allowed")
6566
print(" Ingress Rule has from_port with value", sgr.change.after.from_port)
6667
print(" and Ingress Rule has to_port that is null or undefined")
@@ -71,15 +72,15 @@ for aws_security_group_rules as address, sgr {
7172
types.type_of(sgr.change.after.cidr_blocks) is "list" and
7273
sgr.change.after.cidr_blocks contains "0.0.0.0/0" and
7374
sgr.change.after.from_port else null is not null and
74-
sgr.change.after.from_port <= forbidden_from_port and
75+
sgr.change.after.from_port <= forbidden_from_port and
7576
sgr.change.after.to_port else null is not null and
7677
sgr.change.after.to_port >= forbidden_to_port{
7778
violatingSGRulesCount += 1
78-
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
79+
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
7980
"(SSH) open to", forbidden_cidrs, "that is not allowed")
80-
print(" Ingress Rule has from_port with value", sgr.change.after.from_port,
81+
print(" Ingress Rule has from_port with value", sgr.change.after.from_port,
8182
"that is less than or equal to", forbidden_from_port)
82-
print(" and Ingress Rule has to_port with value", sgr.change.after.to_port,
83+
print(" and Ingress Rule has to_port with value", sgr.change.after.to_port,
8384
"that is greater than or equal to", forbidden_to_port)
8485
print(" The to_port and from_port both need to be set to an integer",
8586
"range or of equal")
@@ -90,7 +91,7 @@ for aws_security_group_rules as address, sgr {
9091
sgr.change.after.to_port else null is not null and
9192
sgr.change.after.to_port is forbidden_port{
9293
violatingSGRulesCount += 1
93-
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
94+
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
9495
"(SSH) open to", forbidden_cidrs, "that is not allowed")
9596
print(" Ingress Rule has to_port with value", sgr.change.after.to_port)
9697
print(" The to_port and from_port both need to be set to an integer",
@@ -108,27 +109,27 @@ for allSGs as address, sg {
108109

109110
# Find the ingress rules of the current SG
110111
ingressRules = plan.find_blocks(sg, "ingress")
111-
112+
112113
# Filter to violating CIDR blocks
113114
# Warnings will not be printed for violations since the last parameter is false
114115
violatingCidr = plan.filter_attribute_contains_items_from_list(ingressRules,
115116
"cidr_blocks", forbidden_cidrs, false)
116-
117+
117118
# Filter to violating Service port
118119
# Warnings will not be printed for violations since the last parameter is false
119120
violatingFromPortLess = plan.filter_attribute_less_than_equal_to_value(ingressRules,
120121
"from_port", forbidden_from_port, false)
121-
122+
122123
# Filter to violating Service port
123124
# Warnings will not be printed for violations since the last parameter is false
124125
violatingToPortGreater = plan.filter_attribute_greater_than_equal_to_value(ingressRules,
125126
"to_port", forbidden_to_port, false)
126-
127+
127128
# Print violation messages
128-
if length(violatingCidr["messages"]) > 0 and length(violatingFromPortLess["messages"]) > 0 and
129+
if length(violatingCidr["messages"]) > 0 and length(violatingFromPortLess["messages"]) > 0 and
129130
length(violatingToPortGreater["messages"]) > 0{
130131
violatingSGsCount += 1
131-
print("SG Ingress Violation:", address, "has port", forbidden_port,
132+
print("SG Ingress Violation:", address, "has port", forbidden_port,
132133
"(SSH) open to", forbidden_cidrs, "that is not allowed")
133134
###Uncomment below if you want to show the CIDRs as a separate message as well
134135
# plan.print_violations(violatingCidr["messages"], " Ingress Rule")
@@ -143,4 +144,4 @@ for allSGs as address, sg {
143144
validated = violatingSGsCount is 0 and violatingSGRulesCount is 0
144145
main = rule {
145146
validated is true
146-
}
147+
}

‎governance/third-generation/azure/restrict-inbound-source-address-prefixes.sentinel

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,11 @@ forbidden_cidrs = ["0.0.0.0/0", "0.0.0.0", "*", "Internet"]
1717
# Get all Network Security Group Inbound Allow Rules
1818
SGInboundAllowRules = filter tfplan.resource_changes as address, rc {
1919
rc.type is "azurerm_network_security_rule" and
20-
rc.mode is "managed" and rc.change.after.direction is "Inbound" and
21-
rc.change.after.access is "Allow" and
20+
rc.mode is "managed" and
2221
(rc.change.actions contains "create" or rc.change.actions contains "update" or
23-
rc.change.actions contains "read" or rc.change.actions contains "no-op")
22+
rc.change.actions contains "read" or rc.change.actions contains "no-op") and
23+
rc.change.after.direction is "Inbound" and
24+
rc.change.after.access is "Allow"
2425
}
2526

2627
# Filter to Inbound Allow Security Group Rules with violations

‎governance/third-generation/azure/restrict-outbound-destination-address-prefixes.sentinel

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,11 @@ forbidden_cidrs = ["0.0.0.0/0", "0.0.0.0", "*", "Internet"]
1717
# Get all Network Security Group Outbound Allow Rules
1818
SGOutboundAllowRules = filter tfplan.resource_changes as address, rc {
1919
rc.type is "azurerm_network_security_rule" and
20-
rc.mode is "managed" and rc.change.after.direction is "Outbound" and
21-
rc.change.after.access is "Allow" and
20+
rc.mode is "managed" and
2221
(rc.change.actions contains "create" or rc.change.actions contains "update" or
23-
rc.change.actions contains "read" or rc.change.actions contains "no-op")
22+
rc.change.actions contains "read" or rc.change.actions contains "no-op") and
23+
rc.change.after.direction is "Outbound" and
24+
rc.change.after.access is "Allow"
2425
}
2526

2627
# Filter to Outbound Allow Security Group Rules with violations

0 commit comments

Comments
 (0)