Skip to content

Commit 493a995

Browse files
rberlindrberlind
committed
add sec group egress policies
1 parent f2a5cc9 commit 493a995

34 files changed

+1976
-7
lines changed

‎governance/third-generation/aws/restrict-egress-sg-rule-cidr-blocks.sentinel

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# This policy uses the Sentinel tfplan/v2 import to validate that no security group
2+
# rules have the CIDR "0.0.0.0/0" for egress rules. It covers both the
3+
# aws_security_group and the aws_security_group_rule resources which can both
4+
# define rules.
5+
6+
# Import the tfplan/v2 import, but use the alias "tfplan"
7+
import "tfplan/v2" as tfplan
8+
9+
# Import common-functions/tfplan-functions/tfplan-functions.sentinel
10+
# with alias "plan"
11+
import "tfplan-functions" as plan
12+
13+
# Forbidden CIDRs
14+
# Include "null" to forbid missing or computed values
15+
forbidden_cidrs = ["0.0.0.0/0"]
16+
17+
# Get all Security Group Egress Rules
18+
SGEgressRules = filter tfplan.resource_changes as address, rc {
19+
rc.type is "aws_security_group_rule" and
20+
rc.mode is "managed" and rc.change.after.type is "egress" and
21+
(rc.change.actions contains "create" or rc.change.actions contains "update" or
22+
rc.change.actions contains "read" or rc.change.actions contains "no-op")
23+
}
24+
25+
# Filter to Egress Security Group Rules with violations
26+
# Warnings will be printed for all violations since the last parameter is true
27+
violatingSGRules = plan.filter_attribute_contains_items_from_list(SGEgressRules,
28+
"cidr_blocks",forbidden_cidrs, true)
29+
30+
# Get all Security Groups
31+
allSGs = plan.find_resources("aws_security_group")
32+
33+
# Validate Security Groups
34+
violatingSGsCount = 0
35+
for allSGs as address, sg {
36+
37+
# Find the egress rules of the current SG
38+
egressRules = plan.find_blocks(sg, "egress")
39+
40+
# Filter to violating CIDR blocks
41+
# Warnings will not be printed for violations since the last parameter is false
42+
violatingERs = plan.filter_attribute_contains_items_from_list(egressRules,
43+
"cidr_blocks", forbidden_cidrs, false)
44+
45+
# Print violation messages
46+
if length(violatingERs["messages"]) > 0 {
47+
violatingSGsCount += 1
48+
print("SG Egress Violation:", address, "has at least one egress rule",
49+
"with forbidden cidr blocks")
50+
plan.print_violations(violatingERs["messages"], "Egress Rule")
51+
} // end if
52+
53+
} // end for SGs
54+
55+
# Main rule
56+
validated = length(violatingSGRules["messages"]) is 0 and violatingSGsCount is 0
57+
main = rule {
58+
validated is true
59+
}

‎governance/third-generation/aws/restrict-ingress-sg-rule-cidr-blocks.sentinel

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
# This policy uses the Sentinel tfplan/v2 import to validate that no security group
2-
# rules have the CIDR "0.0.0.0/0". It covers both the aws_security_group and
3-
# the aws_security_group_rule resources which can both define rules.
2+
# rules have the CIDR "0.0.0.0/0" for ingress rules. It covers both the
3+
# aws_security_group and the aws_security_group_rule resources which can both
4+
# define rules.
45

56
# Import the tfplan/v2 import, but use the alias "tfplan"
67
import "tfplan/v2" as tfplan

‎governance/third-generation/gcp/test/restrict-firewall-source-ranges/fail.json renamed to ‎governance/third-generation/aws/test/restrict-egress-sg-rule-cidr-blocks/fail.json

File renamed without changes.

‎governance/third-generation/aws/test/restrict-egress-sg-rule-cidr-blocks/mock-tfplan-fail.sentinel

Lines changed: 259 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,259 @@
1+
terraform_version = "0.12.24"
2+
3+
variables = {}
4+
5+
resource_changes = {
6+
"aws_security_group.allow_tls": {
7+
"address": "aws_security_group.allow_tls",
8+
"change": {
9+
"actions": [
10+
"create",
11+
],
12+
"after": {
13+
"description": "Allow TLS inbound traffic",
14+
"egress": [
15+
{
16+
"cidr_blocks": [
17+
"0.0.0.0/0",
18+
],
19+
"description": "",
20+
"from_port": 444,
21+
"ipv6_cidr_blocks": [],
22+
"prefix_list_ids": [],
23+
"protocol": "tcp",
24+
"security_groups": [],
25+
"self": false,
26+
"to_port": 444,
27+
},
28+
{
29+
"cidr_blocks": [],
30+
"description": "",
31+
"from_port": 443,
32+
"ipv6_cidr_blocks": [],
33+
"prefix_list_ids": [],
34+
"protocol": "tcp",
35+
"security_groups": [],
36+
"self": true,
37+
"to_port": 443,
38+
},
39+
],
40+
"name": "allow_tls",
41+
"name_prefix": null,
42+
"revoke_rules_on_delete": false,
43+
"tags": {
44+
"Name": "allow_all",
45+
},
46+
"timeouts": null,
47+
},
48+
"after_unknown": {
49+
"arn": true,
50+
"ingress": true,
51+
"id": true,
52+
"egress": [
53+
{
54+
"cidr_blocks": [
55+
false,
56+
],
57+
"ipv6_cidr_blocks": [],
58+
"prefix_list_ids": [],
59+
"security_groups": [],
60+
},
61+
{
62+
"cidr_blocks": [],
63+
"ipv6_cidr_blocks": [],
64+
"prefix_list_ids": [],
65+
"security_groups": [],
66+
},
67+
],
68+
"owner_id": true,
69+
"tags": {},
70+
"vpc_id": true,
71+
},
72+
"before": null,
73+
},
74+
"deposed": "",
75+
"index": null,
76+
"mode": "managed",
77+
"module_address": "",
78+
"name": "allow_tls",
79+
"provider_name": "aws",
80+
"type": "aws_security_group",
81+
},
82+
"aws_security_group_rule.allow_all[0]": {
83+
"address": "aws_security_group_rule.allow_all[0]",
84+
"change": {
85+
"actions": [
86+
"create",
87+
],
88+
"after": {
89+
"cidr_blocks": null,
90+
"description": null,
91+
"from_port": 0,
92+
"ipv6_cidr_blocks": null,
93+
"prefix_list_ids": null,
94+
"protocol": "tcp",
95+
"security_group_id": "sg-008b502d0a24d0136",
96+
"self": true,
97+
"to_port": 65535,
98+
"type": "egress",
99+
},
100+
"after_unknown": {
101+
"id": true,
102+
"source_security_group_id": true,
103+
},
104+
"before": null,
105+
},
106+
"deposed": "",
107+
"index": 0,
108+
"mode": "managed",
109+
"module_address": "",
110+
"name": "allow_all",
111+
"provider_name": "aws",
112+
"type": "aws_security_group_rule",
113+
},
114+
"aws_security_group_rule.allow_all[1]": {
115+
"address": "aws_security_group_rule.allow_all[1]",
116+
"change": {
117+
"actions": [
118+
"create",
119+
],
120+
"after": {
121+
"cidr_blocks": null,
122+
"description": null,
123+
"from_port": 0,
124+
"ipv6_cidr_blocks": null,
125+
"prefix_list_ids": null,
126+
"protocol": "tcp",
127+
"security_group_id": "sg-008b502d0a24d0136",
128+
"self": true,
129+
"to_port": 65535,
130+
"type": "egress",
131+
},
132+
"after_unknown": {
133+
"id": true,
134+
"source_security_group_id": true,
135+
},
136+
"before": null,
137+
},
138+
"deposed": "",
139+
"index": 1,
140+
"mode": "managed",
141+
"module_address": "",
142+
"name": "allow_all",
143+
"provider_name": "aws",
144+
"type": "aws_security_group_rule",
145+
},
146+
"aws_security_group_rule.allow_ssh": {
147+
"address": "aws_security_group_rule.allow_ssh",
148+
"change": {
149+
"actions": [
150+
"create",
151+
],
152+
"after": {
153+
"cidr_blocks": [
154+
"0.0.0.0/0",
155+
],
156+
"description": null,
157+
"from_port": 22,
158+
"ipv6_cidr_blocks": null,
159+
"prefix_list_ids": null,
160+
"protocol": "tcp",
161+
"security_group_id": "sg-008b502d0a24d0136",
162+
"self": false,
163+
"to_port": 22,
164+
"type": "egress",
165+
},
166+
"after_unknown": {
167+
"cidr_blocks": [
168+
false,
169+
],
170+
"id": true,
171+
"source_security_group_id": true,
172+
},
173+
"before": null,
174+
},
175+
"deposed": "",
176+
"index": null,
177+
"mode": "managed",
178+
"module_address": "",
179+
"name": "allow_ssh",
180+
"provider_name": "aws",
181+
"type": "aws_security_group_rule",
182+
},
183+
"module.more-sgrs.aws_security_group_rule.https": {
184+
"address": "module.more-sgrs.aws_security_group_rule.https",
185+
"change": {
186+
"actions": [
187+
"create",
188+
],
189+
"after": {
190+
"cidr_blocks": [
191+
"0.0.0.0/0",
192+
],
193+
"description": null,
194+
"from_port": 443,
195+
"ipv6_cidr_blocks": null,
196+
"prefix_list_ids": null,
197+
"protocol": "tcp",
198+
"security_group_id": "sg-008b502d0a24d0136",
199+
"self": false,
200+
"to_port": 443,
201+
"type": "egress",
202+
},
203+
"after_unknown": {
204+
"cidr_blocks": [
205+
false,
206+
],
207+
"id": true,
208+
"source_security_group_id": true,
209+
},
210+
"before": null,
211+
},
212+
"deposed": "",
213+
"index": null,
214+
"mode": "managed",
215+
"module_address": "module.more-sgrs",
216+
"name": "https",
217+
"provider_name": "aws",
218+
"type": "aws_security_group_rule",
219+
},
220+
"module.more-sgrs.module.even-more-sgrs.aws_security_group_rule.http": {
221+
"address": "module.more-sgrs.module.even-more-sgrs.aws_security_group_rule.http",
222+
"change": {
223+
"actions": [
224+
"create",
225+
],
226+
"after": {
227+
"cidr_blocks": [
228+
"0.0.0.0/0",
229+
],
230+
"description": null,
231+
"from_port": 80,
232+
"ipv6_cidr_blocks": null,
233+
"prefix_list_ids": null,
234+
"protocol": "tcp",
235+
"security_group_id": "sg-008b502d0a24d0136",
236+
"self": false,
237+
"to_port": 80,
238+
"type": "egress",
239+
},
240+
"after_unknown": {
241+
"cidr_blocks": [
242+
false,
243+
],
244+
"id": true,
245+
"source_security_group_id": true,
246+
},
247+
"before": null,
248+
},
249+
"deposed": "",
250+
"index": null,
251+
"mode": "managed",
252+
"module_address": "module.more-sgrs.module.even-more-sgrs",
253+
"name": "http",
254+
"provider_name": "aws",
255+
"type": "aws_security_group_rule",
256+
},
257+
}
258+
259+
output_changes = {}

0 commit comments

Comments
 (0)