Skip to content

Commit b57eccb

Browse files
nikpivkinnikpivkin
authored
feat(misconf): adapt aws_default_security_group (#8538)
Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io>
1 parent 8bf6caf commit b57eccb

File tree

2 files changed

+160
-110
lines changed

2 files changed

+160
-110
lines changed

‎pkg/iac/adapters/terraform/aws/ec2/vpc.go‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
package ec2
22

33
import (
4+
"strconv"
5+
46
"github.com/aquasecurity/trivy/pkg/iac/providers/aws/ec2"
57
"github.com/aquasecurity/trivy/pkg/iac/terraform"
68
iacTypes "github.com/aquasecurity/trivy/pkg/iac/types"
@@ -60,6 +62,15 @@ func (a *sgAdapter) adaptSecurityGroups(modules terraform.Modules) []ec2.Securit
6062
for _, resource := range modules.GetResourcesByType("aws_security_group") {
6163
securityGroups = append(securityGroups, a.adaptSecurityGroup(resource, modules))
6264
}
65+
66+
for _, resource := range modules.GetResourcesByType("aws_default_security_group") {
67+
sg := a.adaptSecurityGroup(resource, modules)
68+
sg.IsDefault = iacTypes.Bool(true, sg.Metadata)
69+
sg.Description = iacTypes.String("", sg.Metadata)
70+
sg.VPCID = iacTypes.String("", sg.Metadata)
71+
securityGroups = append(securityGroups, sg)
72+
}
73+
6374
orphanResources := modules.GetResourceByIDs(a.sgRuleIDs.Orphans()...)
6475
if len(orphanResources) > 0 {
6576
orphanage := ec2.SecurityGroup{
@@ -171,13 +182,19 @@ func adaptSGRule(resource *terraform.Block) ec2.SecurityGroupRule {
171182
cidrs = append(cidrs, ipv6cidrBlocks.AsStringValues()...)
172183
}
173184

185+
protocolAddr := resource.GetAttribute("protocol")
186+
protocol := protocolAddr.AsStringValueOrDefault("", resource)
187+
if protocolAddr.IsNumber() {
188+
protocol = iacTypes.String(strconv.Itoa(int(protocolAddr.AsNumber())), protocolAddr.GetMetadata())
189+
}
190+
174191
return ec2.SecurityGroupRule{
175192
Metadata: resource.GetMetadata(),
176193
Description: ruleDescVal,
177194
CIDRs: cidrs,
178195
FromPort: resource.GetAttribute("from_port").AsIntValueOrDefault(-1, resource),
179196
ToPort: resource.GetAttribute("to_port").AsIntValueOrDefault(-1, resource),
180-
Protocol: resource.GetAttribute("protocol").AsStringValueOrDefault("", resource),
197+
Protocol: protocol,
181198
}
182199
}
183200

‎pkg/iac/adapters/terraform/aws/ec2/vpc_test.go‎

Lines changed: 142 additions & 109 deletions
Original file line numberDiff line numberDiff line change
@@ -20,58 +20,75 @@ func Test_AdaptVPC(t *testing.T) {
2020
}{
2121
{
2222
name: "defined",
23-
terraform: `
24-
resource "aws_flow_log" "this" {
25-
vpc_id = aws_vpc.main.id
26-
}
27-
resource "aws_default_vpc" "default" {
28-
tags = {
29-
Name = "Default VPC"
30-
}
31-
}
32-
33-
resource "aws_vpc" "main" {
34-
cidr_block = "4.5.6.7/32"
35-
}
36-
37-
resource "aws_security_group" "example" {
38-
name = "http"
39-
description = "Allow inbound HTTP traffic"
40-
41-
ingress {
42-
description = "Rule #1"
43-
from_port = 80
44-
to_port = 80
45-
protocol = "tcp"
46-
cidr_blocks = [aws_vpc.main.cidr_block]
47-
}
48-
49-
egress {
50-
cidr_blocks = ["1.2.3.4/32"]
51-
}
52-
}
53-
54-
resource "aws_network_acl_rule" "example" {
55-
egress = false
56-
protocol = "tcp"
57-
from_port = 22
58-
to_port = 22
59-
rule_action = "allow"
60-
cidr_block = "10.0.0.0/16"
61-
}
62-
63-
resource "aws_security_group_rule" "example" {
64-
type = "ingress"
65-
description = "Rule #2"
66-
security_group_id = aws_security_group.example.id
67-
from_port = 22
68-
to_port = 22
69-
protocol = "tcp"
70-
cidr_blocks = [
71-
"1.2.3.4/32",
72-
"4.5.6.7/32",
73-
]
74-
}
23+
terraform: `resource "aws_flow_log" "this" {
24+
vpc_id = aws_vpc.main.id
25+
}
26+
resource "aws_default_vpc" "default" {
27+
tags = {
28+
Name = "Default VPC"
29+
}
30+
}
31+
32+
resource "aws_vpc" "main" {
33+
cidr_block = "4.5.6.7/32"
34+
}
35+
36+
resource "aws_security_group" "example" {
37+
name = "http"
38+
description = "Allow inbound HTTP traffic"
39+
40+
ingress {
41+
description = "Rule #1"
42+
from_port = 80
43+
to_port = 80
44+
protocol = "tcp"
45+
cidr_blocks = [aws_vpc.main.cidr_block]
46+
}
47+
48+
egress {
49+
cidr_blocks = ["1.2.3.4/32"]
50+
}
51+
}
52+
53+
resource "aws_network_acl_rule" "example" {
54+
egress = false
55+
protocol = "tcp"
56+
from_port = 22
57+
to_port = 22
58+
rule_action = "allow"
59+
cidr_block = "10.0.0.0/16"
60+
}
61+
62+
resource "aws_security_group_rule" "example" {
63+
type = "ingress"
64+
description = "Rule #2"
65+
security_group_id = aws_security_group.example.id
66+
from_port = 22
67+
to_port = 22
68+
protocol = "tcp"
69+
cidr_blocks = [
70+
"1.2.3.4/32",
71+
"4.5.6.7/32",
72+
]
73+
}
74+
75+
resource "aws_default_security_group" "default" {
76+
vpc_id = aws_vpc.main.id
77+
78+
ingress {
79+
protocol = -1
80+
self = true
81+
from_port = 0
82+
to_port = 0
83+
}
84+
85+
egress {
86+
from_port = 0
87+
to_port = 0
88+
protocol = "-1"
89+
cidr_blocks = ["0.0.0.0/0"]
90+
}
91+
}
7592
`,
7693
expected: ec2.EC2{
7794
VPCs: []ec2.VPC{
@@ -132,6 +149,24 @@ func Test_AdaptVPC(t *testing.T) {
132149
},
133150
},
134151
},
152+
{
153+
IsDefault: iacTypes.BoolTest(true),
154+
IngressRules: []ec2.SecurityGroupRule{
155+
{
156+
Protocol: iacTypes.StringTest("-1"),
157+
FromPort: iacTypes.IntTest(0),
158+
ToPort: iacTypes.IntTest(0),
159+
},
160+
},
161+
EgressRules: []ec2.SecurityGroupRule{
162+
{
163+
Protocol: iacTypes.StringTest("-1"),
164+
FromPort: iacTypes.IntTest(0),
165+
ToPort: iacTypes.IntTest(0),
166+
CIDRs: []iacTypes.StringValue{iacTypes.StringTest("0.0.0.0/0")},
167+
},
168+
},
169+
},
135170
},
136171
NetworkACLs: []ec2.NetworkACL{
137172
{
@@ -156,17 +191,16 @@ func Test_AdaptVPC(t *testing.T) {
156191
},
157192
{
158193
name: "defaults",
159-
terraform: `
160-
resource "aws_security_group" "example" {
161-
ingress {
162-
}
194+
terraform: `resource "aws_security_group" "example" {
195+
ingress {
196+
}
163197
164-
egress {
165-
}
166-
}
198+
egress {
199+
}
200+
}
167201
168-
resource "aws_network_acl_rule" "example" {
169-
}
202+
resource "aws_network_acl_rule" "example" {
203+
}
170204
`,
171205
expected: ec2.EC2{
172206
SecurityGroups: []ec2.SecurityGroup{
@@ -214,8 +248,7 @@ func Test_AdaptVPC(t *testing.T) {
214248
},
215249
{
216250
name: "aws_flow_log refer to locals",
217-
terraform: `
218-
locals {
251+
terraform: `locals {
219252
vpc_id = try(aws_vpc.this.id, "")
220253
}
221254
@@ -239,8 +272,7 @@ resource "aws_flow_log" "this" {
239272
},
240273
{
241274
name: "ingress and egress rules",
242-
terraform: `
243-
resource "aws_security_group" "example" {
275+
terraform: `resource "aws_security_group" "example" {
244276
name = "example"
245277
description = "example"
246278
}
@@ -300,50 +332,51 @@ resource "aws_vpc_security_group_ingress_rule" "test" {
300332

301333
func TestVPCLines(t *testing.T) {
302334
src := `
303-
resource "aws_default_vpc" "default" {
304-
}
305-
306-
resource "aws_vpc" "main" {
307-
cidr_block = "4.5.6.7/32"
308-
}
309-
310-
resource "aws_security_group" "example" {
311-
name = "http"
312-
description = "Allow inbound HTTP traffic"
313-
314-
ingress {
315-
description = "HTTP from VPC"
316-
from_port = 80
317-
to_port = 80
318-
protocol = "tcp"
319-
cidr_blocks = [aws_vpc.main.cidr_block]
320-
}
321-
322-
egress {
323-
cidr_blocks = ["1.2.3.4/32"]
324-
}
325-
}
326-
327-
resource "aws_security_group_rule" "example" {
328-
type = "ingress"
329-
security_group_id = aws_security_group.example.id
330-
from_port = 22
331-
to_port = 22
332-
protocol = "tcp"
333-
cidr_blocks = [
334-
"1.2.3.4/32",
335-
"4.5.6.7/32",
336-
]
337-
}
338-
339-
resource "aws_network_acl_rule" "example" {
340-
egress = false
341-
protocol = "tcp"
342-
from_port = 22
343-
to_port = 22
344-
rule_action = "allow"
345-
cidr_block = "10.0.0.0/16"
346-
}`
335+
resource "aws_default_vpc" "default" {
336+
}
337+
338+
resource "aws_vpc" "main" {
339+
cidr_block = "4.5.6.7/32"
340+
}
341+
342+
resource "aws_security_group" "example" {
343+
name = "http"
344+
description = "Allow inbound HTTP traffic"
345+
346+
ingress {
347+
description = "HTTP from VPC"
348+
from_port = 80
349+
to_port = 80
350+
protocol = "tcp"
351+
cidr_blocks = [aws_vpc.main.cidr_block]
352+
}
353+
354+
egress {
355+
cidr_blocks = ["1.2.3.4/32"]
356+
}
357+
}
358+
359+
resource "aws_security_group_rule" "example" {
360+
type = "ingress"
361+
security_group_id = aws_security_group.example.id
362+
from_port = 22
363+
to_port = 22
364+
protocol = "tcp"
365+
cidr_blocks = [
366+
"1.2.3.4/32",
367+
"4.5.6.7/32",
368+
]
369+
}
370+
371+
resource "aws_network_acl_rule" "example" {
372+
egress = false
373+
protocol = "tcp"
374+
from_port = 22
375+
to_port = 22
376+
rule_action = "allow"
377+
cidr_block = "10.0.0.0/16"
378+
}
379+
`
347380

348381
modules := tftestutil.CreateModulesFromSource(t, src, ".tf")
349382
adapted := Adapt(modules)

0 commit comments

Comments
 (0)