Skip to content

Commit 0e5b924

Browse files
ja5onhughe5ja5onhughe5
committed
Add some functionality and info
I added a null check in the aws_security_group_rule loop and additional info in the fail messaging.
1 parent 986d450 commit 0e5b924

File tree

2 files changed

+85
-35
lines changed

2 files changed

+85
-35
lines changed

‎governance/third-generation/aws/restrict-ingress-sg-rule-rdp.sentinel

Lines changed: 43 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# This policy uses the Sentinel tfplan/v2 import to validate that no security group
2-
# rules have the have SSH open to CIDR "0.0.0.0/0" for ingress rules. It covers both the
2+
# rules have the have RDP open to CIDR "0.0.0.0/0" for ingress rules. It covers both the
33
# aws_security_group and the aws_security_group_rule resources which can both
44
# define rules.
55

@@ -40,19 +40,50 @@ for aws_security_group_rules as address, sgr {
4040
# We check that it is present and really a list
4141
# before checking whether it contains "0.0.0.0/0"
4242
if sgr.change.after.cidr_blocks else null is not null and
43+
types.type_of(sgr.change.after.cidr_blocks) is "list" and
44+
sgr.change.after.cidr_blocks contains "0.0.0.0/0" and
45+
sgr.change.after.from_port else null is null and
46+
sgr.change.after.to_port else null is not null and
47+
sgr.change.after.to_port is forbidden_to_port{
48+
violatingSGRulesCount += 1
49+
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
50+
"(RDP) open to", forbidden_cidrs, "that is not allowed")
51+
print(" Ingress Rule has from_port that is null or undefined")
52+
print(" and Ingress Rule has to_port with value", sgr.change.after.to_port)
53+
print(" The to_port and from_port both need to be set to an integer",
54+
"range or of equal")
55+
print(" value to each other that is either less than or greater than", forbidden_port)
56+
} else if sgr.change.after.cidr_blocks else null is not null and
4357
types.type_of(sgr.change.after.cidr_blocks) is "list" and
4458
sgr.change.after.cidr_blocks contains "0.0.0.0/0" and
4559
sgr.change.after.from_port else null is not null and
46-
sgr.change.after.from_port <= forbidden_from_port and
60+
sgr.change.after.from_port is forbidden_from_port and
61+
sgr.change.after.to_port else null is null{
62+
violatingSGRulesCount += 1
63+
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
64+
"(RDP) open to", forbidden_cidrs, "that is not allowed")
65+
print(" Ingress Rule has from_port with value", sgr.change.after.from_port)
66+
print(" and Ingress Rule has to_port that is null or undefined")
67+
print(" The to_port and from_port both need to be set to an integer",
68+
"range or of equal")
69+
print(" value to each other that is either less than or greater than", forbidden_port)
70+
} else if sgr.change.after.cidr_blocks else null is not null and
71+
types.type_of(sgr.change.after.cidr_blocks) is "list" and
72+
sgr.change.after.cidr_blocks contains "0.0.0.0/0" and
73+
sgr.change.after.from_port else null is not null and
74+
sgr.change.after.from_port <= forbidden_from_port and
4775
sgr.change.after.to_port else null is not null and
4876
sgr.change.after.to_port >= forbidden_to_port{
4977
violatingSGRulesCount += 1
5078
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
5179
"(RDP) open to", forbidden_cidrs, "that is not allowed")
52-
print(" Ingress Rule", "has from_port with value", sgr.change.after.from_port,
80+
print(" Ingress Rule has from_port with value", sgr.change.after.from_port,
5381
"that is less than or equal to", forbidden_from_port)
54-
print(" and Ingress Rule has to_port with value", sgr.change.after.to_port,
82+
print(" and Ingress Rule has to_port with value", sgr.change.after.to_port,
5583
"that is greater than or equal to", forbidden_to_port)
84+
print(" The to_port and from_port both need to be set to an integer",
85+
"range or of equal")
86+
print(" value to each other that is either less than or greater than", forbidden_port)
5687
} else if sgr.change.after.cidr_blocks else null is not null and
5788
types.type_of(sgr.change.after.cidr_blocks) is "list" and
5889
sgr.change.after.cidr_blocks contains "0.0.0.0/0" and
@@ -61,7 +92,10 @@ for aws_security_group_rules as address, sgr {
6192
violatingSGRulesCount += 1
6293
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
6394
"(RDP) open to", forbidden_cidrs, "that is not allowed")
64-
print(" Ingress Rule", "has to_port with value", sgr.change.after.to_port)
95+
print(" Ingress Rule has to_port with value", sgr.change.after.to_port)
96+
print(" The to_port and from_port both need to be set to an integer",
97+
"range or of equal")
98+
print(" value to each other that is either less than or greater than", forbidden_port)
6599
}
66100
} // end of SG Rules
67101

@@ -80,11 +114,6 @@ for allSGs as address, sg {
80114
violatingCidr = plan.filter_attribute_contains_items_from_list(ingressRules,
81115
"cidr_blocks", forbidden_cidrs, false)
82116

83-
# Filter to violating Service port
84-
# Warnings will not be printed for violations since the last parameter is false
85-
violatingToPort = plan.filter_attribute_is_value(ingressRules,
86-
"to_port", forbidden_to_port, false)
87-
88117
# Filter to violating Service port
89118
# Warnings will not be printed for violations since the last parameter is false
90119
violatingFromPortLess = plan.filter_attribute_less_than_equal_to_value(ingressRules,
@@ -104,14 +133,10 @@ for allSGs as address, sg {
104133
###Uncomment below if you want to show the CIDRs as a separate message as well
105134
# plan.print_violations(violatingCidr["messages"], " Ingress Rule")
106135
plan.print_violations(violatingFromPortLess["messages"], " Ingress Rule")
107-
plan.print_violations(violatingToPortGreater["messages"], " and Ingress Rule")
108-
} else if length(violatingCidr["messages"]) > 0 and length(violatingToPort["messages"]) > 0{
109-
violatingSGsCount += 1
110-
print("SG Ingress Violation:", address, "has port", forbidden_port,
111-
"(RDP) open to", forbidden_cidrs, "that is not allowed")
112-
###Uncomment below if you want to show the CIDRs as a separate message as well
113-
# plan.print_violations(violatingCidr["messages"], " Ingress Rule")
114-
plan.print_violations(violatingToPort["messages"], " Ingress Rule")
136+
plan.print_violations(violatingToPortGreater["messages"], " and Ingress Rule")
137+
print(" The to_port and from_port both need to be set to an integer",
138+
"range or of equal")
139+
print(" value to each other that is either less than or greater than", forbidden_port)
115140
}
116141
} // end for SGs
117142

‎governance/third-generation/aws/restrict-ingress-sg-rule-ssh.sentinel

Lines changed: 42 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -40,19 +40,50 @@ for aws_security_group_rules as address, sgr {
4040
# We check that it is present and really a list
4141
# before checking whether it contains "0.0.0.0/0"
4242
if sgr.change.after.cidr_blocks else null is not null and
43+
types.type_of(sgr.change.after.cidr_blocks) is "list" and
44+
sgr.change.after.cidr_blocks contains "0.0.0.0/0" and
45+
sgr.change.after.from_port else null is null and
46+
sgr.change.after.to_port else null is not null and
47+
sgr.change.after.to_port is forbidden_to_port{
48+
violatingSGRulesCount += 1
49+
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
50+
"(SSH) open to", forbidden_cidrs, "that is not allowed")
51+
print(" Ingress Rule has from_port that is null or undefined")
52+
print(" and Ingress Rule has to_port with value", sgr.change.after.to_port)
53+
print(" The to_port and from_port both need to be set to an integer",
54+
"range or of equal")
55+
print(" value to each other that is either less than or greater than", forbidden_port)
56+
} else if sgr.change.after.cidr_blocks else null is not null and
4357
types.type_of(sgr.change.after.cidr_blocks) is "list" and
4458
sgr.change.after.cidr_blocks contains "0.0.0.0/0" and
4559
sgr.change.after.from_port else null is not null and
46-
sgr.change.after.from_port <= forbidden_from_port and
60+
sgr.change.after.from_port is forbidden_from_port and
61+
sgr.change.after.to_port else null is null{
62+
violatingSGRulesCount += 1
63+
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
64+
"(SSH) open to", forbidden_cidrs, "that is not allowed")
65+
print(" Ingress Rule has from_port with value", sgr.change.after.from_port)
66+
print(" and Ingress Rule has to_port that is null or undefined")
67+
print(" The to_port and from_port both need to be set to an integer",
68+
"range or of equal")
69+
print(" value to each other that is either less than or greater than", forbidden_port)
70+
} else if sgr.change.after.cidr_blocks else null is not null and
71+
types.type_of(sgr.change.after.cidr_blocks) is "list" and
72+
sgr.change.after.cidr_blocks contains "0.0.0.0/0" and
73+
sgr.change.after.from_port else null is not null and
74+
sgr.change.after.from_port <= forbidden_from_port and
4775
sgr.change.after.to_port else null is not null and
4876
sgr.change.after.to_port >= forbidden_to_port{
4977
violatingSGRulesCount += 1
5078
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
5179
"(SSH) open to", forbidden_cidrs, "that is not allowed")
52-
print(" Ingress Rule", "has from_port with value", sgr.change.after.from_port,
80+
print(" Ingress Rule has from_port with value", sgr.change.after.from_port,
5381
"that is less than or equal to", forbidden_from_port)
54-
print(" and Ingress Rule has to_port with value", sgr.change.after.to_port,
82+
print(" and Ingress Rule has to_port with value", sgr.change.after.to_port,
5583
"that is greater than or equal to", forbidden_to_port)
84+
print(" The to_port and from_port both need to be set to an integer",
85+
"range or of equal")
86+
print(" value to each other that is either less than or greater than", forbidden_port)
5687
} else if sgr.change.after.cidr_blocks else null is not null and
5788
types.type_of(sgr.change.after.cidr_blocks) is "list" and
5889
sgr.change.after.cidr_blocks contains "0.0.0.0/0" and
@@ -61,7 +92,10 @@ for aws_security_group_rules as address, sgr {
6192
violatingSGRulesCount += 1
6293
print("SG Rule Ingress Violation:", address, "has port", forbidden_port,
6394
"(SSH) open to", forbidden_cidrs, "that is not allowed")
64-
print(" Ingress Rule", "has to_port with value", sgr.change.after.to_port)
95+
print(" Ingress Rule has to_port with value", sgr.change.after.to_port)
96+
print(" The to_port and from_port both need to be set to an integer",
97+
"range or of equal")
98+
print(" value to each other that is either less than or greater than", forbidden_port)
6599
}
66100
} // end of SG Rules
67101

@@ -80,11 +114,6 @@ for allSGs as address, sg {
80114
violatingCidr = plan.filter_attribute_contains_items_from_list(ingressRules,
81115
"cidr_blocks", forbidden_cidrs, false)
82116

83-
# Filter to violating Service port
84-
# Warnings will not be printed for violations since the last parameter is false
85-
violatingToPort = plan.filter_attribute_is_value(ingressRules,
86-
"to_port", forbidden_to_port, false)
87-
88117
# Filter to violating Service port
89118
# Warnings will not be printed for violations since the last parameter is false
90119
violatingFromPortLess = plan.filter_attribute_less_than_equal_to_value(ingressRules,
@@ -104,14 +133,10 @@ for allSGs as address, sg {
104133
###Uncomment below if you want to show the CIDRs as a separate message as well
105134
# plan.print_violations(violatingCidr["messages"], " Ingress Rule")
106135
plan.print_violations(violatingFromPortLess["messages"], " Ingress Rule")
107-
plan.print_violations(violatingToPortGreater["messages"], " and Ingress Rule")
108-
} else if length(violatingCidr["messages"]) > 0 and length(violatingToPort["messages"]) > 0{
109-
violatingSGsCount += 1
110-
print("SG Ingress Violation:", address, "has port", forbidden_port,
111-
"(SSH) open to", forbidden_cidrs, "that is not allowed")
112-
###Uncomment below if you want to show the CIDRs as a separate message as well
113-
# plan.print_violations(violatingCidr["messages"], " Ingress Rule")
114-
plan.print_violations(violatingToPort["messages"], " Ingress Rule")
136+
plan.print_violations(violatingToPortGreater["messages"], " and Ingress Rule")
137+
print(" The to_port and from_port both need to be set to an integer",
138+
"range or of equal")
139+
print(" value to each other that is either less than or greater than", forbidden_port)
115140
}
116141
} // end for SGs
117142

0 commit comments

Comments
 (0)