Skip to content

Commit 6b96dbc

Browse files
cx-prathmesh-borlecx-prathmesh-borle
committed
fix(query): resolve false positive on Hardcoded AWS Access Key In Lambda #7074 
1 parent e1f23ca commit 6b96dbc

8 files changed

Lines changed: 79 additions & 15 deletions

File tree

‎assets/queries/cloudFormation/aws/hardcoded_aws_access_key_in_lambda/query.rego‎

Lines changed: 30 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,51 @@
11
package Cx
22

3+
import data.generic.common as common_lib
34
import data.generic.cloudformation as cf_lib
45

6+
sensitive_var_pattern := "(?i)(access.?key|secret.?key|aws.?(key|secret|token|credential)|credential|secret.?access)"
7+
8+
CxPolicy[result] {
9+
document := input.document[i]
10+
resource := document.Resources[key]
11+
resource.Type == "AWS::Lambda::Function"
12+
properties := resource.Properties
13+
14+
envVars := properties.Environment.Variables
15+
some var
16+
re_match("(A3T[A-Z0-9]|AKIA|ASIA)[A-Z0-9]{16}", envVars[var])
17+
18+
result := {
19+
"documentId": input.document[i].id,
20+
"resourceType": resource.Type,
21+
"resourceName": cf_lib.get_resource_name(resource, key),
22+
"searchKey": sprintf("Resources.%s.Properties.Environment.Variables", [key]),
23+
"issueType": "IncorrectValue",
24+
"keyExpectedValue": sprintf("Resources.%s.Properties.Environment.Variables shouldn't contain a hardcoded AWS Access Key", [key]),
25+
"keyActualValue": sprintf("Resources.%s.Properties.Environment.Variables contains a hardcoded AWS Access Key", [key]),
26+
"searchLine": common_lib.build_search_line(["Resources", key, "Properties", "Environment", "Variables", var], []),
27+
}
28+
}
29+
530
CxPolicy[result] {
631
document := input.document[i]
732
resource := document.Resources[key]
833
resource.Type == "AWS::Lambda::Function"
934
properties := resource.Properties
1035

1136
envVars := properties.Environment.Variables
12-
regexAccessKey := ["[A-Za-z0-9/+=]{40}", "[A-Z0-9]{20}"]
1337
some var
14-
re_match(regexAccessKey[_], envVars[var])
38+
re_match(sensitive_var_pattern, var)
39+
re_match("^[A-Za-z0-9/+=]{40}$", envVars[var])
1540

1641
result := {
1742
"documentId": input.document[i].id,
1843
"resourceType": resource.Type,
1944
"resourceName": cf_lib.get_resource_name(resource, key),
2045
"searchKey": sprintf("Resources.%s.Properties.Environment.Variables", [key]),
2146
"issueType": "IncorrectValue",
22-
"keyExpectedValue": sprintf("Resources.%s.Properties.Environment.Variables shouldn't contain access key", [key]),
23-
"keyActualValue": sprintf("Resources.%s.Properties.Environment.Variables contains access key", [key]),
47+
"keyExpectedValue": sprintf("Resources.%s.Properties.Environment.Variables shouldn't contain a hardcoded AWS Secret Key", [key]),
48+
"keyActualValue": sprintf("Resources.%s.Properties.Environment.Variables contains a hardcoded AWS Secret Key", [key]),
49+
"searchLine": common_lib.build_search_line(["Resources", key, "Properties", "Environment", "Variables", var], []),
2450
}
2551
}

‎assets/queries/cloudFormation/aws/hardcoded_aws_access_key_in_lambda/test/negative3.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
AWSTemplateFormatVersion: '2010-09-09'
2+
Resources:
3+
LambdaFunctionSafe:
4+
Type: AWS::Lambda::Function
5+
Properties:
6+
Handler: index.handler
7+
Role: arn:aws:iam::123456789012:role/lambda-role
8+
Environment:
9+
Variables:
10+
foo: "12345678901234567890"
11+
DATA_HASH: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
12+
Code:
13+
S3Bucket: my-bucket
14+
S3Key: function.zip
15+
Runtime: nodejs18.x

‎assets/queries/cloudFormation/aws/hardcoded_aws_access_key_in_lambda/test/negative4.json‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
{
2+
"AWSTemplateFormatVersion": "2010-09-09",
3+
"Resources": {
4+
"LambdaFunctionSafe2": {
5+
"Type": "AWS::Lambda::Function",
6+
"Properties": {
7+
"Handler": "index.handler",
8+
"Role": "arn:aws:iam::123456789012:role/lambda-role",
9+
"Environment": {
10+
"Variables": {
11+
"foo": "12345678901234567890",
12+
"DATA_HASH": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
13+
}
14+
},
15+
"Code": {
16+
"S3Bucket": "my-bucket",
17+
"S3Key": "function.zip"
18+
},
19+
"Runtime": "nodejs18.x"
20+
}
21+
}
22+
}
23+
}

‎assets/queries/cloudFormation/aws/hardcoded_aws_access_key_in_lambda/test/positive1.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ Resources:
88
Role: arn:aws:iam::123456789012:role/lambda-role
99
Environment:
1010
Variables:
11-
foo: "1234567890123456789012345678901234567890$"
11+
AWS_ACCESS_KEY_ID: "AKIAIOSFODNN7EXAMPLE"
1212
databaseName: lambdadb
1313
databaseUser: admin
1414
Code:

‎assets/queries/cloudFormation/aws/hardcoded_aws_access_key_in_lambda/test/positive2.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ Resources:
88
Role: arn:aws:iam::123456789012:role/lambda-role
99
Environment:
1010
Variables:
11-
foo: "12345678901234567890123456789012345678901234567890123456789012345678901234567890$"
11+
AWS_SECRET_ACCESS_KEY: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
1212
Code:
1313
S3Bucket: my-bucket
1414
S3Key: function.zip

‎assets/queries/cloudFormation/aws/hardcoded_aws_access_key_in_lambda/test/positive3.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
"Role": "arn:aws:iam::123456789012:role/lambda-role",
2828
"Environment": {
2929
"Variables": {
30-
"foo": "1234567890123456789012345678901234567890$",
30+
"AWS_ACCESS_KEY_ID": "AKIAIOSFODNN7EXAMPLE",
3131
"databaseName": "lambdadb",
3232
"databaseUser": "admin"
3333
}

‎assets/queries/cloudFormation/aws/hardcoded_aws_access_key_in_lambda/test/positive4.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
"Role": "arn:aws:iam::123456789012:role/lambda-role",
2828
"Environment": {
2929
"Variables": {
30-
"foo": "12345678901234567890123456789012345678901234567890123456789012345678901234567890$"
30+
"AWS_SECRET_ACCESS_KEY": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
3131
}
3232
}
3333
}

‎assets/queries/cloudFormation/aws/hardcoded_aws_access_key_in_lambda/test/positive_expected_result.json‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,25 +2,25 @@
22
{
33
"queryName": "Hardcoded AWS Access Key In Lambda",
44
"severity": "HIGH",
5-
"line": 10,
5+
"line": 11,
66
"fileName": "positive1.yaml"
77
},
88
{
99
"queryName": "Hardcoded AWS Access Key In Lambda",
1010
"severity": "HIGH",
11-
"line": 10,
11+
"line": 11,
1212
"fileName": "positive2.yaml"
1313
},
1414
{
15-
"line": 29,
16-
"fileName": "positive3.json",
1715
"queryName": "Hardcoded AWS Access Key In Lambda",
18-
"severity": "HIGH"
16+
"severity": "HIGH",
17+
"line": 30,
18+
"fileName": "positive3.json"
1919
},
2020
{
2121
"queryName": "Hardcoded AWS Access Key In Lambda",
2222
"severity": "HIGH",
23-
"line": 29,
23+
"line": 30,
2424
"fileName": "positive4.json"
2525
}
26-
]
26+
]

0 commit comments

Comments
 (0)