Skip to content

Commit f42f2ed

Browse files
cx-artur-ribeirocx-artur-ribeiro
authored
fix(query): fix EFS Volume With Disabled Transit Encryption queries for multiple volumes cases (#7947)
* fix EFS Volume With Disabled Transit Encryption query for multiple volumes cases in tf and cf * update: dockerfile images
1 parent e1f23ca commit f42f2ed

29 files changed

Lines changed: 1126 additions & 63 deletions

‎Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM checkmarx/go:1.26.0-r0@sha256:bbc945863cdee21f4bab2e80b4bd481cfee5c13ece8e576136bc478a5f6ad34d AS build_env
1+
FROM checkmarx/go:1.26.1-r1@sha256:3984b97600a32d5a9ff14cc4b8029572a762082d98fb9788bbc4050d4f45d9d2 AS build_env
22

33
# Copy the source from the current directory to the Working Directory inside the container
44
WORKDIR /app
@@ -29,7 +29,7 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build \
2929
# Runtime image
3030
# Ignore no User Cmd since KICS container is stopped afer scan
3131
# kics-scan ignore-line
32-
FROM checkmarx/git:2.53.0-r0@sha256:f46c18d1ae724ca35faa4884289e8203294e52cafb17717e3875ab2c636a0a7e
32+
FROM checkmarx/git:2.53.0-r0@sha256:6f398e9772fc0271cbdd77b065a09c9244004fbda17c1c58ba01b412a4292bde
3333

3434
ENV TERM xterm-256color
3535

‎assets/queries/cloudFormation/aws/efs_volume_with_disabled_transit_encryption/query.rego‎

Lines changed: 63 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -7,60 +7,76 @@ CxPolicy[result] {
77
resource_list := input.document[i].Resources
88
resource := resource_list[name]
99
resource.Type == "AWS::ECS::TaskDefinition"
10-
results := is_transit_encryption_disabled(resource,name)
10+
volume := resource.Properties.Volumes[j]
11+
common_lib.valid_key(volume.EFSVolumeConfiguration, "TransitEncryption")
12+
volume.EFSVolumeConfiguration.TransitEncryption != "ENABLED"
1113

12-
result := {
14+
result := {
1315
"documentId": input.document[i].id,
1416
"resourceType": resource.Type,
1517
"resourceName": cf_lib.get_resource_name(resource, name),
16-
"searchKey": results.sk,
17-
"issueType": results.issueT,
18-
"keyExpectedValue": results.kev,
19-
"keyActualValue": results.kav,
20-
"searchLine": results.sl,
18+
"searchKey": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration.TransitEncryption", [name, j]),
19+
"issueType": "IncorrectValue",
20+
"keyExpectedValue": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration.TransitEncryption should be enabled", [name, j]),
21+
"keyActualValue": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration.TransitEncryption is disabled", [name, j]),
22+
"searchLine": common_lib.build_search_line(["Resources", name, "Properties", "Volumes", j, "EFSVolumeConfiguration", "TransitEncryption"], []),
2123
}
2224
}
2325

24-
is_transit_encryption_disabled(taskDefinition, name) = res {
25-
volume := taskDefinition.Properties.Volumes[j]
26-
common_lib.valid_key(volume.EFSVolumeConfiguration, "TransitEncryption")
27-
volume.EFSVolumeConfiguration.TransitEncryption != "ENABLED"
28-
res := {
29-
"sk": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration.TransitEncryption", [name, j]),
30-
"issueT": "IncorrectValue",
31-
"kev": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration.TransitEncryption should be enabled", [name, j]),
32-
"kav": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration.TransitEncryption is disabled", [name, j]),
33-
"sl" : common_lib.build_search_line(["Resources",name,"Properties","Volumes", j,"EFSVolumeConfiguration","TransitEncryption"], []),
34-
}
35-
} else = res {
36-
volume := taskDefinition.Properties.Volumes[j]
37-
efsVolumeConfiguration := volume.EFSVolumeConfiguration
38-
not common_lib.valid_key(efsVolumeConfiguration, "TransitEncryption")
39-
res := {
40-
"sk": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration", [name, j]),
41-
"issueT": "MissingAttribute",
42-
"kev": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration.TransitEncryption should be defined", [name, j]),
43-
"kav": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration.TransitEncryption is not defined (set to DISABLED by default)", [name, j]),
44-
"sl" : common_lib.build_search_line(["Resources",name,"Properties","Volumes", j,"EFSVolumeConfiguration"], []),
45-
}
46-
} else = res {
47-
volume := taskDefinition.Properties.Volumes[j]
48-
not common_lib.valid_key(volume, "EFSVolumeConfiguration")
49-
res := {
50-
"sk": sprintf("Resources.%s.Properties.Volumes[%d]", [name, j]),
51-
"issueT": "MissingAttribute",
52-
"kev": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration should be defined", [name, j]),
53-
"kav": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration is not defined", [name, j]),
54-
"sl" : common_lib.build_search_line(["Resources",name,"Properties","Volumes", j], []),
26+
CxPolicy[result] {
27+
resource_list := input.document[i].Resources
28+
resource := resource_list[name]
29+
resource.Type == "AWS::ECS::TaskDefinition"
30+
volume := resource.Properties.Volumes[j]
31+
efsVolumeConfiguration := volume.EFSVolumeConfiguration
32+
efsVolumeConfiguration != null
33+
not common_lib.valid_key(efsVolumeConfiguration, "TransitEncryption")
34+
35+
result := {
36+
"documentId": input.document[i].id,
37+
"resourceType": resource.Type,
38+
"resourceName": cf_lib.get_resource_name(resource, name),
39+
"searchKey": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration", [name, j]),
40+
"issueType": "MissingAttribute",
41+
"keyExpectedValue": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration.TransitEncryption should be defined", [name, j]),
42+
"keyActualValue": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration.TransitEncryption is not defined (set to DISABLED by default)", [name, j]),
43+
"searchLine": common_lib.build_search_line(["Resources", name, "Properties", "Volumes", j, "EFSVolumeConfiguration"], []),
5544
}
56-
} else = res {
57-
not common_lib.valid_key(taskDefinition.Properties, "Volumes")
58-
res := {
59-
"sk": sprintf("Resources.%s.Properties", [name]),
60-
"issueT": "MissingAttribute",
61-
"kev": sprintf("Resources.%s.Properties.Volumes should be defined", [name]),
62-
"kav": sprintf("Resources.%s.Properties.Volumes is not defined", [name]),
63-
"sl" : common_lib.build_search_line(["Resources",name,"Properties"], []),
45+
}
46+
47+
CxPolicy[result] {
48+
resource_list := input.document[i].Resources
49+
resource := resource_list[name]
50+
resource.Type == "AWS::ECS::TaskDefinition"
51+
volume := resource.Properties.Volumes[j]
52+
not common_lib.valid_key(volume, "EFSVolumeConfiguration")
53+
54+
result := {
55+
"documentId": input.document[i].id,
56+
"resourceType": resource.Type,
57+
"resourceName": cf_lib.get_resource_name(resource, name),
58+
"searchKey": sprintf("Resources.%s.Properties.Volumes[%d]", [name, j]),
59+
"issueType": "MissingAttribute",
60+
"keyExpectedValue": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration should be defined", [name, j]),
61+
"keyActualValue": sprintf("Resources.%s.Properties.Volumes[%d].EFSVolumeConfiguration is not defined", [name, j]),
62+
"searchLine": common_lib.build_search_line(["Resources", name, "Properties", "Volumes", j], []),
6463
}
65-
}
64+
}
6665

66+
CxPolicy[result] {
67+
resource_list := input.document[i].Resources
68+
resource := resource_list[name]
69+
resource.Type == "AWS::ECS::TaskDefinition"
70+
not common_lib.valid_key(resource.Properties, "Volumes")
71+
72+
result := {
73+
"documentId": input.document[i].id,
74+
"resourceType": resource.Type,
75+
"resourceName": cf_lib.get_resource_name(resource, name),
76+
"searchKey": sprintf("Resources.%s.Properties", [name]),
77+
"issueType": "MissingAttribute",
78+
"keyExpectedValue": sprintf("Resources.%s.Properties.Volumes should be defined", [name]),
79+
"keyActualValue": sprintf("Resources.%s.Properties.Volumes is not defined", [name]),
80+
"searchLine": common_lib.build_search_line(["Resources", name, "Properties"], []),
81+
}
82+
}

‎assets/queries/cloudFormation/aws/efs_volume_with_disabled_transit_encryption/test/negative3.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"AWSTemplateFormatVersion": "2010-09-09",
3+
"Description": "Multiple volumes properly configured with TransitEncryption ENABLED",
4+
"Resources": {
5+
"taskdefinition": {
6+
"Type": "AWS::ECS::TaskDefinition",
7+
"Properties": {
8+
"ContainerDefinitions": [
9+
{
10+
"Name": "container1",
11+
"Image": "amazonlinux:2",
12+
"MountPoints": [
13+
{
14+
"SourceVolume": "efs-vol-1",
15+
"ContainerPath": "/mount/efs1"
16+
},
17+
{
18+
"SourceVolume": "efs-vol-2",
19+
"ContainerPath": "/mount/efs2"
20+
}
21+
]
22+
}
23+
],
24+
"Volumes": [
25+
{
26+
"Name": "efs-vol-1",
27+
"EFSVolumeConfiguration": {
28+
"FileSystemId": "fs-1234",
29+
"RootDirectory": "/path/to/data1",
30+
"TransitEncryption": "ENABLED",
31+
"TransitEncryptionPort": 2999
32+
}
33+
},
34+
{
35+
"Name": "efs-vol-2",
36+
"EFSVolumeConfiguration": {
37+
"FileSystemId": "fs-5678",
38+
"RootDirectory": "/path/to/data2",
39+
"TransitEncryption": "ENABLED",
40+
"TransitEncryptionPort": 2999
41+
}
42+
}
43+
]
44+
}
45+
}
46+
}
47+
}
48+

‎assets/queries/cloudFormation/aws/efs_volume_with_disabled_transit_encryption/test/negative3.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
Resources:
2+
taskdefinition:
3+
Type: AWS::ECS::TaskDefinition
4+
Properties:
5+
ContainerDefinitions:
6+
-
7+
Name: "container1"
8+
Image: "amazonlinux:2"
9+
MountPoints:
10+
-
11+
SourceVolume: "efs-vol-1"
12+
ContainerPath: "/mount/efs1"
13+
-
14+
SourceVolume: "efs-vol-2"
15+
ContainerPath: "/mount/efs2"
16+
Volumes:
17+
-
18+
Name: "efs-vol-1"
19+
EFSVolumeConfiguration:
20+
FileSystemId: "fs-1234"
21+
RootDirectory: "/path/to/data1"
22+
TransitEncryption: ENABLED
23+
TransitEncryptionPort: 2999
24+
-
25+
Name: "efs-vol-2"
26+
EFSVolumeConfiguration:
27+
FileSystemId: "fs-5678"
28+
RootDirectory: "/path/to/data2"
29+
TransitEncryption: ENABLED
30+
TransitEncryptionPort: 2999
31+

‎assets/queries/cloudFormation/aws/efs_volume_with_disabled_transit_encryption/test/positive1.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
Resources:
2+
taskdefinition:
3+
Type: AWS::ECS::TaskDefinition
4+
Properties:
5+
ContainerDefinitions:
6+
-
7+
Name: "container-using-efs"
8+
Image: "amazonlinux:2"
9+
EntryPoint:
10+
- "sh"
11+
- "-c"
12+
Command:
13+
- "ls -la /mount/efs"
14+
MountPoints:
15+
-
16+
SourceVolume: "myEfsVolume"
17+
ContainerPath: "/mount/efs"
18+
ReadOnly: true
19+
Volumes:
20+
-
21+
Name: "myEfsVolume"
22+
EFSVolumeConfiguration:
23+
FileSystemId: "fs-1234"
24+
RootDirectory: "/path/to/my/data"
25+
TransitEncryptionPort: 10
26+
TransitEncryption: DISABLED
27+

‎assets/queries/cloudFormation/aws/efs_volume_with_disabled_transit_encryption/test/positive10.json‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
{
2+
"AWSTemplateFormatVersion": "2010-09-09",
3+
"Description": "Multiple volumes missing TransitEncryption",
4+
"Resources": {
5+
"taskdefinition": {
6+
"Type": "AWS::ECS::TaskDefinition",
7+
"Properties": {
8+
"ContainerDefinitions": [
9+
{
10+
"Name": "container1",
11+
"Image": "amazonlinux:2",
12+
"MountPoints": [
13+
{
14+
"SourceVolume": "efs-vol-1",
15+
"ContainerPath": "/mount/efs1"
16+
},
17+
{
18+
"SourceVolume": "efs-vol-2",
19+
"ContainerPath": "/mount/efs2"
20+
}
21+
]
22+
}
23+
],
24+
"Volumes": [
25+
{
26+
"Name": "efs-vol-1",
27+
"EFSVolumeConfiguration": {
28+
"FileSystemId": "fs-1234",
29+
"RootDirectory": "/path/to/data1",
30+
"TransitEncryptionPort": 2999
31+
}
32+
},
33+
{
34+
"Name": "efs-vol-2",
35+
"EFSVolumeConfiguration": {
36+
"FileSystemId": "fs-5678",
37+
"RootDirectory": "/path/to/data2",
38+
"TransitEncryptionPort": 2999
39+
}
40+
}
41+
]
42+
}
43+
}
44+
}
45+
}
46+

‎assets/queries/cloudFormation/aws/efs_volume_with_disabled_transit_encryption/test/positive10.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
Resources:
2+
taskdefinition:
3+
Type: AWS::ECS::TaskDefinition
4+
Properties:
5+
ContainerDefinitions:
6+
-
7+
Name: "container1"
8+
Image: "amazonlinux:2"
9+
MountPoints:
10+
-
11+
SourceVolume: "efs-vol-1"
12+
ContainerPath: "/mount/efs1"
13+
-
14+
SourceVolume: "efs-vol-2"
15+
ContainerPath: "/mount/efs2"
16+
Volumes:
17+
-
18+
Name: "efs-vol-1"
19+
EFSVolumeConfiguration:
20+
FileSystemId: "fs-1234"
21+
RootDirectory: "/path/to/data1"
22+
TransitEncryptionPort: 2999
23+
-
24+
Name: "efs-vol-2"
25+
EFSVolumeConfiguration:
26+
FileSystemId: "fs-5678"
27+
RootDirectory: "/path/to/data2"
28+
TransitEncryptionPort: 2999
29+

‎assets/queries/cloudFormation/aws/efs_volume_with_disabled_transit_encryption/test/positive11.json‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"AWSTemplateFormatVersion": "2010-09-09",
3+
"Description": "Multiple volumes missing EFSVolumeConfiguration",
4+
"Resources": {
5+
"taskdefinition": {
6+
"Type": "AWS::ECS::TaskDefinition",
7+
"Properties": {
8+
"ContainerDefinitions": [
9+
{
10+
"Name": "container1",
11+
"Image": "amazonlinux:2",
12+
"MountPoints": [
13+
{
14+
"SourceVolume": "docker-vol-1",
15+
"ContainerPath": "/mount/docker1"
16+
},
17+
{
18+
"SourceVolume": "docker-vol-2",
19+
"ContainerPath": "/mount/docker2"
20+
}
21+
]
22+
}
23+
],
24+
"Volumes": [
25+
{
26+
"Name": "docker-vol-1",
27+
"Host": {
28+
"SourcePath": "/var/lib/docker/vfs/dir1/"
29+
}
30+
},
31+
{
32+
"Name": "docker-vol-2",
33+
"Host": {
34+
"SourcePath": "/var/lib/docker/vfs/dir2/"
35+
}
36+
}
37+
]
38+
}
39+
}
40+
}
41+
}
42+

‎assets/queries/cloudFormation/aws/efs_volume_with_disabled_transit_encryption/test/positive11.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
Resources:
2+
taskdefinition:
3+
Type: AWS::ECS::TaskDefinition
4+
Properties:
5+
ContainerDefinitions:
6+
-
7+
Name: "container1"
8+
Image: "amazonlinux:2"
9+
MountPoints:
10+
-
11+
SourceVolume: "docker-vol-1"
12+
ContainerPath: "/mount/docker1"
13+
-
14+
SourceVolume: "docker-vol-2"
15+
ContainerPath: "/mount/docker2"
16+
Volumes:
17+
-
18+
Name: "docker-vol-1"
19+
Host:
20+
SourcePath: "/var/lib/docker/vfs/dir1/"
21+
-
22+
Name: "docker-vol-2"
23+
Host:
24+
SourcePath: "/var/lib/docker/vfs/dir2/"
25+

0 commit comments

Comments
 (0)