fix(terraform): Handle new resource type for CKV_GCP_73 #7023
Conversation
tsmithv11
requested a deployment
to
scan-security
GitHub Actions
Waiting
tsmithv11
requested a deployment
to
scan-security
GitHub Actions
Waiting
| if expr.get("expression") == "evaluatePreconfiguredExpr('cve-canary')": | ||
| if rule.get("action") == "allow": | ||
| return CheckResult.FAILED | ||
| if rule.get("preview"): |
There was a problem hiding this comment.
From what I saw if preview=True we do not enforce the action, so why are we failing here?
Also, perhaps before the action check we need to first check the preview since in case it's True the action won't kick in.
There was a problem hiding this comment.
According to the docs, when preview is used, the action is not enforced, so essentially blocking for this WAF rule is not enforced is my understanding. Let me know if you read it differently.
Good call on preview first. I will update that.
There was a problem hiding this comment.
Do you know what would happen if preview=True and action=allow? Would that mean allow isn't enforced so we block? It's an edge case for which I haven't found a direct answer in the docs. In any case, if we cannot find a clear answer for it, just failing for preview=True sounds like a good enough solution.
There was a problem hiding this comment.
The docs say preview mode just logs traffic without enforcing, so I think if preview=True it never blocks.
https://cloud.google.com/armor/docs/security-policy-overview?utm_source=chatgpt.com#preview_mode
tsmithv11
requested a deployment
to
scan-security
GitHub Actions
Waiting
* fix * Fix flake8 * max feedback - preview first
User description
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
Description
Handles google_compute_security_policy_rule
Checklist:
Generated description
Below is a concise technical summary of the changes proposed in this PR:
Enhances the CloudArmorWAFACLCVE202144228 check to handle the new
google_compute_security_policy_ruleresource type. Modifies thecheckmethod to evaluate both inline rules and separate rule resources. Updates test cases to cover the new scenarios, including passing and failing cases for the new resource type.Modified files (1)
Latest Contributors(2)
Modified files (2)
Latest Contributors(2)