add: lambda adapter

avd_docs/aws/iam/AVD-AWS-0342/docs.md

@@ -1,10 +1,8 @@
 
-In iam:PassRole the service carrying out the actions is "provided" a role by the calling principal and implicitly takes on that role to carry out the actions (instead of executing sts:AssumeRole).
-       The privileges attached to the role are distinct from those of the primary ordering the action and may even be larger and can cause security issues.
-
+Ensures any IAM pass role attched to roles are flagged and warned.
 
 ### Impact
-Compromise on security of aws resources.
+<!-- Add Impact here -->
 
 <!-- DO NOT CHANGE -->
 {{ remediationActions }}

avd_docs/azure/container/AVD-AZU-0041/Terraform.md

@@ -3,9 +3,13 @@ Limit the access to the API server to a limited IP range
 
 ```hcl
  resource "azurerm_kubernetes_cluster" "good_example" {
-     api_server_authorized_ip_ranges = [
+	api_server_access_profile {
+		authorized_ip_ranges = [
  		"1.2.3.4/32"
  	]
+
+	}
+
  }
 
 ```

avd_docs/dockerfile/general/AVD-DS-0029/docs.md

@@ -1,14 +1,13 @@
 
-Do not install packages because they may be needed, install them only if you require them.
+'apt-get' install should use '--no-install-recommends' to minimize image size.
 
 ### Impact
-
-Image will increase substantially in size without `--no-install-recommends` for `apt-get install`.
+<!-- Add Impact here -->
 
 <!-- DO NOT CHANGE -->
 {{ remediationActions }}
 
 ### Links
 - https://docs.docker.com/develop/develop-images/dockerfile_best-practices/
-- https://ubuntu.com/blog/we-reduced-our-docker-images-by-60-with-no-install-recommends
+
 

internal/adapters/cloud/aws/lambda/adapt.go

@@ -79,6 +79,58 @@ func (a *adapter) adaptFunction(function types.FunctionConfiguration) (*lambda.F
 		tracingMode = string(function.TracingConfig.Mode)
 	}
 
+	var functionarn string
+	if function.FunctionArn != nil {
+		functionarn = *function.FunctionArn
+	}
+
+	var funcname string
+	if function.FunctionName != nil {
+		funcname = *function.FunctionName
+	}
+
+	var vpcid string
+	if function.VpcConfig != nil && function.VpcConfig.VpcId != nil {
+		vpcid = *function.VpcConfig.VpcId
+	}
+
+	var variables map[string]string
+	if function.Environment != nil && function.Environment.Variables != nil {
+		variables = function.Environment.Variables
+	}
+
+	var runtime string
+	if function.Runtime.Values() != nil {
+		runtime = string(function.Runtime)
+	}
+
+	val, err := a.getPermissions(function, metadata)
+	if err != nil {
+		return nil, err
+	}
+
+	return &lambda.Function{
+		Metadata: metadata,
+		Tracing: lambda.Tracing{
+			Metadata: metadata,
+			Mode:     defsecTypes.String(tracingMode, metadata),
+		},
+		Permissions:  val,
+		FunctionName: defsecTypes.String(funcname, metadata),
+		FunctionArn:  defsecTypes.String(functionarn, metadata),
+		VpcConfig: lambda.VpcConfig{
+			Metadata: metadata,
+			VpcId:    defsecTypes.String(vpcid, metadata),
+		},
+		Runtime: defsecTypes.String(runtime, metadata),
+		Envrionment: lambda.Environment{
+			Metadata:  metadata,
+			Variables: defsecTypes.Map(variables, metadata),
+		},
+	}, nil
+}
+
+func (a *adapter) getPermissions(function types.FunctionConfiguration, metadata defsecTypes.Metadata) ([]lambda.Permission, error) {
 	var permissions []lambda.Permission
 	if output, err := a.api.GetPolicy(a.Context(), &lambdaapi.GetPolicyInput{
 		FunctionName: function.FunctionName,
@@ -123,13 +175,5 @@ func (a *adapter) adaptFunction(function types.FunctionConfiguration) (*lambda.F
 			})
 		}
 	}
-
-	return &lambda.Function{
-		Metadata: metadata,
-		Tracing: lambda.Tracing{
-			Metadata: metadata,
-			Mode:     defsecTypes.String(tracingMode, metadata),
-		},
-		Permissions: permissions,
-	}, nil
+	return permissions, nil
 }

internal/adapters/cloudformation/aws/lambda/function.go

@@ -12,13 +12,26 @@ func getFunctions(ctx parser.FileContext) (functions []lambda.Function) {
 
 	for _, r := range functionResources {
 
+		var variables map[string]string
+
 		function := lambda.Function{
 			Metadata: r.Metadata(),
 			Tracing: lambda.Tracing{
 				Metadata: r.Metadata(),
 				Mode:     types.StringDefault("PassThrough", r.Metadata()),
 			},
-			Permissions: getPermissions(r, ctx),
+			Permissions:  getPermissions(r, ctx),
+			FunctionName: r.GetStringProperty("FunctionName"),
+			FunctionArn:  r.GetStringProperty("Arn"),
+			VpcConfig: lambda.VpcConfig{
+				Metadata: r.Metadata(),
+				VpcId:    types.String("", r.Metadata()),
+			},
+			Envrionment: lambda.Environment{
+				Metadata:  r.Metadata(),
+				Variables: types.Map(variables, r.Metadata()),
+			},
+			Runtime: r.GetStringProperty("Runtime"),
 		}
 
 		if prop := r.GetProperty("TracingConfig"); prop.IsNotNil() {

internal/adapters/terraform/aws/lambda/adapt.go

@@ -39,7 +39,10 @@ func (a *adapter) adaptFunctions(modules terraform.Modules) []lambda.Function {
 				Metadata: defsecTypes.NewUnmanagedMetadata(),
 				Mode:     defsecTypes.StringDefault("", defsecTypes.NewUnmanagedMetadata()),
 			},
-			Permissions: nil,
+			FunctionName: defsecTypes.StringDefault("", defsecTypes.NewUnmanagedMetadata()),
+			FunctionArn:  defsecTypes.StringDefault("", defsecTypes.NewUnmanagedMetadata()),
+			Runtime:      defsecTypes.StringDefault("", defsecTypes.NewUnmanagedMetadata()),
+			Permissions:  nil,
 		}
 		for _, permission := range orphanResources {
 			orphanage.Permissions = append(orphanage.Permissions, a.adaptPermission(permission))
@@ -52,6 +55,7 @@ func (a *adapter) adaptFunctions(modules terraform.Modules) []lambda.Function {
 
 func (a *adapter) adaptFunction(function *terraform.Block, modules terraform.Modules, orphans terraform.ResourceIDResolutions) lambda.Function {
 	var permissions []lambda.Permission
+
 	for _, module := range modules {
 		for _, p := range module.GetResourcesByType("aws_lambda_permission") {
 			if referencedBlock, err := module.GetReferencedBlock(p.GetAttribute("function_name"), p); err == nil && referencedBlock == function {
@@ -62,9 +66,20 @@ func (a *adapter) adaptFunction(function *terraform.Block, modules terraform.Mod
 	}
 
 	return lambda.Function{
-		Metadata:    function.GetMetadata(),
-		Tracing:     a.adaptTracing(function),
-		Permissions: permissions,
+		Metadata:     function.GetMetadata(),
+		Tracing:      a.adaptTracing(function),
+		Permissions:  permissions,
+		FunctionName: function.GetAttribute("function_name").AsStringValueOrDefault("", function),
+		FunctionArn:  function.GetAttribute("arn").AsStringValueOrDefault("", function),
+		VpcConfig: lambda.VpcConfig{
+			Metadata: function.GetMetadata(),
+			VpcId:    defsecTypes.String("", function.GetMetadata()),
+		},
+		Runtime: function.GetAttribute("runtime").AsStringValueOrDefault("", function),
+		Envrionment: lambda.Environment{
+			Metadata:  function.GetMetadata(),
+			Variables: defsecTypes.MapDefault(nil, function.GetMetadata()),
+		},
 	}
 }
 

internal/adapters/terraform/aws/lambda/adapt_test.go

@@ -44,7 +44,10 @@ func Test_Adapt(t *testing.T) {
 			expected: lambda.Lambda{
 				Functions: []lambda.Function{
 					{
-						Metadata: defsecTypes.NewTestMetadata(),
+						Metadata:     defsecTypes.NewTestMetadata(),
+						FunctionName: defsecTypes.String("lambda_function_name", defsecTypes.NewTestMetadata()),
+						FunctionArn:  defsecTypes.String("", defsecTypes.NewTestMetadata()),
+						Runtime:      defsecTypes.String("nodejs12.x", defsecTypes.NewTestMetadata()),
 						Tracing: lambda.Tracing{
 							Metadata: defsecTypes.NewTestMetadata(),
 							Mode:     defsecTypes.String("Passthrough", defsecTypes.NewTestMetadata()),
@@ -56,6 +59,10 @@ func Test_Adapt(t *testing.T) {
 								SourceARN: defsecTypes.String("default", defsecTypes.NewTestMetadata()),
 							},
 						},
+						Envrionment: lambda.Environment{
+							Metadata:  defsecTypes.NewTestMetadata(),
+							Variables: defsecTypes.MapDefault(nil, defsecTypes.NewTestMetadata()),
+						},
 					},
 				},
 			},

pkg/providers/aws/lambda/lambda.go

@@ -9,9 +9,24 @@ type Lambda struct {
 }
 
 type Function struct {
-	Metadata    defsecTypes.Metadata
-	Tracing     Tracing
-	Permissions []Permission
+	Metadata     defsecTypes.Metadata
+	Tracing      Tracing
+	Permissions  []Permission
+	FunctionName defsecTypes.StringValue
+	FunctionArn  defsecTypes.StringValue
+	VpcConfig    VpcConfig
+	Runtime      defsecTypes.StringValue
+	Envrionment  Environment
+}
+
+type Environment struct {
+	Metadata  defsecTypes.Metadata
+	Variables defsecTypes.MapValue
+}
+
+type VpcConfig struct {
+	Metadata defsecTypes.Metadata
+	VpcId    defsecTypes.StringValue
 }
 
 const (

pkg/rego/schemas/cloud.json

@@ -2134,19 +2134,48 @@
         }
       }
     },
+    "github.aaakk.us.kg.aquasecurity.defsec.pkg.providers.aws.lambda.Environment": {
+      "type": "object",
+      "properties": {
+        "variables": {
+          "type": "object",
+          "$ref": "#/definitions/github.aaakk.us.kg.aquasecurity.defsec.pkg.types.MapValue"
+        }
+      }
+    },
     "github.aaakk.us.kg.aquasecurity.defsec.pkg.providers.aws.lambda.Function": {
       "type": "object",
       "properties": {
+        "envrionment": {
+          "type": "object",
+          "$ref": "#/definitions/github.aaakk.us.kg.aquasecurity.defsec.pkg.providers.aws.lambda.Environment"
+        },
+        "functionarn": {
+          "type": "object",
+          "$ref": "#/definitions/github.aaakk.us.kg.aquasecurity.defsec.pkg.types.StringValue"
+        },
+        "functionname": {
+          "type": "object",
+          "$ref": "#/definitions/github.aaakk.us.kg.aquasecurity.defsec.pkg.types.StringValue"
+        },
         "permissions": {
           "type": "array",
           "items": {
             "type": "object",
             "$ref": "#/definitions/github.aaakk.us.kg.aquasecurity.defsec.pkg.providers.aws.lambda.Permission"
           }
         },
+        "runtime": {
+          "type": "object",
+          "$ref": "#/definitions/github.aaakk.us.kg.aquasecurity.defsec.pkg.types.StringValue"
+        },
         "tracing": {
           "type": "object",
           "$ref": "#/definitions/github.aaakk.us.kg.aquasecurity.defsec.pkg.providers.aws.lambda.Tracing"
+        },
+        "vpcconfig": {
+          "type": "object",
+          "$ref": "#/definitions/github.aaakk.us.kg.aquasecurity.defsec.pkg.providers.aws.lambda.VpcConfig"
         }
       }
     },
@@ -2184,6 +2213,15 @@
         }
       }
     },
+    "github.aaakk.us.kg.aquasecurity.defsec.pkg.providers.aws.lambda.VpcConfig": {
+      "type": "object",
+      "properties": {
+        "vpcid": {
+          "type": "object",
+          "$ref": "#/definitions/github.aaakk.us.kg.aquasecurity.defsec.pkg.types.StringValue"
+        }
+      }
+    },
     "github.aaakk.us.kg.aquasecurity.defsec.pkg.providers.aws.mq.Broker": {
       "type": "object",
       "properties": {