feat: add the occurrences field

[nikpivkin]

Added the occurrences field. Based on this field, we can display a list of occurrences in reports.
See aquasecurity/trivy#4581

Example of json output:

{
  "results": [
    {
      "rule_id": "AVD-AWS-0107",
      "long_id": "aws-ec2-no-public-ingress-sgr",
      "rule_description": "An ingress security group rule allows traffic from /0.",
      "rule_provider": "aws",
      "rule_service": "ec2",
      "impact": "Your port exposed to the internet",
      "resolution": "Set a more restrictive cidr range",
      "links": [
        "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules-reference.html"
      ],
      "description": "Security group rule allows ingress from public internet.",
      "severity": "CRITICAL",
      "warning": false,
      "status": 0,
      "resource": "module.aws-security-groups[\"db1\"]",
      "occurrences": [
        {
          "resource": "aws_security_group_rule.ingress_with_cidr_blocks[0]",
          "filename": "terraform-aws-modules/security-group/aws/main.tf",
          "start_line": 191,
          "end_line": 227
        },
        {
          "resource": "module.aws-security-groups[\"db1\"]",
          "filename": "sg.tf",
          "start_line": 1,
          "end_line": 13
        }
      ],
      "location": {
        "filename": "terraform-aws-modules/security-group/aws/main.tf",
        "start_line": 197,
        "end_line": 204
      }
    }
  ]
}

[nikpivkin]

@simar7 I followed the logic in tfsec and took only the first occurrence in the file, otherwise there will be a conclusion that seems verbose, but on the other hand, more accurate:

"occurrences": [
                                {
                                        "resource": "aws_security_group_rule.ingress_with_cidr_blocks[0]",
                                        "filename": "terraform-aws-modules/security-group/aws/main.tf",
                                        "start_line": 191,
                                        "end_line": 227
                                },
                                {
                                        "resource": "module.aws-security-groups[\"db1\"]",
                                        "filename": "sg.tf",
                                        "start_line": 1,
                                        "end_line": 13
                                }
                        ],

[simar7]

@simar7 I followed the logic in tfsec and took only the first occurrence in the file, otherwise there will be a conclusion that seems verbose, but on the other hand, more accurate:

"occurrences": [
                                {
                                        "resource": "aws_security_group_rule.ingress_with_cidr_blocks[0]",
                                        "filename": "terraform-aws-modules/security-group/aws/main.tf",
                                        "start_line": 191,
                                        "end_line": 227
                                },
                                {
                                        "resource": "module.aws-security-groups[\"db1\"]",
                                        "filename": "sg.tf",
                                        "start_line": 1,
                                        "end_line": 13
                                }
                        ],

could you explain what you mean by first occurrence?

[nikpivkin]

@simar7 For example, if the metadata of the resource will refer to the following sources:

terraform-aws-modules/security-group/aws/main.tf:197-204
terraform-aws-modules/security-group/aws/main.tf:191-227
sg.tf:1-13

tfsec takes only the first occurrence in the file (terraform-aws-modules/security-group/aws/main.tf:197-204), the second is not used for the report

[simar7]

@simar7 For example, if the metadata of the resource will refer to the following sources:

terraform-aws-modules/security-group/aws/main.tf:197-204
terraform-aws-modules/security-group/aws/main.tf:191-227
sg.tf:1-13

tfsec takes only the first occurrence in the file (terraform-aws-modules/security-group/aws/main.tf:197-204), the second is not used for the report

Are they unique misconfigurations? If so, we should report them all at once.

[nikpivkin]

@simar7 No, it refers to one misconfiguration.

[simar7]

@simar7 No, it refers to one misconfiguration.

Got it. So in the table output we will still see one misconfiguration right?

If so, we should include all occurrences that are related to one misconfiguration.

[simar7]

just left one comment around testing this change

[simar7]

Can we add a test for this? We can probably add it in pkg/scanners/cloud/aws/scanner_test.go.

[nikpivkin]

@simar7 How good is this place for the test? this file refers to tests of aws services. Since the method is public and converts the result to another structure, maybe it's worth adding it to pkg/scan/result_test.go?

[nikpivkin]

@simar7 Do you think this will close this issue?

[simar7]

@simar7 Do you think this will close this issue?

Yeah good catch. I think so, it satisfies the ask.