Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor(checks): migrate Oracle to Rego #182

Merged
merged 2 commits into from
Aug 22, 2024
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
refactor(checks): migrate Oracle to Rego
Signed-off-by: Nikita Pivkin <[email protected]>
nikpivkin committed Aug 21, 2024
commit d597b1ae866943ff19d8f0c9e9c1ffef6c68bead
3 changes: 2 additions & 1 deletion avd_docs/oracle/compute/AVD-OCI-0001/docs.md
Original file line number Diff line number Diff line change
@@ -3,8 +3,9 @@ Compute instance requests an IP reservation from a public pool

The compute instance has the ability to be reached from outside, you might want to sonder the use of a non public IP.


### Impact
The compute instance has the ability to be reached from outside
<!-- Add Impact here -->

<!-- DO NOT CHANGE -->
{{ remediationActions }}
3 changes: 2 additions & 1 deletion checks/cloud/oracle/compute/no_public_ip.go
Original file line number Diff line number Diff line change
@@ -27,7 +27,8 @@ The compute instance has the ability to be reached from outside, you might want
Links: terraformNoPublicIpLinks,
RemediationMarkdown: terraformNoPublicIpRemediationMarkdown,
},
Severity: severity.Critical,
Severity: severity.Critical,
Deprecated: true,
},
func(s *state.State) (results scan.Results) {
for _, reservation := range s.Oracle.Compute.AddressReservations {
41 changes: 41 additions & 0 deletions checks/cloud/oracle/compute/no_public_ip.rego
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
# METADATA
# title: Compute instance requests an IP reservation from a public pool
# description: |
# Compute instance requests an IP reservation from a public pool
#
# The compute instance has the ability to be reached from outside, you might want to sonder the use of a non public IP.
# scope: package
# schemas:
# - input: schema["cloud"]
# custom:
# id: AVD-OCI-0001
# avd_id: AVD-OCI-0001
# provider: oracle
# service: compute
# severity: CRITICAL
# short_code: no-public-ip
# recommended_action: Reconsider the use of an public IP
# input:
# selector:
# - type: cloud
# subtypes:
# - service: compute
# provider: oracle
# terraform:
# links:
# - https://registry.terraform.io/providers/hashicorp/opc/latest/docs/resources/opc_compute_ip_address_reservation
# - https://registry.terraform.io/providers/hashicorp/opc/latest/docs/resources/opc_compute_instance
# good_examples: checks/cloud/oracle/compute/no_public_ip.tf.go
# bad_examples: checks/cloud/oracle/compute/no_public_ip.tf.go
package builtin.oracle.compute.oracle0001

import rego.v1

deny contains res if {
some reservation in input.oracle.compute.addressreservations

# TODO: future improvement: we need to see what this IP is used for before flagging
reservation.pool.value == "public-ippool"

res := result.new("Reservation made for public IP address.", reservation.pool)
}
65 changes: 0 additions & 65 deletions checks/cloud/oracle/compute/no_public_ip_test.go

This file was deleted.

20 changes: 20 additions & 0 deletions checks/cloud/oracle/compute/no_public_ip_test.rego
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
package builtin.oracle.compute.oracle0001_test

import rego.v1

import data.builtin.oracle.compute.oracle0001 as check
import data.lib.test

test_deny_pool_is_public if {
inp := {"oracle": {"compute": {"addressreservations": [{"pool": {"value": "public-ippool"}}]}}}

res := check.deny with input as inp
count(res) == 1
}

test_allow_pool_is_cloud if {
inp := {"oracle": {"compute": {"addressreservations": [{"pool": {"value": "cloud-ippool"}}]}}}

res := check.deny with input as inp
res == set()
}