feat(query): implements "Beta - Storage Account With Cross Tenant Replication Enabled"

assets/queries/terraform/azure/storage_account_with_cross_tenant_replication_enabled/metadata.json

@@ -0,0 +1,14 @@
+{
+  "id": "50e0a9e3-7360-483c-9873-ba1ea1a7faf8",
+  "queryName": "Beta - Storage Account With Cross Tenant Replication Enabled",
+  "severity": "MEDIUM",
+  "category": "Access Control",
+  "descriptionText": "No resource of type 'azurerm_storage_account' should set 'cross_tenant_replication_enabled' to true, this increases risk of unauthorized data access",
+  "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#cross_tenant_replication_enabled-1",
+  "platform": "Terraform",
+  "descriptionID": "50e0a9e3",
+  "cloudProvider": "azure",
+  "cwe": "281",
+  "riskScore": "3.0",
+  "experimental": "true"
+}

assets/queries/terraform/azure/storage_account_with_cross_tenant_replication_enabled/query.rego

@@ -0,0 +1,21 @@
+package Cx
+
+import data.generic.common as common_lib
+import data.generic.terraform as tf_lib
+
+CxPolicy[result] {
+	resource := input.document[i].resource.azurerm_storage_account[name]
+
+	resource.cross_tenant_replication_enabled == true
+
+	result := {
+		"documentId": input.document[i].id,
+		"resourceType": "azurerm_storage_account",
+		"resourceName": tf_lib.get_resource_name(resource, name),
+		"searchKey" : sprintf("azurerm_storage_account[%s].cross_tenant_replication_enabled", [name]),
+		"issueType": "IncorrectValue",
+		"keyExpectedValue": sprintf("'azurerm_storage_account[%s].cross_tenant_replication_enabled' should be set to false", [name]),
+		"keyActualValue" : sprintf("'azurerm_storage_account[%s].cross_tenant_replication_enabled' is set to true", [name]),
+		"searchLine" : common_lib.build_search_line(["resource", "azurerm_storage_account", name, "cross_tenant_replication_enabled"], [])
+	}
+}

assets/queries/terraform/azure/storage_account_with_cross_tenant_replication_enabled/test/negative.tf

@@ -0,0 +1,21 @@
+resource "azurerm_storage_account" "negative1" {
+  name                     = "negative1"
+  resource_group_name      = "testRG"
+  location                 = "northeurope"
+  account_tier             = "Premium"
+  account_replication_type = "LRS"
+  account_kind             = "FileStorage"
+
+  # missing "cross_tenant_replication_enabled" - defaults to false
+}
+
+resource "azurerm_storage_account" "negative2" {
+  name                     = "negative2"
+  resource_group_name      = "testRG"
+  location                 = "northeurope"
+  account_tier             = "Premium"
+  account_replication_type = "LRS"
+  account_kind             = "FileStorage"
+
+  cross_tenant_replication_enabled = false
+}

assets/queries/terraform/azure/storage_account_with_cross_tenant_replication_enabled/test/positive.tf

@@ -0,0 +1,9 @@
+resource "azurerm_storage_account" "positive1" {
+  name                     = "positive1"
+  resource_group_name      = azurerm_resource_group.positive1.name
+  location                 = azurerm_resource_group.positive1.location
+  account_tier             = "Standard"
+  account_replication_type = "GRS"
+
+  cross_tenant_replication_enabled = true
+}

assets/queries/terraform/azure/storage_account_with_cross_tenant_replication_enabled/test/positive_expected_result.json

@@ -0,0 +1,7 @@
+[
+  {
+    "queryName": "Beta - Storage Account With Cross Tenant Replication Enabled",
+    "severity": "MEDIUM",
+    "line": 8
+  }
+]

assets/similarityID_transition/terraform_azure.yaml

@@ -3,6 +3,10 @@ similarityIDChangeList:
       queryName: Sensitive Port Is Exposed To Wide Private Network
       observations: ""
       change: 5
+    - queryId: 50e0a9e3-7360-483c-9873-ba1ea1a7faf8
+      queryName: Beta - Storage Account With Cross Tenant Replication Enabled
+      observations: ""
+      change: 2
     - queryId: 12ecec8a-7961-48db-b644-86be8845d8fd
       queryName: Beta - Containers Without Soft Delete
       observations: ""