From 272514f53c971b63973d2e825920f299348ea70d Mon Sep 17 00:00:00 2001 From: Andre Pereira <219305055+cx-andre-pereira@users.noreply.github.com> Date: Mon, 17 Nov 2025 12:12:25 +0000 Subject: [PATCH 1/7] initial implementation --- .../metadata.json | 14 ++++ .../query.rego | 66 +++++++++++++++++++ .../test/negative1.tf | 31 +++++++++ .../test/negative2.tf | 9 +++ .../test/negative3.tf | 9 +++ .../test/positive1.tf | 39 +++++++++++ .../test/positive2.tf | 9 +++ .../test/positive3.tf | 9 +++ .../test/positive_expected_result.json | 32 +++++++++ .../terraform_azure.yaml | 4 ++ 10 files changed, 222 insertions(+) create mode 100644 assets/queries/terraform/azure/virtual_machine_without_managed_disk/metadata.json create mode 100644 assets/queries/terraform/azure/virtual_machine_without_managed_disk/query.rego create mode 100644 assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/negative1.tf create mode 100644 assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/negative2.tf create mode 100644 assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/negative3.tf create mode 100644 assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive1.tf create mode 100644 assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive2.tf create mode 100644 assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive3.tf create mode 100644 assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive_expected_result.json diff --git a/assets/queries/terraform/azure/virtual_machine_without_managed_disk/metadata.json b/assets/queries/terraform/azure/virtual_machine_without_managed_disk/metadata.json new file mode 100644 index 00000000000..c4a405f1866 --- /dev/null +++ b/assets/queries/terraform/azure/virtual_machine_without_managed_disk/metadata.json @@ -0,0 +1,14 @@ +{ + "id": "0536c90c-714e-4184-991e-3fed8d8b7b46", + "queryName": "Beta - Virtual Machine Without Managed Disk", + "severity": "MEDIUM", + "category": "Resource Management", + "descriptionText": "Virtual machine resources should set a managed disk for encryption, resilience and reduction of costs", + "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_virtual_machine", + "platform": "Terraform", + "descriptionID": "0536c90c", + "cloudProvider": "azure", + "cwe": "922", + "riskScore": "3.0", + "experimental": "true" +} diff --git a/assets/queries/terraform/azure/virtual_machine_without_managed_disk/query.rego b/assets/queries/terraform/azure/virtual_machine_without_managed_disk/query.rego new file mode 100644 index 00000000000..c5f5f0117f0 --- /dev/null +++ b/assets/queries/terraform/azure/virtual_machine_without_managed_disk/query.rego @@ -0,0 +1,66 @@ +package Cx + +import data.generic.common as common_lib +import data.generic.terraform as tf_lib + +types := {"azurerm_virtual_machine", "azurerm_linux_virtual_machine", "azurerm_windows_virtual_machine"} + +CxPolicy[result] { + resource := input.document[i].resource[types[t]][name] + + results := get_results(resource, name, types[t]) + + result := { + "documentId": input.document[i].id, + "resourceType": types[t], + "resourceName": tf_lib.get_resource_name(resource, name), + "searchKey": results.searchKey, + "issueType": results.issueType, + "keyExpectedValue": results.keyExpectedValue, + "keyActualValue": results.keyActualValue, + "searchLine": results.searchLine + } +} + +get_results(resource, name, type) = results { + type == "azurerm_virtual_machine" + not common_lib.valid_key(resource, "storage_os_disk") + results := { + "searchKey": sprintf("azurerm_virtual_machine[%s]", [name]), + "issueType": "MissingAttribute", + "keyExpectedValue": sprintf("'azurerm_virtual_machine[%s].storage_os_disk' should be defined and not null", [name]), + "keyActualValue": sprintf("'azurerm_virtual_machine[%s].storage_os_disk' is undefined or null", [name]), + "searchLine": common_lib.build_search_line(["resource", "azurerm_virtual_machine", name], []) + } +} else = results { + type == "azurerm_virtual_machine" + common_lib.valid_key(resource.storage_os_disk, "vhd_uri") + results := { + "searchKey": sprintf("azurerm_virtual_machine[%s].storage_os_disk.vhd_uri", [name]), + "issueType": "IncorrectValue", + "keyExpectedValue": sprintf("'azurerm_virtual_machine[%s].storage_os_disk.vhd_uri' should not be set", [name]), + "keyActualValue": sprintf("'azurerm_virtual_machine[%s].storage_os_disk.vhd_uri' is set", [name]), + "searchLine": common_lib.build_search_line(["resource", "azurerm_virtual_machine", name, "storage_os_disk", "vhd_uri"], []) + } +} else = results { + type == "azurerm_virtual_machine" + not common_lib.valid_key(resource.storage_os_disk, "managed_disk_id") + not common_lib.valid_key(resource.storage_os_disk, "managed_disk_type") + results := { + "searchKey": sprintf("azurerm_virtual_machine[%s].storage_os_disk", [name]), + "issueType": "MissingAttribute", + "keyExpectedValue": sprintf("'azurerm_virtual_machine[%s].storage_os_disk' should define a 'managed_disk_id' or 'managed_disk_type'", [name]), + "keyActualValue": sprintf("'azurerm_virtual_machine[%s].storage_os_disk' does not define or sets to null 'managed_disk_id' and 'managed_disk_type'", [name]), + "searchLine": common_lib.build_search_line(["resource", "azurerm_virtual_machine", name, "storage_os_disk"], []) + } +} else = results { + type != "azurerm_virtual_machine" + not common_lib.valid_key(resource, "os_managed_disk_id") + results := { + "searchKey": sprintf("%s[%s]", [type, name]), + "issueType": "MissingAttribute", + "keyExpectedValue": sprintf("'%s[%s].os_managed_disk_id' should be defined and not null", [type, name]), + "keyActualValue": sprintf("'%s[%s].os_managed_disk_id' is undefined or null", [type, name]), + "searchLine": common_lib.build_search_line(["resource", type, name], []) + } +} diff --git a/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/negative1.tf b/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/negative1.tf new file mode 100644 index 00000000000..424dec8481d --- /dev/null +++ b/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/negative1.tf @@ -0,0 +1,31 @@ +resource "azurerm_virtual_machine" "main" { + name = "${var.prefix}-vm" + location = azurerm_resource_group.example.location + resource_group_name = azurerm_resource_group.example.name + network_interface_ids = [azurerm_network_interface.main.id] + vm_size = "Standard_DS1_v2" + + + storage_os_disk { + name = "myosdisk1" + caching = "ReadWrite" + create_option = "FromImage" + managed_disk_type = "Standard_LRS" + } +} + +resource "azurerm_virtual_machine" "main" { + name = "${var.prefix}-vm" + location = azurerm_resource_group.example.location + resource_group_name = azurerm_resource_group.example.name + network_interface_ids = [azurerm_network_interface.main.id] + vm_size = "Standard_DS1_v2" + + + storage_os_disk { + name = "myosdisk1" + caching = "ReadWrite" + create_option = "Attach" + managed_disk_id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.Compute/disks/myManagedDisk" + } +} diff --git a/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/negative2.tf b/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/negative2.tf new file mode 100644 index 00000000000..5e07fd2491f --- /dev/null +++ b/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/negative2.tf @@ -0,0 +1,9 @@ +resource "azurerm_linux_virtual_machine" "negative2" { + name = "negative2-machine" + resource_group_name = azurerm_resource_group.negative2.name + location = azurerm_resource_group.negative2.location + size = "Standard_F2" + admin_username = "adminuser" + + os_managed_disk_id = azurerm_managed_disk.negative2.id +} diff --git a/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/negative3.tf b/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/negative3.tf new file mode 100644 index 00000000000..ad5ffba1e68 --- /dev/null +++ b/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/negative3.tf @@ -0,0 +1,9 @@ +resource "azurerm_windows_virtual_machine" "negative3" { + name = "negative3-machine" + resource_group_name = azurerm_resource_group.negative3.name + location = azurerm_resource_group.negative3.location + size = "Standard_F2" + admin_username = "adminuser" + + os_managed_disk_id = azurerm_managed_disk.negative3.id +} diff --git a/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive1.tf b/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive1.tf new file mode 100644 index 00000000000..698246ed068 --- /dev/null +++ b/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive1.tf @@ -0,0 +1,39 @@ +resource "azurerm_virtual_machine" "positive1" { + name = "${var.prefix}-vm" + location = azurerm_resource_group.positive1.location + resource_group_name = azurerm_resource_group.positive1.name + network_interface_ids = [azurerm_network_interface.main.id] + vm_size = "Standard_DS1_v2" + + # missing "storage_os_disk" (tecnically required) +} + +resource "azurerm_virtual_machine" "positive2" { + name = "${var.prefix}-vm" + location = azurerm_resource_group.positive2.location + resource_group_name = azurerm_resource_group.positive2.name + network_interface_ids = [azurerm_network_interface.main.id] + vm_size = "Standard_DS1_v2" + + storage_os_disk { + name = "myosdisk1" + create_option = "FromImage" + vhd_uri = "https://.blob.core.windows.net//.vhd" + # unmanaged disk + } +} + +resource "azurerm_virtual_machine" "positive3" { + name = "${var.prefix}-vm" + location = azurerm_resource_group.positive3.location + resource_group_name = azurerm_resource_group.positive3.name + network_interface_ids = [azurerm_network_interface.main.id] + vm_size = "Standard_DS1_v2" + + + storage_os_disk { + name = "myosdisk1" + create_option = "FromImage" + # missing managed_disk_type + } +} diff --git a/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive2.tf b/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive2.tf new file mode 100644 index 00000000000..7f4e383ade5 --- /dev/null +++ b/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive2.tf @@ -0,0 +1,9 @@ +resource "azurerm_linux_virtual_machine" "positive2" { + name = "positive2-machine" + resource_group_name = azurerm_resource_group.positive2.name + location = azurerm_resource_group.positive2.location + size = "Standard_F2" + admin_username = "adminuser" + + # missing os_managed_disk_id +} diff --git a/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive3.tf b/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive3.tf new file mode 100644 index 00000000000..d4271363318 --- /dev/null +++ b/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive3.tf @@ -0,0 +1,9 @@ +resource "azurerm_windows_virtual_machine" "positive3" { + name = "positive3-machine" + resource_group_name = azurerm_resource_group.positive3.name + location = azurerm_resource_group.positive3.location + size = "Standard_F2" + admin_username = "adminuser" + + # missing os_managed_disk_id +} diff --git a/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive_expected_result.json b/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive_expected_result.json new file mode 100644 index 00000000000..c5bc4c9870b --- /dev/null +++ b/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive_expected_result.json @@ -0,0 +1,32 @@ +[ + { + "queryName": "Beta - Virtual Machine Without Managed Disk", + "severity": "MEDIUM", + "line": 1, + "filename": "positive1.tf" + }, + { + "queryName": "Beta - Virtual Machine Without Managed Disk", + "severity": "MEDIUM", + "line": 21, + "filename": "positive1.tf" + }, + { + "queryName": "Beta - Virtual Machine Without Managed Disk", + "severity": "MEDIUM", + "line": 34, + "filename": "positive1.tf" + }, + { + "queryName": "Beta - Virtual Machine Without Managed Disk", + "severity": "MEDIUM", + "line": 1, + "filename": "positive2.tf" + }, + { + "queryName": "Beta - Virtual Machine Without Managed Disk", + "severity": "MEDIUM", + "line": 1, + "filename": "positive3.tf" + } +] diff --git a/assets/similarityID_transition/terraform_azure.yaml b/assets/similarityID_transition/terraform_azure.yaml index 407c810f4d1..9e14058cada 100644 --- a/assets/similarityID_transition/terraform_azure.yaml +++ b/assets/similarityID_transition/terraform_azure.yaml @@ -3,3 +3,7 @@ similarityIDChangeList: queryName: Sensitive Port Is Exposed To Wide Private Network observations: "" change: 5 + - queryId: 0536c90c-714e-4184-991e-3fed8d8b7b46 + queryName: Beta - Virtual Machine Without Managed Disk + observations: "" + change: 2 From a8aaa9acece8540f80dc6f888ce4c97fd6022887 Mon Sep 17 00:00:00 2001 From: Andre Pereira <219305055+cx-andre-pereira@users.noreply.github.com> Date: Mon, 17 Nov 2025 13:57:55 +0000 Subject: [PATCH 2/7] minor change --- .../virtual_machine_without_managed_disk/test/positive1.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive1.tf b/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive1.tf index 698246ed068..8cc500b063c 100644 --- a/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive1.tf +++ b/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive1.tf @@ -34,6 +34,6 @@ resource "azurerm_virtual_machine" "positive3" { storage_os_disk { name = "myosdisk1" create_option = "FromImage" - # missing managed_disk_type + # missing managed_disk_type/managed_disk_id } } From 9b7b9bd8630c27634891f6e6f7afb3c5d0ceb483 Mon Sep 17 00:00:00 2001 From: Andre Pereira <219305055+cx-andre-pereira@users.noreply.github.com> Date: Mon, 17 Nov 2025 14:02:07 +0000 Subject: [PATCH 3/7] renamed query --- .../metadata.json | 2 +- .../query.rego | 0 .../test/negative1.tf | 2 -- .../test/negative2.tf | 0 .../test/negative3.tf | 0 .../test/positive1.tf | 0 .../test/positive2.tf | 0 .../test/positive3.tf | 0 .../test/positive_expected_result.json | 10 +++++----- assets/similarityID_transition/terraform_azure.yaml | 2 +- 10 files changed, 7 insertions(+), 9 deletions(-) rename assets/queries/terraform/azure/{virtual_machine_without_managed_disk => vm_without_managed_disk}/metadata.json (89%) rename assets/queries/terraform/azure/{virtual_machine_without_managed_disk => vm_without_managed_disk}/query.rego (100%) rename assets/queries/terraform/azure/{virtual_machine_without_managed_disk => vm_without_managed_disk}/test/negative1.tf (99%) rename assets/queries/terraform/azure/{virtual_machine_without_managed_disk => vm_without_managed_disk}/test/negative2.tf (100%) rename assets/queries/terraform/azure/{virtual_machine_without_managed_disk => vm_without_managed_disk}/test/negative3.tf (100%) rename assets/queries/terraform/azure/{virtual_machine_without_managed_disk => vm_without_managed_disk}/test/positive1.tf (100%) rename assets/queries/terraform/azure/{virtual_machine_without_managed_disk => vm_without_managed_disk}/test/positive2.tf (100%) rename assets/queries/terraform/azure/{virtual_machine_without_managed_disk => vm_without_managed_disk}/test/positive3.tf (100%) rename assets/queries/terraform/azure/{virtual_machine_without_managed_disk => vm_without_managed_disk}/test/positive_expected_result.json (56%) diff --git a/assets/queries/terraform/azure/virtual_machine_without_managed_disk/metadata.json b/assets/queries/terraform/azure/vm_without_managed_disk/metadata.json similarity index 89% rename from assets/queries/terraform/azure/virtual_machine_without_managed_disk/metadata.json rename to assets/queries/terraform/azure/vm_without_managed_disk/metadata.json index c4a405f1866..378a38d331e 100644 --- a/assets/queries/terraform/azure/virtual_machine_without_managed_disk/metadata.json +++ b/assets/queries/terraform/azure/vm_without_managed_disk/metadata.json @@ -1,6 +1,6 @@ { "id": "0536c90c-714e-4184-991e-3fed8d8b7b46", - "queryName": "Beta - Virtual Machine Without Managed Disk", + "queryName": "Beta - VM Without Managed Disk", "severity": "MEDIUM", "category": "Resource Management", "descriptionText": "Virtual machine resources should set a managed disk for encryption, resilience and reduction of costs", diff --git a/assets/queries/terraform/azure/virtual_machine_without_managed_disk/query.rego b/assets/queries/terraform/azure/vm_without_managed_disk/query.rego similarity index 100% rename from assets/queries/terraform/azure/virtual_machine_without_managed_disk/query.rego rename to assets/queries/terraform/azure/vm_without_managed_disk/query.rego diff --git a/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/negative1.tf b/assets/queries/terraform/azure/vm_without_managed_disk/test/negative1.tf similarity index 99% rename from assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/negative1.tf rename to assets/queries/terraform/azure/vm_without_managed_disk/test/negative1.tf index 424dec8481d..a59e49ff0f6 100644 --- a/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/negative1.tf +++ b/assets/queries/terraform/azure/vm_without_managed_disk/test/negative1.tf @@ -5,7 +5,6 @@ resource "azurerm_virtual_machine" "main" { network_interface_ids = [azurerm_network_interface.main.id] vm_size = "Standard_DS1_v2" - storage_os_disk { name = "myosdisk1" caching = "ReadWrite" @@ -21,7 +20,6 @@ resource "azurerm_virtual_machine" "main" { network_interface_ids = [azurerm_network_interface.main.id] vm_size = "Standard_DS1_v2" - storage_os_disk { name = "myosdisk1" caching = "ReadWrite" diff --git a/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/negative2.tf b/assets/queries/terraform/azure/vm_without_managed_disk/test/negative2.tf similarity index 100% rename from assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/negative2.tf rename to assets/queries/terraform/azure/vm_without_managed_disk/test/negative2.tf diff --git a/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/negative3.tf b/assets/queries/terraform/azure/vm_without_managed_disk/test/negative3.tf similarity index 100% rename from assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/negative3.tf rename to assets/queries/terraform/azure/vm_without_managed_disk/test/negative3.tf diff --git a/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive1.tf b/assets/queries/terraform/azure/vm_without_managed_disk/test/positive1.tf similarity index 100% rename from assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive1.tf rename to assets/queries/terraform/azure/vm_without_managed_disk/test/positive1.tf diff --git a/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive2.tf b/assets/queries/terraform/azure/vm_without_managed_disk/test/positive2.tf similarity index 100% rename from assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive2.tf rename to assets/queries/terraform/azure/vm_without_managed_disk/test/positive2.tf diff --git a/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive3.tf b/assets/queries/terraform/azure/vm_without_managed_disk/test/positive3.tf similarity index 100% rename from assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive3.tf rename to assets/queries/terraform/azure/vm_without_managed_disk/test/positive3.tf diff --git a/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive_expected_result.json b/assets/queries/terraform/azure/vm_without_managed_disk/test/positive_expected_result.json similarity index 56% rename from assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive_expected_result.json rename to assets/queries/terraform/azure/vm_without_managed_disk/test/positive_expected_result.json index c5bc4c9870b..a21daea1b79 100644 --- a/assets/queries/terraform/azure/virtual_machine_without_managed_disk/test/positive_expected_result.json +++ b/assets/queries/terraform/azure/vm_without_managed_disk/test/positive_expected_result.json @@ -1,30 +1,30 @@ [ { - "queryName": "Beta - Virtual Machine Without Managed Disk", + "queryName": "Beta - VM Without Managed Disk", "severity": "MEDIUM", "line": 1, "filename": "positive1.tf" }, { - "queryName": "Beta - Virtual Machine Without Managed Disk", + "queryName": "Beta - VM Without Managed Disk", "severity": "MEDIUM", "line": 21, "filename": "positive1.tf" }, { - "queryName": "Beta - Virtual Machine Without Managed Disk", + "queryName": "Beta - VM Without Managed Disk", "severity": "MEDIUM", "line": 34, "filename": "positive1.tf" }, { - "queryName": "Beta - Virtual Machine Without Managed Disk", + "queryName": "Beta - VM Without Managed Disk", "severity": "MEDIUM", "line": 1, "filename": "positive2.tf" }, { - "queryName": "Beta - Virtual Machine Without Managed Disk", + "queryName": "Beta - VM Without Managed Disk", "severity": "MEDIUM", "line": 1, "filename": "positive3.tf" diff --git a/assets/similarityID_transition/terraform_azure.yaml b/assets/similarityID_transition/terraform_azure.yaml index 9e14058cada..d5b1c99352c 100644 --- a/assets/similarityID_transition/terraform_azure.yaml +++ b/assets/similarityID_transition/terraform_azure.yaml @@ -4,6 +4,6 @@ similarityIDChangeList: observations: "" change: 5 - queryId: 0536c90c-714e-4184-991e-3fed8d8b7b46 - queryName: Beta - Virtual Machine Without Managed Disk + queryName: Beta - VM Without Managed Disk observations: "" change: 2 From d4a4addde0eac26ec21ac0efc67c2cc4f490c6e2 Mon Sep 17 00:00:00 2001 From: Andre Pereira <219305055+cx-andre-pereira@users.noreply.github.com> Date: Thu, 11 Dec 2025 16:51:30 +0000 Subject: [PATCH 4/7] fix sample resource naming --- .../vm_without_managed_disk/test/negative1.tf | 14 +++++++------- .../vm_without_managed_disk/test/negative4.tf | 8 ++++---- .../vm_without_managed_disk/test/positive1.tf | 12 ++++++------ .../vm_without_managed_disk/test/positive4.tf | 2 +- .../query.rego | 6 +++++- .../test/negative.tf | 12 ++++++++++++ 6 files changed, 35 insertions(+), 19 deletions(-) diff --git a/assets/queries/terraform/azure/vm_without_managed_disk/test/negative1.tf b/assets/queries/terraform/azure/vm_without_managed_disk/test/negative1.tf index a59e49ff0f6..d897629fb5f 100644 --- a/assets/queries/terraform/azure/vm_without_managed_disk/test/negative1.tf +++ b/assets/queries/terraform/azure/vm_without_managed_disk/test/negative1.tf @@ -1,7 +1,7 @@ -resource "azurerm_virtual_machine" "main" { +resource "azurerm_virtual_machine" "negative1_1" { name = "${var.prefix}-vm" - location = azurerm_resource_group.example.location - resource_group_name = azurerm_resource_group.example.name + location = azurerm_resource_group.negative1_1.location + resource_group_name = azurerm_resource_group.negative1_1.name network_interface_ids = [azurerm_network_interface.main.id] vm_size = "Standard_DS1_v2" @@ -13,11 +13,11 @@ resource "azurerm_virtual_machine" "main" { } } -resource "azurerm_virtual_machine" "main" { +resource "azurerm_virtual_machine" "negative1_2" { name = "${var.prefix}-vm" - location = azurerm_resource_group.example.location - resource_group_name = azurerm_resource_group.example.name - network_interface_ids = [azurerm_network_interface.main.id] + location = azurerm_resource_group.negative1_2.location + resource_group_name = azurerm_resource_group.negative1_2.name + network_interface_ids = [azurerm_network_interface.negative1_2.id] vm_size = "Standard_DS1_v2" storage_os_disk { diff --git a/assets/queries/terraform/azure/vm_without_managed_disk/test/negative4.tf b/assets/queries/terraform/azure/vm_without_managed_disk/test/negative4.tf index 766671d3998..5cf7860c06e 100644 --- a/assets/queries/terraform/azure/vm_without_managed_disk/test/negative4.tf +++ b/assets/queries/terraform/azure/vm_without_managed_disk/test/negative4.tf @@ -1,7 +1,7 @@ -resource "azurerm_virtual_machine_scale_set" "negative5" { - name = "vmss-ssd-negative5" - location = azurerm_resource_group.negative5.location - resource_group_name = azurerm_resource_group.negative5.name +resource "azurerm_virtual_machine_scale_set" "negative4" { + name = "vmss-ssd-negative4" + location = azurerm_resource_group.negative4.location + resource_group_name = azurerm_resource_group.negative4.name upgrade_policy_mode = "Manual" storage_profile_os_disk { diff --git a/assets/queries/terraform/azure/vm_without_managed_disk/test/positive1.tf b/assets/queries/terraform/azure/vm_without_managed_disk/test/positive1.tf index 8cc500b063c..faf57da658a 100644 --- a/assets/queries/terraform/azure/vm_without_managed_disk/test/positive1.tf +++ b/assets/queries/terraform/azure/vm_without_managed_disk/test/positive1.tf @@ -8,10 +8,10 @@ resource "azurerm_virtual_machine" "positive1" { # missing "storage_os_disk" (tecnically required) } -resource "azurerm_virtual_machine" "positive2" { +resource "azurerm_virtual_machine" "positive1_2" { name = "${var.prefix}-vm" - location = azurerm_resource_group.positive2.location - resource_group_name = azurerm_resource_group.positive2.name + location = azurerm_resource_group.positive1_2.location + resource_group_name = azurerm_resource_group.positive1_2.name network_interface_ids = [azurerm_network_interface.main.id] vm_size = "Standard_DS1_v2" @@ -23,10 +23,10 @@ resource "azurerm_virtual_machine" "positive2" { } } -resource "azurerm_virtual_machine" "positive3" { +resource "azurerm_virtual_machine" "positive1_3" { name = "${var.prefix}-vm" - location = azurerm_resource_group.positive3.location - resource_group_name = azurerm_resource_group.positive3.name + location = azurerm_resource_group.positive1_3.location + resource_group_name = azurerm_resource_group.positive1_3.name network_interface_ids = [azurerm_network_interface.main.id] vm_size = "Standard_DS1_v2" diff --git a/assets/queries/terraform/azure/vm_without_managed_disk/test/positive4.tf b/assets/queries/terraform/azure/vm_without_managed_disk/test/positive4.tf index 2f1409a790a..702de1dd6fc 100644 --- a/assets/queries/terraform/azure/vm_without_managed_disk/test/positive4.tf +++ b/assets/queries/terraform/azure/vm_without_managed_disk/test/positive4.tf @@ -23,7 +23,7 @@ resource "azurerm_virtual_machine_scale_set" "positive4_2" { storage_profile_os_disk { caching = "ReadOnly" create_option = "FromImage" - os_type = "Linux" # Required when using `image` + os_type = "Linux" # Required when using "image" image = "https://mystorageaccount.blob.core.windows.net/system/Microsoft.Compute/Images/custom-os-image/osDisk.vhd" # image instead of "managed_disk_type" } diff --git a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego index a210f11a472..88d4d2e1a5f 100644 --- a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego +++ b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego @@ -23,6 +23,7 @@ CxPolicy[result] { get_results(resource, name) = results { not common_lib.valid_key(resource, "settings") + not common_lib.valid_key(resource, "clone") results := { "searchKey": sprintf("google_sql_database_instance[%s]", [name]), @@ -30,9 +31,9 @@ get_results(resource, name) = results { "keyExpectedValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' should be defined and set 'log_connections' to 'on'", [name]), "keyActualValue": sprintf("'google_sql_database_instance[%s].settings' is undefined or null", [name]), "searchLine": common_lib.build_search_line(["resource", "google_sql_database_instance", name], []) - } } else = results { + common_lib.valid_key(resource, "settings") not common_lib.valid_key(resource.settings, "database_flags") results := { @@ -44,6 +45,7 @@ get_results(resource, name) = results { } } else = results { + common_lib.valid_key(resource, "settings") not has_flag(resource.settings.database_flags) results := { @@ -55,6 +57,7 @@ get_results(resource, name) = results { } } else = results { # array + common_lib.valid_key(resource, "settings") resource.settings.database_flags[x].name == "log_connections" resource.settings.database_flags[x].value != "on" @@ -66,6 +69,7 @@ get_results(resource, name) = results { "searchLine": common_lib.build_search_line(["resource", "google_sql_database_instance", name, "settings", "database_flags", x, "name"], []) } } else = results { # single object + common_lib.valid_key(resource, "settings") resource.settings.database_flags.name == "log_connections" resource.settings.database_flags.value != "on" diff --git a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf index 77fb0fbc8f3..e675594ea2c 100644 --- a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf +++ b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf @@ -47,3 +47,15 @@ resource "google_sql_database_instance" "negative_3" { # Single object support } # Has flag set to "on" } } + +resource "google_sql_database_instance" "negative_4" { + name = "main-instance" + database_version = "MYSQL_8_0" # Is not a POSTGRES instance + region = "us-central1" + + # Missing "settings" but "clone" is set + + clone { + source_instance_name = google_sql_database_instance.source.name + } +} From 2ebb491661d87dd6103f6ea274ee3fd185dea8f5 Mon Sep 17 00:00:00 2001 From: Andre Pereira <219305055+cx-andre-pereira@users.noreply.github.com> Date: Thu, 11 Dec 2025 16:56:12 +0000 Subject: [PATCH 5/7] fix files --- .../vm_without_managed_disk/test/negative1.tf | 14 +++++++------- .../vm_without_managed_disk/test/negative4.tf | 8 ++++---- .../vm_without_managed_disk/test/positive1.tf | 12 ++++++------ .../vm_without_managed_disk/test/positive4.tf | 2 +- 4 files changed, 18 insertions(+), 18 deletions(-) diff --git a/assets/queries/terraform/azure/vm_without_managed_disk/test/negative1.tf b/assets/queries/terraform/azure/vm_without_managed_disk/test/negative1.tf index a59e49ff0f6..d897629fb5f 100644 --- a/assets/queries/terraform/azure/vm_without_managed_disk/test/negative1.tf +++ b/assets/queries/terraform/azure/vm_without_managed_disk/test/negative1.tf @@ -1,7 +1,7 @@ -resource "azurerm_virtual_machine" "main" { +resource "azurerm_virtual_machine" "negative1_1" { name = "${var.prefix}-vm" - location = azurerm_resource_group.example.location - resource_group_name = azurerm_resource_group.example.name + location = azurerm_resource_group.negative1_1.location + resource_group_name = azurerm_resource_group.negative1_1.name network_interface_ids = [azurerm_network_interface.main.id] vm_size = "Standard_DS1_v2" @@ -13,11 +13,11 @@ resource "azurerm_virtual_machine" "main" { } } -resource "azurerm_virtual_machine" "main" { +resource "azurerm_virtual_machine" "negative1_2" { name = "${var.prefix}-vm" - location = azurerm_resource_group.example.location - resource_group_name = azurerm_resource_group.example.name - network_interface_ids = [azurerm_network_interface.main.id] + location = azurerm_resource_group.negative1_2.location + resource_group_name = azurerm_resource_group.negative1_2.name + network_interface_ids = [azurerm_network_interface.negative1_2.id] vm_size = "Standard_DS1_v2" storage_os_disk { diff --git a/assets/queries/terraform/azure/vm_without_managed_disk/test/negative4.tf b/assets/queries/terraform/azure/vm_without_managed_disk/test/negative4.tf index 766671d3998..5cf7860c06e 100644 --- a/assets/queries/terraform/azure/vm_without_managed_disk/test/negative4.tf +++ b/assets/queries/terraform/azure/vm_without_managed_disk/test/negative4.tf @@ -1,7 +1,7 @@ -resource "azurerm_virtual_machine_scale_set" "negative5" { - name = "vmss-ssd-negative5" - location = azurerm_resource_group.negative5.location - resource_group_name = azurerm_resource_group.negative5.name +resource "azurerm_virtual_machine_scale_set" "negative4" { + name = "vmss-ssd-negative4" + location = azurerm_resource_group.negative4.location + resource_group_name = azurerm_resource_group.negative4.name upgrade_policy_mode = "Manual" storage_profile_os_disk { diff --git a/assets/queries/terraform/azure/vm_without_managed_disk/test/positive1.tf b/assets/queries/terraform/azure/vm_without_managed_disk/test/positive1.tf index 8cc500b063c..faf57da658a 100644 --- a/assets/queries/terraform/azure/vm_without_managed_disk/test/positive1.tf +++ b/assets/queries/terraform/azure/vm_without_managed_disk/test/positive1.tf @@ -8,10 +8,10 @@ resource "azurerm_virtual_machine" "positive1" { # missing "storage_os_disk" (tecnically required) } -resource "azurerm_virtual_machine" "positive2" { +resource "azurerm_virtual_machine" "positive1_2" { name = "${var.prefix}-vm" - location = azurerm_resource_group.positive2.location - resource_group_name = azurerm_resource_group.positive2.name + location = azurerm_resource_group.positive1_2.location + resource_group_name = azurerm_resource_group.positive1_2.name network_interface_ids = [azurerm_network_interface.main.id] vm_size = "Standard_DS1_v2" @@ -23,10 +23,10 @@ resource "azurerm_virtual_machine" "positive2" { } } -resource "azurerm_virtual_machine" "positive3" { +resource "azurerm_virtual_machine" "positive1_3" { name = "${var.prefix}-vm" - location = azurerm_resource_group.positive3.location - resource_group_name = azurerm_resource_group.positive3.name + location = azurerm_resource_group.positive1_3.location + resource_group_name = azurerm_resource_group.positive1_3.name network_interface_ids = [azurerm_network_interface.main.id] vm_size = "Standard_DS1_v2" diff --git a/assets/queries/terraform/azure/vm_without_managed_disk/test/positive4.tf b/assets/queries/terraform/azure/vm_without_managed_disk/test/positive4.tf index 2f1409a790a..702de1dd6fc 100644 --- a/assets/queries/terraform/azure/vm_without_managed_disk/test/positive4.tf +++ b/assets/queries/terraform/azure/vm_without_managed_disk/test/positive4.tf @@ -23,7 +23,7 @@ resource "azurerm_virtual_machine_scale_set" "positive4_2" { storage_profile_os_disk { caching = "ReadOnly" create_option = "FromImage" - os_type = "Linux" # Required when using `image` + os_type = "Linux" # Required when using "image" image = "https://mystorageaccount.blob.core.windows.net/system/Microsoft.Compute/Images/custom-os-image/osDisk.vhd" # image instead of "managed_disk_type" } From 56c91248b7f964b77ba4da1e1254319b9e65d33e Mon Sep 17 00:00:00 2001 From: Andre Pereira <219305055+cx-andre-pereira@users.noreply.github.com> Date: Thu, 11 Dec 2025 17:01:36 +0000 Subject: [PATCH 6/7] files fix 2 --- .../query.rego | 1 - .../query.rego | 5 ----- .../test/negative.tf | 12 ------------ assets/similarityID_transition/terraform_azure.yaml | 5 ++--- 4 files changed, 2 insertions(+), 21 deletions(-) diff --git a/assets/queries/terraform/gcp/sql_db_instance_without_centralized_logging/query.rego b/assets/queries/terraform/gcp/sql_db_instance_without_centralized_logging/query.rego index 910fb8e80f2..eada0eea798 100644 --- a/assets/queries/terraform/gcp/sql_db_instance_without_centralized_logging/query.rego +++ b/assets/queries/terraform/gcp/sql_db_instance_without_centralized_logging/query.rego @@ -6,7 +6,6 @@ import data.generic.terraform as tf_lib CxPolicy[result] { resource := input.document[i].resource.google_sql_database_instance[name] - not common_lib.valid_key(resource, "clone") contains(resource.database_version, "POSTGRES") results := get_results(resource, name) diff --git a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego index 88d4d2e1a5f..e572444101e 100644 --- a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego +++ b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego @@ -23,7 +23,6 @@ CxPolicy[result] { get_results(resource, name) = results { not common_lib.valid_key(resource, "settings") - not common_lib.valid_key(resource, "clone") results := { "searchKey": sprintf("google_sql_database_instance[%s]", [name]), @@ -33,7 +32,6 @@ get_results(resource, name) = results { "searchLine": common_lib.build_search_line(["resource", "google_sql_database_instance", name], []) } } else = results { - common_lib.valid_key(resource, "settings") not common_lib.valid_key(resource.settings, "database_flags") results := { @@ -45,7 +43,6 @@ get_results(resource, name) = results { } } else = results { - common_lib.valid_key(resource, "settings") not has_flag(resource.settings.database_flags) results := { @@ -57,7 +54,6 @@ get_results(resource, name) = results { } } else = results { # array - common_lib.valid_key(resource, "settings") resource.settings.database_flags[x].name == "log_connections" resource.settings.database_flags[x].value != "on" @@ -69,7 +65,6 @@ get_results(resource, name) = results { "searchLine": common_lib.build_search_line(["resource", "google_sql_database_instance", name, "settings", "database_flags", x, "name"], []) } } else = results { # single object - common_lib.valid_key(resource, "settings") resource.settings.database_flags.name == "log_connections" resource.settings.database_flags.value != "on" diff --git a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf index e675594ea2c..77fb0fbc8f3 100644 --- a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf +++ b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/test/negative.tf @@ -47,15 +47,3 @@ resource "google_sql_database_instance" "negative_3" { # Single object support } # Has flag set to "on" } } - -resource "google_sql_database_instance" "negative_4" { - name = "main-instance" - database_version = "MYSQL_8_0" # Is not a POSTGRES instance - region = "us-central1" - - # Missing "settings" but "clone" is set - - clone { - source_instance_name = google_sql_database_instance.source.name - } -} diff --git a/assets/similarityID_transition/terraform_azure.yaml b/assets/similarityID_transition/terraform_azure.yaml index f0c57f588d6..9e9c7e357e3 100644 --- a/assets/similarityID_transition/terraform_azure.yaml +++ b/assets/similarityID_transition/terraform_azure.yaml @@ -3,10 +3,10 @@ similarityIDChangeList: queryName: Sensitive Port Is Exposed To Wide Private Network observations: "" change: 5 -<<<<<<< HEAD - queryId: 0536c90c-714e-4184-991e-3fed8d8b7b46 queryName: Beta - VM Without Managed Disk -======= + observations: "" + change: 2 - queryId: b373043c-f3bf-40db-b67a-c982732c7781 queryName: Beta - Recovery Services Vault Without Soft Delete observations: "" @@ -117,7 +117,6 @@ similarityIDChangeList: change: 2 - queryId: 05d6b52e-11ca-453d-bb3a-21c7c853ee92 queryName: Beta - Databricks Workspace Using Default Virtual Network ->>>>>>> c1d990bc4b42d0a70a31f6fc3a3f0f547964f4e6 observations: "" change: 2 - queryId: 41d7989b-3be2-4081-8c79-cf903dd174c5 From 237286489500990104ce81a05cc978668a25f95e Mon Sep 17 00:00:00 2001 From: Andre Pereira <219305055+cx-andre-pereira@users.noreply.github.com> Date: Thu, 11 Dec 2025 17:02:27 +0000 Subject: [PATCH 7/7] final fix files --- .../gcp/sql_db_instance_without_connections_logging/query.rego | 1 + 1 file changed, 1 insertion(+) diff --git a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego index e572444101e..a210f11a472 100644 --- a/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego +++ b/assets/queries/terraform/gcp/sql_db_instance_without_connections_logging/query.rego @@ -30,6 +30,7 @@ get_results(resource, name) = results { "keyExpectedValue": sprintf("'google_sql_database_instance[%s].settings.database_flags' should be defined and set 'log_connections' to 'on'", [name]), "keyActualValue": sprintf("'google_sql_database_instance[%s].settings' is undefined or null", [name]), "searchLine": common_lib.build_search_line(["resource", "google_sql_database_instance", name], []) + } } else = results { not common_lib.valid_key(resource.settings, "database_flags")