Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] #381

Open
ssodhi-intuit opened this issue Dec 1, 2022 · 0 comments
Open

[BUG] #381

ssodhi-intuit opened this issue Dec 1, 2022 · 0 comments

Comments

@ssodhi-intuit
Copy link

ssodhi-intuit commented Dec 1, 2022

Describe the bug
Regula cli returning incorrect response for terraform files in same directory

How you're running Regula
Please include versions of all relevant tools. Some examples:

  • I'm using Regula v2.10.0 as a CLI tool and my Terraform source code as an input:
regula run /tmp/regula_test/folder3 -i /Users/ssodhi/go/src/github.intuit.com/cloud-ops/policy-engine-v2-policies/buildtime/gcp/tf/google_storage_no_public_access.rego
1. sample_tf_fail.tf

Operating System
macOS Monterey (12.6)

Steps to reproduce

  1. Policy Link to replace "/Users/ssodhi/go/src/github.intuit.com/cloud-ops/policy-engine-v2-policies/buildtime/gcp/tf/google_storage_no_public_access.rego"

  2. Added below terraform files in a directory folder3 and ran the command above:
    a. sample_tf_fail.tf

    data "google_iam_policy" "viewer" {
      binding {
        role = "roles/storage.objectViewer"
        members = [
            "allUsers",
        ]
      }
    }
    resource "google_storage_bucket_iam_policy" "editor" {
      bucket = "${google_storage_bucket.bucket.name}"
      policy_data = "${data.google_iam_policy.viewer.policy_data}"
    }
    resource "google_storage_bucket" "bucket" {
      name = "policyengine-v2-dev-storage-bucket"
      storage_class = "STANDARD"
      location = "EU"
    }
    

    b. sample_tf_pass.tf

    resource "google_storage_bucket" "bucket1" {
      name = "policyengine-v2-dev-storage-bucket"
      storage_class = "STANDARD"
      location = "EU"
    }
    
  3. Response from library:

    {
      "rule_results": [
        {
          "controls": [
            "IS044.1",
            "IS044.2"
          ],
          "families": [
            "IS044.1"
          ],
          "filepath": "folder3/sample_tf_fail.tf",
          "input_type": "tf",
          "provider": "google",
          "resource_id": "google_storage_bucket.bucket",
          "resource_type": "google_storage_bucket",
          "resource_tags": {},
          "rule_description": "Storage buckets should not be anonymously or publicly accessible. Cloud Storage bucket permissions should not be configured to allow 'allUsers' or 'allAuthenticatedUsers' access. These permissions provides broad, public access, which can result in unknown or undesired data access.",
          "rule_id": "gcp_tf_google_storage_no_public_access",
          "rule_message": "",
          "rule_name": "gcp_tf_google_storage_no_public_access",
          "rule_raw_result": false,
          "rule_remediation_doc": "https://github.intuit.com/cloud-ops/ACP-Remediation-Links/blob/master/IS044.1-gcp-google-storage-no-public-access.md",
          "rule_result": "FAIL",
          "rule_severity": "Informational",
          "rule_summary": "Storage buckets should not be anonymously or publicly accessible",
          "source_location": [
            {
              "path": "folder3/sample_tf_fail.tf",
              "line": 13,
              "column": 1
            }
          ]
        },
        {
          "controls": [
            "IS044.1",
            "IS044.2"
          ],
          "families": [
            "IS044.1"
          ],
          "filepath": "folder3/sample_tf_pass.tf",
          "input_type": "tf",
          "provider": "google",
          "resource_id": "google_storage_bucket.bucket1",
          "resource_type": "google_storage_bucket",
          "resource_tags": {},
          "rule_description": "Storage buckets should not be anonymously or publicly accessible. Cloud Storage bucket permissions should not be configured to allow 'allUsers' or 'allAuthenticatedUsers' access. These permissions provides broad, public access, which can result in unknown or undesired data access.",
          "rule_id": "gcp_tf_google_storage_no_public_access",
          "rule_message": "",
          "rule_name": "gcp_tf_google_storage_no_public_access",
          "rule_raw_result": false,
          "rule_remediation_doc": "https://github.intuit.com/cloud-ops/ACP-Remediation-Links/blob/master/IS044.1-gcp-google-storage-no-public-access.md",
          "rule_result": "FAIL",
          "rule_severity": "Informational",
          "rule_summary": "Storage buckets should not be anonymously or publicly accessible",
          "source_location": [
            {
              "path": "folder3/sample_tf_pass.tf",
              "line": 1,
              "column": 1
            }
          ]
        }
      ],
      "summary": {
        "filepaths": [
          "folder3/sample_tf_fail.tf",
          "folder3/sample_tf_pass.tf"
        ],
        "rule_results": {
          "FAIL": 2,
          "PASS": 0,
          "WAIVED": 0
        },
        "severities": {
          "Critical": 0,
          "High": 0,
          "Informational": 2,
          "Low": 0,
          "Medium": 0,
          "Unknown": 0
        }
      }
    }
    ssodhi@macos-C02CJ5YPMD6N pe-policyguard-service % regula run ./folder3 -i /Users/ssodhi/go/src/github.intuit.com/cloud-ops/policy-engine-v2-policies/buildtime/gcp/tf/google_storage_no_public_access.rego --no-built-ins --format json
    
    {
      "rule_results": [
        {
          "controls": [
            "IS044.1",
            "IS044.2"
          ],
          "families": [
            "IS044.1"
          ],
          "filepath": "folder3/sample_tf_fail.tf",
          "input_type": "tf",
          "provider": "google",
          "resource_id": "google_storage_bucket.bucket",
          "resource_type": "google_storage_bucket",
          "resource_tags": {},
          "rule_description": "Storage buckets should not be anonymously or publicly accessible. Cloud Storage bucket permissions should not be configured to allow 'allUsers' or 'allAuthenticatedUsers' access. These permissions provides broad, public access, which can result in unknown or undesired data access.",
          "rule_id": "gcp_tf_google_storage_no_public_access",
          "rule_message": "",
          "rule_name": "gcp_tf_google_storage_no_public_access",
          "rule_raw_result": false,
          "rule_remediation_doc": "https://github.intuit.com/cloud-ops/ACP-Remediation-Links/blob/master/IS044.1-gcp-google-storage-no-public-access.md",
          "rule_result": "FAIL",
          "rule_severity": "Informational",
          "rule_summary": "Storage buckets should not be anonymously or publicly accessible",
          "source_location": [
            {
              "path": "folder3/sample_tf_fail.tf",
              "line": 13,
              "column": 1
            }
          ]
        },
        {
          "controls": [
            "IS044.1",
            "IS044.2"
          ],
          "families": [
            "IS044.1"
          ],
          "filepath": "folder3/sample_tf_pass.tf",
          "input_type": "tf",
          "provider": "google",
          "resource_id": "google_storage_bucket.bucket1",
          "resource_type": "google_storage_bucket",
          "resource_tags": {},
          "rule_description": "Storage buckets should not be anonymously or publicly accessible. Cloud Storage bucket permissions should not be configured to allow 'allUsers' or 'allAuthenticatedUsers' access. These permissions provides broad, public access, which can result in unknown or undesired data access.",
          "rule_id": "gcp_tf_google_storage_no_public_access",
          "rule_message": "",
          "rule_name": "gcp_tf_google_storage_no_public_access",
          "rule_raw_result": false,
          "rule_remediation_doc": "https://github.intuit.com/cloud-ops/ACP-Remediation-Links/blob/master/IS044.1-gcp-google-storage-no-public-access.md",
          "rule_result": "FAIL",
          "rule_severity": "Informational",
          "rule_summary": "Storage buckets should not be anonymously or publicly accessible",
          "source_location": [
            {
              "path": "folder3/sample_tf_pass.tf",
              "line": 1,
              "column": 1
            }
          ]
        }
      ],
      "summary": {
        "filepaths": [
          "folder3/sample_tf_fail.tf",
          "folder3/sample_tf_pass.tf"
        ],
        "rule_results": {
          "FAIL": 2,
          "PASS": 0,
          "WAIVED": 0
        },
        "severities": {
          "Critical": 0,
          "High": 0,
          "Informational": 2,
          "Low": 0,
          "Medium": 0,
          "Unknown": 0
        }
      }
    }
    

Expected Response:
One pass and one fail

IaC Configuration
If applicable, please include a minimal configuration that we can use to reproduce the issue. Valid configurations save us a lot of time in troubleshooting. So please, try using what you post to reproduce the issue to verify that it demonstrates the problem.

Additional context
Add any other context about the problem here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant