Repository: aquasecurity/tfsec (go)

Issue:
kubernetes_service_account automount_service_account_token bool triggers general-secrets-sensitive-in-attribute rule
When defining `kubernetes_service_account`, if you set the `automount_service_account_token` explicitly, it triggers the `general-secrets-sensitive-in-attribute` rule.

Example resource def:

```
resource "kubernetes_service_account" "rule_breaker" {
  metadata {
    name      = var.name
    namespace = var.namespace
  }
  automount_service_account_token = "true"
}
```

Example output: 

```
  Result 1

  [general-secrets-sensitive-in-attribute][CRITICAL] Block 'module.aws_serviceaccount:kubernetes_service_account.rule_breaker[0]' includes a potentially sensitive attribute which is defined within the project.
.../main.tf:81


      78 |     }
      79 |   }
      80 |
      81 |   automount_service_account_token = "true"    string: "true"
      82 | }
      83 |

  Legacy ID:  GEN003
  Impact:     Block attribute could be leaking secrets
  Resolution: Don't include sensitive data in blocks
```

I think this should be whitelisted. We're not actually passing a secret with this attribute, it's just a boolean.


Pull request:
Whitelist kubernetes_service_account token
Resolves #1316

Patch:
diff --git a/internal/app/tfsec/rules/general/secrets/sensitive_in_attribute_rule.go b/internal/app/tfsec/rules/general/secrets/sensitive_in_attribute_rule.go
index a79d3d3c6..7e343ad7d 100644
--- a/internal/app/tfsec/rules/general/secrets/sensitive_in_attribute_rule.go
+++ b/internal/app/tfsec/rules/general/secrets/sensitive_in_attribute_rule.go
@@ -42,6 +42,10 @@ var sensitiveWhitelist = []struct {
 		Resource:  "vault_pki_secret_backend_cert",
 		Attribute: "private_key_format",
 	},
+	{
+		Resource:  "kubernetes_service_account",
+		Attribute: "automount_service_account_token",
+	},
 }
 
 func init() {
@@ -63,7 +67,7 @@ func init() {
  }
  
  resource "evil_corp" "good_example" {
- 	root_password = var.passwordx
+ 	root_password = var.password
  }
  `},
 		Base: secrets.CheckNotExposed,


Test patch:
diff --git a/internal/app/tfsec/rules/general/secrets/sensitive_in_attribute_rule_test.go b/internal/app/tfsec/rules/general/secrets/sensitive_in_attribute_rule_test.go
index 2077cbf8e..a6a095e3e 100644
--- a/internal/app/tfsec/rules/general/secrets/sensitive_in_attribute_rule_test.go
+++ b/internal/app/tfsec/rules/general/secrets/sensitive_in_attribute_rule_test.go
@@ -72,6 +72,19 @@ resource "vault_pki_secret_backend_cert" "server_cert" {
   private_key_format = "pkcs8"
 }
 
+            `,
+			mustExcludeResultCode: expectedCode,
+		},
+		{
+			name: "kubernetes_service_account automount_service_account_token",
+			source: `
+resource "kubernetes_service_account" "rule_breaker" {
+  metadata {
+    name      = var.name
+    namespace = var.namespace
+  }
+  automount_service_account_token = "true"
+}
             `,
 			mustExcludeResultCode: expectedCode,
 		},