Repository: aquasecurity/tfsec (go)

Issue:
database-retention-period-set does not detect unlimited retention
**Describe the bug**
tfsec [database-retention-period-set](https://aquasecurity.github.io/tfsec/v0.63.1/checks/azure/database/retention-period-set/) check doesn't detect unlimited retention set with `retention_in_days = 0`

[Docs](https://docs.microsoft.com/en-us/azure/azure-sql/database/auditing-overview#audit-storage-destination) say "The default value for retention period is 0 (unlimited retention). "

**To Reproduce**
Steps to reproduce the behavior:
1. scan the code below with tfsec

```hcl
resource "azurerm_mssql_database_extended_auditing_policy" "sqldbaudit" {
  database_id            = azurerm_mssql_database.sqldb.id
  log_monitoring_enabled = true
  retention_in_days      = 0
}
```

**Expected behavior**
`retention_in_days = 0` should pass the test.
Secure examples should be updated to include this case

```hcl
resource "azurerm_mssql_database_extended_auditing_policy" "good_example" {
  database_id                             = azurerm_mssql_database.example.id
  storage_endpoint                        = azurerm_storage_account.example.primary_blob_endpoint
  storage_account_access_key              = azurerm_storage_account.example.primary_access_key
  storage_account_access_key_is_secondary = false
  retention_in_days                       = 0
}
```



Pull request:
Add support for unlimited retention policy for azurerm_sql_server
Fixes #1240

Depends on this https://github.com/aquasecurity/defsec/pull/52

Not sure if the documentation should be updated as well https://github.com/aquasecurity/tfsec/blob/master/docs/checks/azure/database/retention-period-set.md

Patch:
diff --git a/docs/checks/azure/database/retention-period-set.md b/docs/checks/azure/database/retention-period-set.md
index 015e4638d..0f1e9cc0f 100644
--- a/docs/checks/azure/database/retention-period-set.md
+++ b/docs/checks/azure/database/retention-period-set.md
@@ -14,7 +14,7 @@ If the retention period is to be explicitly set, it should be set for no less th
 Short logging retention could result in missing valuable historical information
 
 ### Suggested Resolution
-Set retention periods of database auditing to greater than 90 days
+Set retention periods of database auditing to greater than 90 days or unlimited (0).
 
 
 ### Insecure Example
@@ -56,16 +56,8 @@ The following example will pass the azure-database-retention-period-set check.
  
 ```
 
-
-
 ### Links
 
-
 - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mssql_database_extended_auditing_policy](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mssql_database_extended_auditing_policy){:target="_blank" rel="nofollow noreferrer noopener"}
-
 - [https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mssql_server#retention_in_days](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mssql_server#retention_in_days){:target="_blank" rel="nofollow noreferrer noopener"}
-
 - [https://docs.microsoft.com/en-us/azure/azure-sql/database/auditing-overview](https://docs.microsoft.com/en-us/azure/azure-sql/database/auditing-overview){:target="_blank" rel="nofollow noreferrer noopener"}
-
-
-
diff --git a/internal/app/tfsec/rules/azure/database/retention_period_set_rule.go b/internal/app/tfsec/rules/azure/database/retention_period_set_rule.go
index a9e138905..485ac0098 100644
--- a/internal/app/tfsec/rules/azure/database/retention_period_set_rule.go
+++ b/internal/app/tfsec/rules/azure/database/retention_period_set_rule.go
@@ -55,6 +55,12 @@ func init() {
 				// using default of unlimited
 				return
 			}
+
+			if resourceBlock.GetAttribute("retention_in_days").Equals(0) {
+				// using explicit unlimited
+				return
+			}
+
 			if resourceBlock.GetAttribute("retention_in_days").LessThan(90) {
 				results.Add("Resource specifies a retention period of less than 90 days.", resourceBlock)
 			}


Test patch:
diff --git a/internal/app/tfsec/rules/azure/database/retention_period_set_rule_test.go b/internal/app/tfsec/rules/azure/database/retention_period_set_rule_test.go
index 7f29a60ca..af65bdd44 100644
--- a/internal/app/tfsec/rules/azure/database/retention_period_set_rule_test.go
+++ b/internal/app/tfsec/rules/azure/database/retention_period_set_rule_test.go
@@ -28,6 +28,19 @@ func Test_AZUDatabaseAuditingRetention90Days(t *testing.T) {
  `,
 			mustIncludeResultCode: expectedCode,
 		},
+		{
+			name: "check passes if retention period is unlimited (0)",
+			source: `
+ resource "azurerm_mssql_database_extended_auditing_policy" "unlimited_retention" {
+   database_id                             = azurerm_mssql_database.example.id
+   storage_endpoint                        = azurerm_storage_account.example.primary_blob_endpoint
+   storage_account_access_key              = azurerm_storage_account.example.primary_access_key
+   storage_account_access_key_is_secondary = false
+   retention_in_days                       = 0
+ }
+ `,
+			mustExcludeResultCode: expectedCode,
+		},
 		{
 			name: "check fails if extended_auditing_policy has retention less than 90 days",
 			source: `
@@ -81,7 +94,7 @@ func Test_AZUDatabaseAuditingRetention90Days(t *testing.T) {
 			mustExcludeResultCode: expectedCode,
 		},
 		{
-			name: "check passes if retention period is greatet than or equal 90",
+			name: "check passes if retention period is greater than or equal 90",
 			source: `
  resource "azurerm_mssql_database_extended_auditing_policy" "good_example" {
    database_id                             = azurerm_mssql_database.example.id
@@ -94,7 +107,7 @@ func Test_AZUDatabaseAuditingRetention90Days(t *testing.T) {
 			mustExcludeResultCode: expectedCode,
 		},
 		{
-			name: "check passes if extended auditing policy has retention period is greatet than or equal 90",
+			name: "check passes if extended auditing policy has retention period is greater than or equal 90",
 			source: `
  resource "azurerm_sql_server" "good_example" {
    name                         = "mssqlserver"
@@ -111,6 +124,27 @@ func Test_AZUDatabaseAuditingRetention90Days(t *testing.T) {
  	retention_in_days                       = 90
    }
  }
+ `,
+			mustExcludeResultCode: expectedCode,
+		},
+		{
+			name: "check passes if extended auditing policy is unlimited retention",
+			source: `
+ resource "azurerm_sql_server" "good_example" {
+   name                         = "mssqlserver"
+   resource_group_name          = azurerm_resource_group.example.name
+   location                     = azurerm_resource_group.example.location
+   version                      = "12.0"
+   administrator_login          = "mradministrator"
+   administrator_login_password = "tfsecRocks"
+
+   extended_auditing_policy {
+     storage_endpoint                        = azurerm_storage_account.example.primary_blob_endpoint
+     storage_account_access_key              = azurerm_storage_account.example.primary_access_key
+     storage_account_access_key_is_secondary = true
+     retention_in_days                        = 0
+   }
+ }
  `,
 			mustExcludeResultCode: expectedCode,
 		},