Repository: aquasecurity/tfsec (go)

Issue:
AWS068 should not be flagged when public access to EKS API server is disabled
AWS068 - EKS cluster should not have open CIDR range for public access

In EKS, there is an option to disable public access to the API server.  When public access is disabled, I think AWS068 should not be flagged.
i.e. the following code should pass the check
```terraform
resource "aws_eks_cluster" "private_cluster" {
    name = "private_cluster"
    role_arn = var.cluster_arn
    vpc_config {
        endpoint_public_access = false
    }
}
```

Relevant docs:
https://tfsec.dev/docs/aws/eks/no-public-cluster-access-to-cidr/
https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_cluster#vpc_config-arguments


Pull request:
Fix EKS check for public access CIDR
Resolves #910

Patch:
diff --git a/internal/app/tfsec/rules/aws/eks/no_public_cluster_access_to_cidr_rule.go b/internal/app/tfsec/rules/aws/eks/no_public_cluster_access_to_cidr_rule.go
index 5db9b7577..7648075ee 100644
--- a/internal/app/tfsec/rules/aws/eks/no_public_cluster_access_to_cidr_rule.go
+++ b/internal/app/tfsec/rules/aws/eks/no_public_cluster_access_to_cidr_rule.go
@@ -65,26 +65,22 @@ resource "aws_eks_cluster" "good_example" {
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("vpc_config") {
-				set.Add(
-					result.New(resourceBlock).
-						WithDescription(fmt.Sprintf("Resource '%s' has no vpc_config block specified so default public access cidrs is set", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()),
-				)
 				return
 			}
-
 			vpcConfig := resourceBlock.GetBlock("vpc_config")
-			if vpcConfig.MissingChild("public_access_cidrs") {
-				set.Add(
-					result.New(resourceBlock).
-						WithDescription(fmt.Sprintf("Resource '%s' is using default public access cidrs in the vpc config", resourceBlock.FullName())).
-						WithRange(vpcConfig.Range()),
-				)
+
+			publicAccessEnabledAttr := vpcConfig.GetAttribute("endpoint_public_access")
+			if publicAccessEnabledAttr != nil && publicAccessEnabledAttr.IsFalse() {
 				return
 			}
 
 			publicAccessCidrsAttr := vpcConfig.GetAttribute("public_access_cidrs")
-			if cidr.IsOpen(publicAccessCidrsAttr) {
+			if publicAccessCidrsAttr == nil {
+				set.Add(
+					result.New(resourceBlock).
+						WithDescription(fmt.Sprintf("Resource '%s' uses the default public access cidr of 0.0.0.0/0", resourceBlock.FullName())),
+				)
+			} else if cidr.IsOpen(publicAccessCidrsAttr) {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has public access cidr explicitly set to wide open", resourceBlock.FullName())).


Test patch:
diff --git a/internal/app/tfsec/rules/aws/eks/no_public_cluster_access_to_cidr_rule_test.go b/internal/app/tfsec/rules/aws/eks/no_public_cluster_access_to_cidr_rule_test.go
index 3e6f89ea4..7043fccf6 100644
--- a/internal/app/tfsec/rules/aws/eks/no_public_cluster_access_to_cidr_rule_test.go
+++ b/internal/app/tfsec/rules/aws/eks/no_public_cluster_access_to_cidr_rule_test.go
@@ -16,18 +16,18 @@ func Test_AWSEKSClusterNotOpenPublicly(t *testing.T) {
 		mustExcludeResultCode string
 	}{
 		{
-			name: "Test public access cidrs left to default causes check to fail",
+			name: "Test public access cidrs left to default causes check to pass if public access is disabled",
 			source: `
-resource "aws_eks_cluster" "bad_example" {
+resource "aws_eks_cluster" "good_example" {
 
-    name = "bad_example_cluster"
+    name = "good_example_cluster"
     role_arn = var.cluster_arn
     vpc_config {
         endpoint_public_access = false
     }
 }
 `,
-			mustIncludeResultCode: expectedCode,
+			mustExcludeResultCode: expectedCode,
 		},
 		{
 			name: "Test public access cidrs actively set to open check to fail",
@@ -37,10 +37,37 @@ resource "aws_eks_cluster" "bad_example" {
     name = "bad_example_cluster"
     role_arn = var.cluster_arn
     vpc_config {
-        endpoint_public_access = false
+        endpoint_public_access = true
 		public_access_cidrs = [ "0.0.0.0/0" ]
     }
 }
+`,
+		},
+		{
+			name: "Test public access cidrs actively set to open check to fail",
+			source: `
+resource "aws_eks_cluster" "bad_example" {
+
+name = "bad_example_cluster"
+role_arn = var.cluster_arn
+vpc_config {
+public_access_cidrs = [ "0.0.0.0/0" ]
+}
+}
+`,
+			mustIncludeResultCode: expectedCode,
+		},
+
+		{
+			name: "Test public access cidrs using default set to open check to fail",
+			source: `
+resource "aws_eks_cluster" "bad_example" {
+
+name = "bad_example_cluster"
+role_arn = var.cluster_arn
+vpc_config {
+}
+}
 `,
 			mustIncludeResultCode: expectedCode,
 		},