Project: Checkov (Provisioning / Security & Compliance)
File: Examples.md

layout: default published: true title: Custom YAML Policies Examples nav_order: 4 ```yaml metadata: name: "Check that all resources are tagged with the key - env" id: "CKV2AWS1" category: "GENERAL_SECURITY" scope: provider: aws definition: cond_type: "attribute" resource_types: "all" attribute: "tags.env" operator: "exists" ``` ```yaml metadata: name: "Ensure all modules are using the official AWS ones" id: "CKV2AWS1" category: "SUPPLY_CHAIN" definition: cond_type: attribute resource_types: module attribute: source operator: starting_with value: terraform-aws-modules ``` ```yaml metadata: name: "Ensure a certain region is not added" id: "CKV2AWS3" category: "GENERAL_SECURITY" definition: cond_type: "attribute" resource_types: "provider.aws" attribute: "region" operator: "not_contains" value: "us-west-1" ``` ```yaml metadata: id: "CUSTOMGRAPHAWS_3" name: "Ensure a certain region is not added" category: "GENERAL_SECURITY" scope: provider: "AWS" definition: and: cond_type: "attribute" resource_types: "provider" attribute: "default_tags" operator: exists cond_type: "attribute" resource_types: "provider" attribute: "region" operator: "not_contains" value: "us-west-1" ``` ```yaml metadata: name: "Ensure Secret is not deleted" id: "CKV2AWS1" category: "GENERAL_SECURITY" definition: cond_type: attribute resource_types: awssecretsmanagersecret attribute: change_actions operator: not_contains value: delete ``` ```yaml metadata: name: "Org's compute instances should not be t3.micro or t3.nano" id: "CKV2AWS1" category: "NETWORKING" definition: or: cond_type: "attribute" resource_types: "aws_instance" attribute: "instance_type" operator: "not_equals" value: "t3.micro" cond_type: "attribute" resource_types: "aws_instance" attribute: "instance_type" operator: "not_equals" value: "t3.nano" ``` ```yaml metadata: name: "Check that all encrypted RDS clusters are tagged with encrypted: true" id: "CKV2AWS1" category: "SECRETS" definition: and: cond_type: "attribute" resource_types: "awsrdscluster" attribute:

operator: "equals" value: "true" or: cond_type: "attribute" resource_types: "awsrdscluster" attribute: "kmskeyid" operator: "exists" cond_type: "attribute" resource_types: "awsrdscluster" attribute: "storage_encrypted" operator: "equals" value: "true" ``` ```yaml metadata: name: "Ensure all AWS databases have Backup Policy" id: "CKV2AWS1" category: "BACKUPANDRECOVERY" definition: or: cond_type: "attribute" resource_types: "awsrdscluster" "awsdbinstance" attribute: "backupretentionperiod" operator: "not_exists" cond_type: "attribute" resource_types: "awsrdscluster" "awsdbinstance" attribute: "backupretentionperiod" operator: "not_equals" value: "0" cond_type: "attribute" resource_types: "awsredshiftcluster" attribute: "automatedsnapshotretention_period" operator: "not_equals" value: "0" cond_type: "attribute" resource_types: "awsdynamodbtable" attribute: "pointintime_recovery" operator: "not_equals" value: "false" cond_type: "attribute" resource_types: "awsdynamodbtable" attribute: "pointintime_recovery" operator: "exists" ``` ```yaml metadata: name: "Ensure all EC2s are connected only to encrypted EBS volumes" id: "CKV2AWS1" category: "ENCRYPTION" definition: and: cond_type: "attribute" resource_types: "awsebsvolume" attribute: "encrypted" operator: "equals" value: "true" cond_type: "connection" resource_types: "awsvolumeattachment" connectedresourcetypes: "awsebsvolume" operator: "exists" cond_type: "filter" attribute: "resource_type" value: "awsebsvolume" operator: "within" ``` ```yaml metadata: name: "Ensure admin groups are not created" id: "CKV2AZURE999" category: "IAM" definition: and: cond_type: filter attribute: resource_type operator: within value: azuredevopsgroupmembership or: cond_type: connection resource_types: azuredevopsgroupmembership connectedresourcetypes: data.azuredevops_group operator: not_exists and: cond_type: connection resource_types: azuredevopsgroupmembership connectedresourcetypes: data.azuredevops_group operator: exists cond_type: attribute resource_types: data.azuredevops_group attribute: name operator: not_equals value: "Build Administrators" ``` ```yaml metadata: name: "Ensure all ALBs are connected only to HTTPS listeners" id: "CKV2AWS1" category: "NETWORKING" definition: and: cond_type: "filter" value: "aws_lb" attribute: "resource_type" operator: "within" cond_type: "attribute" resource_types: "aws_lb" attribute: "loadbalancertype" operator: "equals" value: "application" or: cond_type: "connection" resource_types: "aws_lb" connectedresourcetypes: "awslblistener" operator: "not_exists" and: cond_type: "connection" resource_types: "aws_lb" connectedresourcetypes: "awslblistener" operator: "exists" cond_type: "attribute" resource_types: "awslblistener" attribute: "certificate_arn" operator: "exists" cond_type: "attribute" resource_types: "awslblistener" attribute: "ssl_policy" operator: "exists" cond_type: "attribute" resource_types: "awslblistener" attribute: "protocol" operator: "equals" value: "HTTPS" or: cond_type: "attribute" resource_types: "awslblistener" attribute: "default_action.redirect.protocol" operator: "equals" value: "HTTPS" cond_type: "attribute" resource_types: "awslblistener" attribute: "default_action.redirect.protocol" operator: "not_exists" or: cond_type: "connection" resource_types: "awslblistener_rule" connectedresourcetypes: "awslblistener" operator: "not_exists" and: cond_type: "connection" resource_types: "awslblistener_rule" connectedresourcetypes: "awslblistener" operator: "exists" or: cond_type: "attribute" resource_types: "awslblistener_rule" attribute: "default_action.redirect.protocol" operator: "equals" value: "HTTPS" cond_type: "attribute" resource_types: "awslblistener_rule" attribute: "default_action.redirect.protocol" operator: "not_exists" ``` ```yaml metadata: name: "Ensure resources allows encrypted ingress communication (SSH)" id: "CKV2AWS1" category: "NETWORKING" definition: and: cond_type: "filter" attribute: "resource_type" value: "aws_instance" "aws_elb" "aws_lb" "awsdbinstance" "awselasticachecluster" "awsemrcluster" "awsredshiftcluster" "awselasticsearchdomain" "awsrdscluster" "awsefsmount_target" "awsefsfile_system" "awsecsservice" operator: "within" cond_type: "connection" resource_types: "aws_instance" "aws_elb" "aws_lb" "awsdbinstance" "awselasticachecluster" "awsemrcluster" "awsredshiftcluster" "awselasticsearchdomain" "awsrdscluster" "awsefsmount_target" "awsefsfile_system" "awsecsservice" connectedresourcetypes: "awssecuritygroup" "awsdefaultsecurity_group" operator: "exists" or: cond_type: "attribute" resource_types: "awssecuritygroup" "awsdefaultsecurity_group" attribute: "ingress.from_port" operator: "equals" value: "22" cond_type: "attribute" resource_types: "awssecuritygroup" "awsdefaultsecurity_group" value: "22" operator: "equals" attribute: "ingress.to_port" or: cond_type: "connection" resource_types: "awssecuritygroup_rule" connectedresourcetypes: "awssecuritygroup" "awsdefaultsecurity_group" operator: "not_exists" and: cond_type: "connection" resource_types: "awssecuritygroup_rule" connectedresourcetypes: "awssecuritygroup" "awsdefaultsecurity_group" operator: "exists" cond_type: "attribute" resource_types: "awssecuritygroup_rule" attribute: "type" operator: "equals" value: "ingress" or: cond_type: "attribute" resource_types: "awssecuritygroup_rule" attribute: "to_port" operator: "equals" value: "22" cond_type: "attribute" resource_types: "awssecuritygroup_rule" attribute: "from_port" operator: "equals" value: "22" ``` The following policy will pass if and only if all of the `cidr_blocks` arrays within the `ingress` blocks of a security group do not contain `0.0.0.0/0`. ```yaml definition: not: cond_type: attribute resource_types: "awssecuritygroup" attribute: "ingress.*.cidr_blocks" operator: "contains" value: "0.0.0.0/0" ``` The following policy looks for a CloudFormation S3 Bucket with a tag name `env` and it should have one of the values `prod` or `prod-eu`. ```yaml definition: cond_type: "attribute" resource_types: "AWS::S3::Bucket" attribute: "Tags[?(@.Key == env)].Value" operator: "jsonpath_within" value: prod prod-eu ```