Repository: bridgecrewio/checkov

Issue:
CKV_AZURE_109 tfsec collision AZU020
There is a collision between guidelines on which nacl rule to add to an azurerm_key_vault

[This doc](https://docs.bridgecrew.io/docs/ensure-that-key-vault-allows-firewall-rules-settings) from bridgecrew tells to allow default (which is what checkov checks)
[This doc](https://tfsec.dev/docs/azure/AZU020/) from tfsec.dev tells to deny default.

OMHO, I think tsec is right on that.

cf. https://github.com/tfsec/tfsec/issues/690


Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/azure/KeyVaultAllowsFirewallRulesSettings.py b/checkov/terraform/checks/resource/azure/KeyVaultEnablesFirewallRulesSettings.py
similarity index 81%
rename from checkov/terraform/checks/resource/azure/KeyVaultAllowsFirewallRulesSettings.py
rename to checkov/terraform/checks/resource/azure/KeyVaultEnablesFirewallRulesSettings.py
--- a/checkov/terraform/checks/resource/azure/KeyVaultAllowsFirewallRulesSettings.py
+++ b/checkov/terraform/checks/resource/azure/KeyVaultEnablesFirewallRulesSettings.py
@@ -2,7 +2,7 @@
 from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
 
 
-class KeyVaultAllowsFirewallRulesSettings(BaseResourceValueCheck):
+class KeyVaultEnablesFirewallRulesSettings(BaseResourceValueCheck):
     def __init__(self):
         name = "Ensure that key vault allows firewall rules settings"
         id = "CKV_AZURE_109"
@@ -14,7 +14,7 @@ def get_inspected_key(self):
         return "network_acls/[0]/default_action"
 
     def get_expected_value(self):
-        return "allow"
+        return "deny"
 
 
-check = KeyVaultAllowsFirewallRulesSettings()
+check = KeyVaultEnablesFirewallRulesSettings()


Test patch:
diff --git a/tests/terraform/checks/resource/azure/test_KeyVaultAllowsFirewallRulesSettings.py b/tests/terraform/checks/resource/azure/test_KeyVaultEnablesFirewallRulesSettings.py
similarity index 95%
rename from tests/terraform/checks/resource/azure/test_KeyVaultAllowsFirewallRulesSettings.py
rename to tests/terraform/checks/resource/azure/test_KeyVaultEnablesFirewallRulesSettings.py
--- a/tests/terraform/checks/resource/azure/test_KeyVaultAllowsFirewallRulesSettings.py
+++ b/tests/terraform/checks/resource/azure/test_KeyVaultEnablesFirewallRulesSettings.py
@@ -2,13 +2,13 @@
 
 import hcl2
 
-from checkov.terraform.checks.resource.azure.KeyVaultAllowsFirewallRulesSettings import check
+from checkov.terraform.checks.resource.azure.KeyVaultEnablesFirewallRulesSettings import check
 from checkov.common.models.enums import CheckResult
 
 
-class TestKeyVaultAllowsFirewallRulesSettings(unittest.TestCase):
+class TestKeyVaultEnablesFirewallRulesSettings(unittest.TestCase):
 
-    def test_failure(self):
+    def test_failure_missing(self):
         hcl_res = hcl2.loads("""
                 resource "azurerm_key_vault" "example" {
                   name                        = "examplekeyvault"
@@ -43,7 +43,7 @@ def test_failure(self):
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.FAILED, scan_result)
 
-    def test_failure2(self):
+    def test_success(self):
         hcl_res = hcl2.loads("""
                 resource "azurerm_key_vault" "example" {
                   name                        = "examplekeyvault"
@@ -79,9 +79,9 @@ def test_failure2(self):
                 """)
         resource_conf = hcl_res['resource'][0]['azurerm_key_vault']['example']
         scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.FAILED, scan_result)
+        self.assertEqual(CheckResult.PASSED, scan_result)
 
-    def test_success(self):
+    def test_fail_allow(self):
         hcl_res = hcl2.loads("""
                 resource "azurerm_key_vault" "example" {
                   name                        = "examplekeyvault"
@@ -117,7 +117,7 @@ def test_success(self):
                 """)
         resource_conf = hcl_res['resource'][0]['azurerm_key_vault']['example']
         scan_result = check.scan_resource_conf(conf=resource_conf)
-        self.assertEqual(CheckResult.PASSED, scan_result)
+        self.assertEqual(CheckResult.FAILED, scan_result)
 
 
 if __name__ == '__main__':