Repository: aquasecurity/tfsec
Pull request #1032 (2021-08-16 15:58:02)

Redshift SG needs description


Patch:
diff --git a/internal/app/tfsec/rules/aws/redshift/add_decription_to_security_group_rule.go b/internal/app/tfsec/rules/aws/redshift/add_decription_to_security_group_rule.go
new file mode 100644
index 000000000..6b1bf8e62
--- /dev/null
+++ b/internal/app/tfsec/rules/aws/redshift/add_decription_to_security_group_rule.go
@@ -0,0 +1,82 @@
+package redshift
+
+// generator-locked
+import (
+	"github.com/aquasecurity/tfsec/pkg/result"
+	"github.com/aquasecurity/tfsec/pkg/severity"
+
+	"github.com/aquasecurity/tfsec/pkg/provider"
+
+	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
+
+	"github.com/aquasecurity/tfsec/pkg/rule"
+
+	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
+)
+
+func init() {
+	scanner.RegisterCheckRule(rule.Rule{
+		Service:   "redshift",
+		ShortCode: "add-description-to-security-group",
+		Documentation: rule.RuleDocumentation{
+			Summary:    "Missing description for security group/security group rule.",
+			Impact:     "Descriptions provide context for the firewall rule reasons",
+			Resolution: "Add descriptions for all security groups and rules",
+			Explanation: `
+Security groups and security group rules should include a description for auditing purposes.
+
+Simplifies auditing, debugging, and managing security groups.
+`,
+			BadExample: []string{`
+resource "aws_redshift_security_group" "bad_example" {
+  name        = "http"
+
+  ingress {
+    description = "HTTP from VPC"
+    from_port   = 80
+    to_port     = 80
+    protocol    = "tcp"
+    cidr_blocks = [aws_vpc.main.cidr_block]
+  }
+}
+`},
+			GoodExample: []string{`
+resource "aws_redshift_security_group" "good_example" {
+  name        = "http"
+  description = "Allow inbound HTTP traffic"
+
+  ingress {
+    description = "HTTP from VPC"
+    from_port   = 80
+    to_port     = 80
+    protocol    = "tcp"
+    cidr_blocks = [aws_vpc.main.cidr_block]
+  }
+}
+`},
+			Links: []string{
+				"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group",
+				"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule",
+				"https://www.cloudconformity.com/knowledge-base/aws/EC2/security-group-rules-description.html",
+			},
+		},
+		Provider:        provider.AWSProvider,
+		RequiredTypes:   []string{"resource"},
+		RequiredLabels:  []string{"aws_redshift_security_group"},
+		DefaultSeverity: severity.Low,
+		CheckFunc: func(set result.Set, resourceBlock block.Block, _ block.Module) {
+			if resourceBlock.MissingChild("description") {
+				set.AddResult().
+					WithDescription("Resource '%s' should include a description for auditing purposes.", resourceBlock.FullName())
+				return
+			}
+
+			descriptionAttr := resourceBlock.GetAttribute("description")
+			if descriptionAttr.IsEmpty() {
+				set.AddResult().
+					WithDescription("Resource '%s' should include a non-empty description for auditing purposes.", resourceBlock.FullName()).
+					WithAttribute(descriptionAttr)
+			}
+		},
+	})
+}


Test patch:
diff --git a/internal/app/tfsec/rules/aws/redshift/add_decription_to_security_group_rule_test.go b/internal/app/tfsec/rules/aws/redshift/add_decription_to_security_group_rule_test.go
new file mode 100644
index 000000000..26f638523
--- /dev/null
+++ b/internal/app/tfsec/rules/aws/redshift/add_decription_to_security_group_rule_test.go
@@ -0,0 +1,45 @@
+package redshift
+
+// generator-locked
+import (
+	"testing"
+
+	"github.com/aquasecurity/tfsec/internal/app/tfsec/testutil"
+)
+
+func Test_AWSMissingDescriptionForSecurityGroup(t *testing.T) {
+	expectedCode := "aws-redshift-add-description-to-security-group"
+
+	var tests = []struct {
+		name                  string
+		source                string
+		mustIncludeResultCode string
+		mustExcludeResultCode string
+	}{
+		{
+			name: "check aws_security_group without description",
+			source: `
+resource "aws_redshift_security_group" "my-group" {
+	
+}`,
+			mustIncludeResultCode: expectedCode,
+		},
+		{
+			name: "check aws_security_group with description",
+			source: `
+resource "aws_redshift_security_group" "my-group" {
+	description = "this is a group for allowing shiz"
+}`,
+			mustExcludeResultCode: expectedCode,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+
+			results := testutil.ScanHCL(test.source, t)
+			testutil.AssertCheckCode(t, test.mustIncludeResultCode, test.mustExcludeResultCode, results)
+		})
+	}
+
+}