Repository: aquasecurity/tfsec
Pull request #949 (2021-07-26 13:23:58)

 add additional resources this applies to


Patch:
diff --git a/internal/app/tfsec/rules/azure/database/no_public_firewall_access_rule.go b/internal/app/tfsec/rules/azure/database/no_public_firewall_access_rule.go
index fb7bcd3d2..852ea8152 100644
--- a/internal/app/tfsec/rules/azure/database/no_public_firewall_access_rule.go
+++ b/internal/app/tfsec/rules/azure/database/no_public_firewall_access_rule.go
@@ -34,6 +34,14 @@ resource "azurerm_sql_firewall_rule" "bad_example" {
   start_ip_address    = "0.0.0.0"
   end_ip_address      = "255.255.255.255"
 }
+
+resource "azurerm_postgresql_firewall_rule" "bad_example" {
+  name                = "bad_example"
+  resource_group_name = azurerm_resource_group.example.name
+  server_name         = azurerm_postgresql_server.example.name
+  start_ip_address    = "0.0.0.0"
+  end_ip_address      = "255.255.255.255"
+}
 `,
 			GoodExample: `
 resource "azurerm_sql_firewall_rule" "good_example" {
@@ -49,9 +57,14 @@ resource "azurerm_sql_firewall_rule" "good_example" {
 				"https://docs.microsoft.com/en-us/rest/api/sql/2021-02-01-preview/firewall-rules/create-or-update",
 			},
 		},
-		Provider:        provider.AzureProvider,
-		RequiredTypes:   []string{"resource"},
-		RequiredLabels:  []string{"azurerm_sql_firewall_rule"},
+		Provider:      provider.AzureProvider,
+		RequiredTypes: []string{"resource"},
+		RequiredLabels: []string{
+			"azurerm_sql_firewall_rule",
+			"azurerm_mysql_firewall_rule",
+			"azurerm_postgresql_firewall_rule",
+			"azurerm_mariadb_firewall_rule",
+		},
 		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 


Test patch:
diff --git a/internal/app/tfsec/rules/azure/database/no_public_firewall_access_rule_test.go b/internal/app/tfsec/rules/azure/database/no_public_firewall_access_rule_test.go
index dc130a4be..a4ba5da92 100644
--- a/internal/app/tfsec/rules/azure/database/no_public_firewall_access_rule_test.go
+++ b/internal/app/tfsec/rules/azure/database/no_public_firewall_access_rule_test.go
@@ -18,10 +18,23 @@ func Test_AzureNoPublicFirewallAccess(t *testing.T) {
 		{
 			name: "rule with open ip range fails check",
 			source: `
-resource "azurerm_sql_firewall_rule" "bad_example" {
-  name                = "bad_rule"
+resource "azurerm_postgresql_firewall_rule" "bad_example" {
+  name                = "bad_example"
   resource_group_name = azurerm_resource_group.example.name
-  server_name         = azurerm_sql_server.example.name
+  server_name         = azurerm_postgresql_server.example.name
+  start_ip_address    = "0.0.0.0"
+  end_ip_address      = "255.255.255.255"
+}
+`,
+			mustIncludeResultCode: expectedCode,
+		},
+		{
+			name: "postgresql rule with open ip range fails check",
+			source: `
+resource "azurerm_postgresql_firewall_rule" "bad_example" {
+  name                = "bad_example"
+  resource_group_name = azurerm_resource_group.example.name
+  server_name         = azurerm_postgresql_server.example.name
   start_ip_address    = "0.0.0.0"
   end_ip_address      = "255.255.255.255"
 }
@@ -51,6 +64,14 @@ resource "azurerm_sql_firewall_rule" "good_example" {
   start_ip_address    = "10.0.2.0"
   end_ip_address      = "10.0.2.240"
 }
+
+resource "azurerm_postgresql_firewall_rule" "good_example" {
+	name                = "good_rule"
+	resource_group_name = azurerm_resource_group.example.name
+	server_name         = azurerm_sql_server.example.name
+	start_ip_address    = "10.0.2.0"
+	end_ip_address      = "10.0.2.240"
+  }
 `,
 			mustExcludeResultCode: expectedCode,
 		},