Repository: aquasecurity/tfsec
Pull request #1247 (2022-01-06 20:54:42)

Azure storage - adapt to use defsec logic
Write azure storage adapter.

Update resource `"azure_storage_container"` to `"azurerm_storage_container"` as per the latest [docs](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_container).
Azure container resource in Terraform no longer includes a `properties` block and as such the `no_public_access_rule` has been modified to check the value in the `container_access_type` attribute. 
But it's up to the maintainers to decide if the rule should be kept at all.

An `"azurerm_storage_account"` resource has been added to the container examples, since its existence is already [required](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_container#storage_account_name) by Terraform, it is used to classify which account the containers belong to. 

Closes: https://github.com/aquasecurity/tfsec/issues/1221


Patch:
diff --git a/internal/app/tfsec/adapter/azure/storage/adapt.go b/internal/app/tfsec/adapter/azure/storage/adapt.go
index aa1305327..747f0900e 100644
--- a/internal/app/tfsec/adapter/azure/storage/adapt.go
+++ b/internal/app/tfsec/adapter/azure/storage/adapt.go
@@ -2,9 +2,116 @@ package storage
 
 import (
 	"github.com/aquasecurity/defsec/provider/azure/storage"
+	"github.com/aquasecurity/defsec/types"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 )
 
 func Adapt(modules []block.Module) storage.Storage {
-	return storage.Storage{}
+	return storage.Storage{
+		Accounts: adaptAccounts(modules),
+	}
+}
+
+func adaptAccounts(modules []block.Module) []storage.Account {
+	var accounts []storage.Account
+
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("azurerm_storage_account") {
+			account := adaptAccount(resource)
+			containerResource := module.GetReferencingResources(resource, "azurerm_storage_container", "storage_account_name")
+			for _, containerBlock := range containerResource {
+				account.Containers = append(account.Containers, adaptContainer(containerBlock))
+			}
+			networkRulesResource := module.GetReferencingResources(resource, "azurerm_storage_account_network_rules", "storage_account_name")
+			for _, networkRuleBlock := range networkRulesResource {
+				account.NetworkRules = append(account.NetworkRules, adaptNetworkRule(networkRuleBlock))
+			}
+			accounts = append(accounts, account)
+		}
+
+		if len(module.GetResourcesByType("azurerm_storage_account")) == 0 {
+			for _, resource := range module.GetResourcesByType("azurerm_storage_account_network_rules") {
+				accounts = append(accounts, storage.Account{
+					NetworkRules: []storage.NetworkRule{
+						adaptNetworkRule(resource),
+					},
+				})
+			}
+		}
+	}
+
+	return accounts
+}
+
+func adaptAccount(resource block.Block) storage.Account {
+	var networkRules []storage.NetworkRule
+	networkRulesBlocks := resource.GetBlocks("network_rules")
+	for _, networkBlock := range networkRulesBlocks {
+		networkRules = append(networkRules, adaptNetworkRule(networkBlock))
+	}
+
+	httpsOnlyAttr := resource.GetAttribute("enable_https_traffic_only")
+	httpsOnlyVal := httpsOnlyAttr.AsBoolValueOrDefault(true, resource)
+
+	enableLogging := types.Bool(false, *resource.GetMetadata())
+	queuePropertiesBlock := resource.GetBlock("queue_properties")
+	if queuePropertiesBlock.IsNotNil() {
+		loggingBlock := queuePropertiesBlock.GetBlock("logging")
+		if loggingBlock.IsNotNil() {
+			enableLogging = types.Bool(true, *loggingBlock.GetMetadata())
+		}
+	}
+
+	minTLSVersionAttr := resource.GetAttribute("min_tls_version")
+	minTLSVersionVal := minTLSVersionAttr.AsStringValueOrDefault("TLS1_0", resource)
+
+	return storage.Account{
+		NetworkRules: networkRules,
+		EnforceHTTPS: httpsOnlyVal,
+		QueueProperties: storage.QueueProperties{
+			EnableLogging: enableLogging,
+		},
+		MinimumTLSVersion: minTLSVersionVal,
+	}
+}
+
+func adaptContainer(resource block.Block) storage.Container {
+	accessTypeAttr := resource.GetAttribute("container_access_type")
+	publicAccess := types.String(storage.PublicAccessOff, *resource.GetMetadata())
+
+	if accessTypeAttr.Equals("blob") {
+		publicAccess = types.String(storage.PublicAccessBlob, *resource.GetMetadata())
+	} else if accessTypeAttr.Equals("container") {
+		publicAccess = types.String(storage.PublicAccessContainer, *resource.GetMetadata())
+	}
+
+	return storage.Container{
+		PublicAccess: publicAccess,
+	}
+}
+
+func adaptNetworkRule(resource block.Block) storage.NetworkRule {
+	var allowByDefault types.BoolValue
+	var bypass []types.StringValue
+
+	defaultActionAttr := resource.GetAttribute("default_action")
+	if defaultActionAttr.Equals("allow", block.IgnoreCase) {
+		allowByDefault = types.Bool(true, *resource.GetMetadata())
+	} else if defaultActionAttr.Equals("deny", block.IgnoreCase) {
+		allowByDefault = types.Bool(false, *resource.GetMetadata())
+	}
+
+	if resource.HasChild("bypass") {
+		bypassAttr := resource.GetAttribute("bypass")
+		bypassList := bypassAttr.ValueAsStrings()
+		for _, bypassVal := range bypassList {
+			bypass = append(bypass, types.String(bypassVal, *resource.GetMetadata()))
+		}
+	}
+
+	return storage.NetworkRule{
+		Metadata:       *resource.GetMetadata(),
+		Bypass:         bypass,
+		AllowByDefault: allowByDefault,
+	}
 }
diff --git a/internal/app/tfsec/adapter/google/bigquery/adapt.go b/internal/app/tfsec/adapter/google/bigquery/adapt.go
index 0922aa3db..29d99f8a1 100644
--- a/internal/app/tfsec/adapter/google/bigquery/adapt.go
+++ b/internal/app/tfsec/adapter/google/bigquery/adapt.go
@@ -6,5 +6,48 @@ import (
 )
 
 func Adapt(modules []block.Module) bigquery.BigQuery {
-	return bigquery.BigQuery{}
+	return bigquery.BigQuery{
+		Datasets: adaptDatasets(modules),
+	}
+}
+
+func adaptDatasets(modules []block.Module) []bigquery.Dataset {
+	var datasets []bigquery.Dataset
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("google_bigquery_dataset") {
+			datasets = append(datasets, adaptDataset(resource))
+		}
+	}
+	return datasets
+}
+
+func adaptDataset(resource block.Block) bigquery.Dataset {
+	IDAttr := resource.GetAttribute("dataset_id")
+	IDVal := IDAttr.AsStringValueOrDefault("", resource)
+
+	var accessGrants []bigquery.AccessGrant
+
+	accessBlocks := resource.GetBlocks("access")
+	for _, accessBlock := range accessBlocks {
+		roleAttr := accessBlock.GetAttribute("role")
+		roleVal := roleAttr.AsStringValueOrDefault("", accessBlock)
+
+		domainAttr := accessBlock.GetAttribute("domain")
+		domainVal := domainAttr.AsStringValueOrDefault("", accessBlock)
+
+		specialGrAttr := accessBlock.GetAttribute("special_group")
+		specialGrVal := specialGrAttr.AsStringValueOrDefault("", accessBlock)
+
+		accessGrants = append(accessGrants, bigquery.AccessGrant{
+			Role:         roleVal,
+			Domain:       domainVal,
+			SpecialGroup: specialGrVal,
+		})
+	}
+
+	return bigquery.Dataset{
+		Metadata:     *resource.GetMetadata(),
+		ID:           IDVal,
+		AccessGrants: accessGrants,
+	}
 }
diff --git a/internal/app/tfsec/adapter/google/dns/adapt.go b/internal/app/tfsec/adapter/google/dns/adapt.go
index 68f2804b4..e066a04db 100644
--- a/internal/app/tfsec/adapter/google/dns/adapt.go
+++ b/internal/app/tfsec/adapter/google/dns/adapt.go
@@ -2,9 +2,105 @@ package dns
 
 import (
 	"github.com/aquasecurity/defsec/provider/google/dns"
+	"github.com/aquasecurity/defsec/types"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 )
 
 func Adapt(modules []block.Module) dns.DNS {
-	return dns.DNS{}
+	return dns.DNS{
+		ManagedZones: adaptManagedZones(modules),
+	}
+}
+
+func adaptManagedZones(modules []block.Module) []dns.ManagedZone {
+	var managedZones []dns.ManagedZone
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("google_dns_managed_zone") {
+			managedZone := adaptManagedZone(resource)
+			for _, data := range module.GetDatasByType("google_dns_keys") {
+				managedZone.DNSSec.DefaultKeySpecs = adaptKeySpecs(data)
+			}
+			managedZones = append(managedZones, managedZone)
+		}
+	}
+	return managedZones
+}
+
+func adaptManagedZone(resource block.Block) dns.ManagedZone {
+	enabled := types.Bool(false, *resource.GetMetadata())
+
+	if resource.HasChild("dnssec_config") {
+		DNSSecBlock := resource.GetBlock("dnssec_config")
+
+		stateAttr := DNSSecBlock.GetAttribute("state")
+		if stateAttr.Equals("on") {
+			enabled = types.Bool(true, *DNSSecBlock.GetMetadata())
+		} else if stateAttr.Equals("off") || stateAttr.Equals("transfer") {
+			enabled = types.Bool(false, *DNSSecBlock.GetMetadata())
+		}
+
+		if DNSSecBlock.HasChild("default_key_specs") {
+			DefaultKeySpecsBlock := DNSSecBlock.GetBlock("default_key_specs")
+
+			algorithmAttr := DefaultKeySpecsBlock.GetAttribute("algorithm")
+			algorithmVal := algorithmAttr.AsStringValueOrDefault("", DefaultKeySpecsBlock)
+
+			keyTypeAttr := DefaultKeySpecsBlock.GetAttribute("key_type")
+			if keyTypeAttr.Equals("keySigning") {
+				return dns.ManagedZone{
+					DNSSec: dns.DNSSec{
+						Enabled: enabled,
+						DefaultKeySpecs: dns.KeySpecs{
+							KeySigningKey: dns.Key{
+								Algorithm: algorithmVal,
+							},
+						},
+					},
+				}
+			}
+			if keyTypeAttr.Equals("zoneSigning") {
+				return dns.ManagedZone{
+					DNSSec: dns.DNSSec{
+						Enabled: enabled,
+						DefaultKeySpecs: dns.KeySpecs{
+							ZoneSigningKey: dns.Key{
+								Algorithm: algorithmVal,
+							},
+						},
+					},
+				}
+			}
+		}
+	}
+	return dns.ManagedZone{
+		DNSSec: dns.DNSSec{
+			Enabled: enabled,
+		},
+	}
+}
+
+func adaptKeySpecs(resource block.Block) dns.KeySpecs {
+	keyAlgorithm := types.String("", *resource.GetMetadata())
+	zoneAlgorithm := types.String("", *resource.GetMetadata())
+
+	KeySigningKeysBlock := resource.GetBlock("key_signing_keys")
+	if KeySigningKeysBlock.IsNotNil() {
+		algorithmAttr := KeySigningKeysBlock.GetAttribute("algorithm")
+		keyAlgorithm = algorithmAttr.AsStringValueOrDefault("", KeySigningKeysBlock)
+	}
+
+	ZoneSigningKeysBlock := resource.GetBlock("zone_signing_keys")
+	if ZoneSigningKeysBlock.IsNotNil() {
+		algorithmAttr := ZoneSigningKeysBlock.GetAttribute("algorithm")
+		zoneAlgorithm = algorithmAttr.AsStringValueOrDefault("", ZoneSigningKeysBlock)
+	}
+
+	return dns.KeySpecs{
+		KeySigningKey: dns.Key{
+			Algorithm: keyAlgorithm,
+		},
+		ZoneSigningKey: dns.Key{
+			Algorithm: zoneAlgorithm,
+		},
+	}
 }
diff --git a/internal/app/tfsec/adapter/google/kms/adapt.go b/internal/app/tfsec/adapter/google/kms/adapt.go
index 2fb8db937..1c839e629 100644
--- a/internal/app/tfsec/adapter/google/kms/adapt.go
+++ b/internal/app/tfsec/adapter/google/kms/adapt.go
@@ -1,10 +1,50 @@
 package kms
 
 import (
+	"strconv"
+
 	"github.com/aquasecurity/defsec/provider/google/kms"
+	"github.com/aquasecurity/defsec/types"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 )
 
 func Adapt(modules []block.Module) kms.KMS {
-	return kms.KMS{}
+	return kms.KMS{
+		KeyRings: adaptKeyRings(modules),
+	}
+}
+
+func adaptKeyRings(modules []block.Module) []kms.KeyRing {
+	var keyRings []kms.KeyRing
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("google_kms_key_ring") {
+			var keys []kms.Key
+
+			keyBlocks := module.GetReferencingResources(resource, "google_kms_crypto_key", "key_ring")
+			for _, keyBlock := range keyBlocks {
+				keys = append(keys, adaptKey(keyBlock))
+			}
+			keyRings = append(keyRings, kms.KeyRing{
+				Keys: keys,
+			})
+		}
+	}
+	return keyRings
+}
+
+func adaptKey(resource block.Block) kms.Key {
+	rotationPeriodAttr := resource.GetAttribute("rotation_period")
+	rotationStr := rotationPeriodAttr.Value().AsString()
+
+	if rotationStr[len(rotationStr)-1:] != "s" {
+		return kms.Key{}
+	}
+	seconds, err := strconv.Atoi(rotationStr[:len(rotationStr)-1])
+	if err != nil {
+		return kms.Key{}
+	}
+
+	return kms.Key{
+		RotationPeriodSeconds: types.Int(seconds, *resource.GetMetadata()),
+	}
 }
diff --git a/internal/app/tfsec/rules/azure/storage/allow_microsoft_service_bypass_rule.go b/internal/app/tfsec/rules/azure/storage/allow_microsoft_service_bypass_rule.go
index 3a642367b..a8a7f13f7 100644
--- a/internal/app/tfsec/rules/azure/storage/allow_microsoft_service_bypass_rule.go
+++ b/internal/app/tfsec/rules/azure/storage/allow_microsoft_service_bypass_rule.go
@@ -1,9 +1,7 @@
 package storage
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/azure/storage"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -80,23 +78,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"azurerm_storage_account_network_rules", "azurerm_storage_account"},
 		Base:           storage.CheckAllowMicrosoftServiceBypass,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if resourceBlock.IsResourceType("azurerm_storage_account") {
-				if resourceBlock.MissingChild("network_rules") {
-					return
-				}
-				resourceBlock = resourceBlock.GetBlock("network_rules")
-			}
-
-			if resourceBlock.HasChild("bypass") {
-				bypass := resourceBlock.GetAttribute("bypass")
-				if bypass.IsNotNil() && !bypass.Contains("AzureServices") {
-					results.Add("Resource defines a network rule that doesn't allow bypass of Microsoft Services.", bypass)
-				}
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/azure/storage/default_action_deny_rule.go b/internal/app/tfsec/rules/azure/storage/default_action_deny_rule.go
index 6de6f7ea4..bf168c9be 100644
--- a/internal/app/tfsec/rules/azure/storage/default_action_deny_rule.go
+++ b/internal/app/tfsec/rules/azure/storage/default_action_deny_rule.go
@@ -1,9 +1,7 @@
 package storage
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/azure/storage"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -35,21 +33,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"azurerm_storage_account", "azurerm_storage_account_network_rules"},
 		Base:           storage.CheckDefaultActionDeny,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if resourceBlock.IsResourceType("azurerm_storage_account") {
-				if resourceBlock.MissingChild("network_rules") {
-					return
-				}
-				resourceBlock = resourceBlock.GetBlock("network_rules")
-			}
-
-			defaultAction := resourceBlock.GetAttribute("default_action")
-			if defaultAction.IsNotNil() && defaultAction.Equals("Allow", block.IgnoreCase) {
-				results.Add("Resource defines a default_action of Allow. It should be Deny.", defaultAction)
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/azure/storage/enforce_https_rule.go b/internal/app/tfsec/rules/azure/storage/enforce_https_rule.go
index bd3e12bfc..eee8a9c6f 100644
--- a/internal/app/tfsec/rules/azure/storage/enforce_https_rule.go
+++ b/internal/app/tfsec/rules/azure/storage/enforce_https_rule.go
@@ -1,9 +1,7 @@
 package storage
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/azure/storage"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -37,18 +35,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"azurerm_storage_account"},
 		Base:           storage.CheckEnforceHttps,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if resourceBlock.HasChild("enable_https_traffic_only") {
-
-				httpsOnlyAttr := resourceBlock.GetAttribute("enable_https_traffic_only")
-
-				if httpsOnlyAttr.IsFalse() {
-					results.Add("Resource explicitly turns off secure transfer to storage account.", httpsOnlyAttr)
-				}
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/azure/storage/no_public_access_rule.go b/internal/app/tfsec/rules/azure/storage/no_public_access_rule.go
index d4d6b3ec8..6af6bfa16 100644
--- a/internal/app/tfsec/rules/azure/storage/no_public_access_rule.go
+++ b/internal/app/tfsec/rules/azure/storage/no_public_access_rule.go
@@ -1,56 +1,41 @@
 package storage
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/azure/storage"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
-	"github.com/zclconf/go-cty/cty"
 )
 
 func init() {
 	scanner.RegisterCheckRule(rule.Rule{
 		LegacyID: "AZU011",
 		BadExample: []string{`
- resource "azure_storage_container" "bad_example" {
+ resource "azurerm_storage_account" "example" {
+	name                     = "examplestoraccount"
+ }
+
+ resource "azurerm_storage_container" "bad_example" {
  	name                  = "terraform-container-storage"
+	storage_account_name  = azurerm_storage_account.example.name
  	container_access_type = "blob"
- 	
- 	properties = {
- 		"publicAccess" = "blob"
- 	}
  }
  `},
 		GoodExample: []string{`
- resource "azure_storage_container" "good_example" {
+ resource "azurerm_storage_account" "example" {
+	name                     = "examplestoraccount"
+ }
+
+ resource "azurerm_storage_container" "good_example" {
  	name                  = "terraform-container-storage"
- 	container_access_type = "blob"
- 	
- 	properties = {
- 		"publicAccess" = "off"
- 	}
+	storage_account_name  = azurerm_storage_account.example.name
+ 	container_access_type = "private"
  }
  `},
 		Links: []string{
-			"https://www.terraform.io/docs/providers/azure/r/storage_container.html#properties",
+			"https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_container",
 		},
 		RequiredTypes:  []string{"resource"},
-		RequiredLabels: []string{"azure_storage_container"},
+		RequiredLabels: []string{"azurerm_storage_container"},
 		Base:           storage.CheckNoPublicAccess,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if resourceBlock.MissingChild("properties") {
-				return
-			}
-			properties := resourceBlock.GetAttribute("properties")
-			if properties.Contains("publicAccess") {
-				value := properties.MapValue("publicAccess")
-				if value == cty.StringVal("blob") || value == cty.StringVal("container") {
-					results.Add("Resource should disable public access.", properties)
-				}
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/azure/storage/queue_services_logging_enabled_rule.go b/internal/app/tfsec/rules/azure/storage/queue_services_logging_enabled_rule.go
index b5b245da8..570940950 100644
--- a/internal/app/tfsec/rules/azure/storage/queue_services_logging_enabled_rule.go
+++ b/internal/app/tfsec/rules/azure/storage/queue_services_logging_enabled_rule.go
@@ -1,9 +1,7 @@
 package storage
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/azure/storage"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -46,17 +44,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"azurerm_storage_account"},
 		Base:           storage.CheckQueueServicesLoggingEnabled,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if resourceBlock.MissingChild("queue_properties") {
-				return
-			}
-			queueProps := resourceBlock.GetBlock("queue_properties")
-			if queueProps.MissingChild("logging") {
-				results.Add("Resource defines a Queue Services storage account without Storage Analytics logging.", queueProps)
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/azure/storage/use_secure_tls_policy_rule.go b/internal/app/tfsec/rules/azure/storage/use_secure_tls_policy_rule.go
index 5b6ca274c..76dedfbae 100644
--- a/internal/app/tfsec/rules/azure/storage/use_secure_tls_policy_rule.go
+++ b/internal/app/tfsec/rules/azure/storage/use_secure_tls_policy_rule.go
@@ -1,9 +1,7 @@
 package storage
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/azure/storage"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -32,18 +30,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"azurerm_storage_account"},
 		Base:           storage.CheckUseSecureTlsPolicy,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if resourceBlock.MissingChild("min_tls_version") {
-				results.Add("Resource should have the min tls version set to TLS1_2 .", resourceBlock)
-				return
-			}
-
-			minTlsAttr := resourceBlock.GetAttribute("min_tls_version")
-			if minTlsAttr.IsNone("TLS1_2") {
-				results.Add("Resource should have the min tls version set to TLS1_2 .", minTlsAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/google/bigquery/no_public_access_rule.go b/internal/app/tfsec/rules/google/bigquery/no_public_access_rule.go
index a6fafe79b..9cfe23d42 100644
--- a/internal/app/tfsec/rules/google/bigquery/no_public_access_rule.go
+++ b/internal/app/tfsec/rules/google/bigquery/no_public_access_rule.go
@@ -1,9 +1,7 @@
 package bigquery
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/google/bigquery"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -71,11 +69,5 @@ func init() {
 			"google_bigquery_dataset",
 		},
 		Base: bigquery.CheckNoPublicAccess,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			if specialGroupAttr := resourceBlock.GetBlock("access").GetAttribute("special_group"); specialGroupAttr.Equals("allAuthenticatedUsers") {
-				results.Add("Resource has access.special_group set to allAuthenticatedUsers", resourceBlock)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/google/dns/enable_dnssec_rule.go b/internal/app/tfsec/rules/google/dns/enable_dnssec_rule.go
index 7cdd48055..9d2c4d02d 100644
--- a/internal/app/tfsec/rules/google/dns/enable_dnssec_rule.go
+++ b/internal/app/tfsec/rules/google/dns/enable_dnssec_rule.go
@@ -1,9 +1,7 @@
 package dns
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/google/dns"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -54,13 +52,5 @@ func init() {
 			"google_dns_managed_zone",
 		},
 		Base: dns.CheckEnableDnssec,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			if stateAttr := resourceBlock.GetBlock("dnssec_config").GetAttribute("state"); stateAttr.IsNil() { // alert on use of default value
-				results.Add("Resource uses default value for dnssec_config.state", resourceBlock)
-			} else if stateAttr.NotEqual("on") {
-				results.Add("Resource does not have dnssec_config.state set to on", stateAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/google/dns/no_rsa_sha1_rule.go b/internal/app/tfsec/rules/google/dns/no_rsa_sha1_rule.go
index 7ad6d740a..08d540446 100644
--- a/internal/app/tfsec/rules/google/dns/no_rsa_sha1_rule.go
+++ b/internal/app/tfsec/rules/google/dns/no_rsa_sha1_rule.go
@@ -1,9 +1,7 @@
 package dns
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/google/dns"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -66,14 +64,5 @@ func init() {
 			"google_dns_keys",
 		},
 		Base: dns.CheckNoRsaSha1,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			if algorithmAttr := resourceBlock.GetBlock("zone_signing_keys").GetAttribute("algorithm"); algorithmAttr.Equals("rsasha1") {
-				results.Add("Data '%s' has zone_signing_keys.algorithm set to rsasha1", algorithmAttr)
-			}
-			if algorithmAttr := resourceBlock.GetBlock("key_signing_keys").GetAttribute("algorithm"); algorithmAttr.Equals("rsasha1") {
-				results.Add("Data '%s' has key_signing_keys.algorithm set to rsasha1", algorithmAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/google/kms/rotate_kms_keys_rule.go b/internal/app/tfsec/rules/google/kms/rotate_kms_keys_rule.go
index 49e18dc30..e061488f4 100644
--- a/internal/app/tfsec/rules/google/kms/rotate_kms_keys_rule.go
+++ b/internal/app/tfsec/rules/google/kms/rotate_kms_keys_rule.go
@@ -1,12 +1,8 @@
 package kms
 
 import (
-	"strconv"
-
 	"github.com/aquasecurity/defsec/rules/google/kms"
 
-	"github.com/aquasecurity/defsec/rules"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -55,28 +51,5 @@ func init() {
 			"google_kms_crypto_key",
 		},
 		Base: kms.CheckRotateKmsKeys,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			rotationAttr := resourceBlock.GetAttribute("rotation_period")
-			if rotationAttr.IsNil() || (rotationAttr.IsResolvable() && rotationAttr.IsEmpty()) {
-				results.Add("Resource does not have key rotation enabled.", resourceBlock)
-				return
-			}
-			if !rotationAttr.IsResolvable() || !rotationAttr.IsString() {
-				return
-			}
-
-			rotationStr := rotationAttr.Value().AsString()
-			if rotationStr[len(rotationStr)-1:] != "s" {
-				return
-			}
-			seconds, err := strconv.Atoi(rotationStr[:len(rotationStr)-1])
-			if err != nil {
-				return
-			}
-			if seconds > 7776000 {
-				results.Add("Resource has a key rotation of greater than 90 days.", resourceBlock)
-			}
-			return results
-		},
 	})
 }


Test patch:
diff --git a/internal/app/tfsec/rules/azure/storage/no_public_access_rule_test.go b/internal/app/tfsec/rules/azure/storage/no_public_access_rule_test.go
index f20438d12..f73bce855 100644
--- a/internal/app/tfsec/rules/azure/storage/no_public_access_rule_test.go
+++ b/internal/app/tfsec/rules/azure/storage/no_public_access_rule_test.go
@@ -16,68 +16,75 @@ func Test_AZUBlobStorageContainerNoPublicAccess(t *testing.T) {
 		mustExcludeResultCode string
 	}{
 		{
-			name: "check there is an error when the public access is set to blob",
+			name: "check there is an error when the container access type is set to blob",
 			source: `
- resource "azure_storage_container" "blob_storage_container" {
+ resource "azurerm_storage_account" "example" {
+	name                     = "examplestoraccount"
+ }
+ 
+ resource "azurerm_storage_container" "blob_storage_container" {
  	name                  = "terraform-container-storage"
  	container_access_type = "blob"
- 	
- 	properties = {
- 		"publicAccess" = "blob"
- 	}
+	storage_account_name  = azurerm_storage_account.example.name
  }
  `,
 			mustIncludeResultCode: expectedCode,
 		},
 		{
-			name: "check there is an error when the public access is set to container",
+			name: "check there is an error when the container access type is set to container",
 			source: `
- resource "azure_storage_container" "blob_storage_container" {
+ resource "azurerm_storage_account" "example" {
+	name                     = "examplestoraccount"
+ }
+
+ resource "azurerm_storage_container" "blob_storage_container" {
  	name                  = "terraform-container-storage"
- 	container_access_type = "blob"
- 	
- 	properties = {
- 		"publicAccess" = "container"
- 	}
+	storage_account_name  = azurerm_storage_account.example.name
+ 	container_access_type = "container"
  }
  `,
 			mustIncludeResultCode: expectedCode,
 		},
 		{
-			name: "check there is no failure when the public access is set to off",
+			name: "check there is no failure when the container access type is set to private",
 			source: `
- resource "azure_storage_container" "blob_storage_container" {
+ resource "azurerm_storage_account" "example" {
+ 	name                     = "examplestoraccount"
+ }
+
+ resource "azurerm_storage_container" "blob_storage_container" {
  	name                  = "terraform-container-storage"
- 	container_access_type = "blob"
- 	
- 	properties = {
- 		"publicAccess" = "off"
- 	}
+	storage_account_name  = azurerm_storage_account.example.name
+ 	container_access_type = "private"
  }
  `,
 			mustExcludeResultCode: expectedCode,
 		},
 		{
-			name: "check there is no failure when public access level is not set",
+			name: "check there is no failure when container access type is not set",
 			source: `
- resource "azure_storage_container" "blob_storage_container" {
+ resource "azurerm_storage_account" "example" {
+ 	name                     = "examplestoraccount"
+ }
+
+ resource "azurerm_storage_container" "blob_storage_container" {
  	name                  = "terraform-container-storage"
- 	container_access_type = "blob"
- 	
- 	properties = {
- 		"publicAccess" = "off"
- 	}
+	storage_account_name  = azurerm_storage_account.example.name
+	container_access_type = ""
  }
  `,
 			mustExcludeResultCode: expectedCode,
 		},
 		{
-			name: "check there is no failure when no properties are supplied",
+			name: "check there is no failure when no container access type is supplied",
 			source: `
- resource "azure_storage_container" "blob_storage_container" {
+ resource "azurerm_storage_account" "example" {
+	name                     = "examplestoraccount"
+ }
+
+ resource "azurerm_storage_container" "blob_storage_container" {
  	name                  = "terraform-container-storage"
- 	container_access_type = "blob"
- 
+	storage_account_name  = azurerm_storage_account.example.name
  }
  `,
 			mustExcludeResultCode: expectedCode,