Repository: tfsec/tfsec
Pull request #708 (2021-04-28 04:16:33)

Added AZU026 Ensure that the expiration date is set on all keys.
Please close issue #284, this check addressed it. 


Patch:
diff --git a/internal/app/tfsec/checks/azu026.go b/internal/app/tfsec/checks/azu026.go
new file mode 100644
index 000000000..643cd397b
--- /dev/null
+++ b/internal/app/tfsec/checks/azu026.go
@@ -0,0 +1,83 @@
+package checks
+
+import (
+	"fmt"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+)
+
+const AZUKeyVaultKeyExpirationDate scanner.RuleCode = "AZU026"
+const AZUKeyVaultKeyExpirationDateDescription scanner.RuleSummary = "Ensure that the expiration date is set on all keys"
+const AZUKeyVaultKeyExpirationDateExplanation = `
+Expiration Date is an optional Key Vault Key behavior and is not set by default.
+
+Set when the resource will be become inactive.
+`
+const AZUKeyVaultKeyExpirationDateBadExample = `
+resource "azurerm_key_vault_key" "bad_example" {
+  name         = "generated-certificate"
+  key_vault_id = azurerm_key_vault.example.id
+  key_type     = "RSA"
+  key_size     = 2048
+
+  key_opts = [
+    "decrypt",
+    "encrypt",
+    "sign",
+    "unwrapKey",
+    "verify",
+    "wrapKey",
+  ]
+}
+`
+const AZUKeyVaultKeyExpirationDateGoodExample = `
+resource "azurerm_key_vault_key" "good_example" {
+  name         = "generated-certificate"
+  key_vault_id = azurerm_key_vault.example.id
+  key_type     = "RSA"
+  key_size     = 2048
+  expiration_date = "1982-12-31T00:00:00Z"
+
+  key_opts = [
+    "decrypt",
+    "encrypt",
+    "sign",
+    "unwrapKey",
+    "verify",
+    "wrapKey",
+  ]
+}
+`
+
+func init() {
+	scanner.RegisterCheck(scanner.Check{
+		Code: AZUKeyVaultKeyExpirationDate,
+		Documentation: scanner.CheckDocumentation{
+			Summary:     AZUKeyVaultKeyExpirationDateDescription,
+			Explanation: AZUKeyVaultKeyExpirationDateExplanation,
+			BadExample:  AZUKeyVaultKeyExpirationDateBadExample,
+			GoodExample: AZUKeyVaultKeyExpirationDateGoodExample,
+			Links: []string{
+				"https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key#expiration_date",
+				"https://docs.microsoft.com/en-us/powershell/module/az.keyvault/update-azkeyvaultkey?view=azps-5.8.0#example-1--modify-a-key-to-enable-it--and-set-the-expiration-date-and-tags",
+			},
+		},
+		Provider:       scanner.AzureProvider,
+		RequiredTypes:  []string{"resource"},
+		RequiredLabels: []string{"azurerm_key_vault_key"},
+		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
+
+			if block.MissingChild("expiration_date") {
+				return []scanner.Result{
+					check.NewResult(
+						fmt.Sprintf("Resource '%s' should have an expiration date set.", block.FullName()),
+						block.Range(),
+						scanner.SeverityWarning,
+					),
+				}
+			}
+			return nil
+		},
+	})
+}


Test patch:
diff --git a/internal/app/tfsec/test/azu026_test.go b/internal/app/tfsec/test/azu026_test.go
new file mode 100644
index 000000000..6fd6bf03b
--- /dev/null
+++ b/internal/app/tfsec/test/azu026_test.go
@@ -0,0 +1,70 @@
+package test
+
+import (
+	"testing"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+)
+
+func Test_AZUKeyVaultKeyExpirationDate(t *testing.T) {
+
+	var tests = []struct {
+		name                  string
+		source                string
+		mustIncludeResultCode scanner.RuleCode
+		mustExcludeResultCode scanner.RuleCode
+	}{
+		{
+			name: "check if expiration_date is not set, check fails",
+			source: `
+resource "azurerm_key_vault_key" "bad_example" {
+  name         = "generated-certificate"
+  key_vault_id = azurerm_key_vault.example.id
+  key_type     = "RSA"
+  key_size     = 2048
+
+  key_opts = [
+    "decrypt",
+    "encrypt",
+    "sign",
+    "unwrapKey",
+    "verify",
+    "wrapKey",
+  ]
+}
+`,
+			mustIncludeResultCode: checks.AZUKeyVaultKeyExpirationDate,
+		},
+		{
+			name: "check if expiration_date is set, check passes",
+			source: `
+resource "azurerm_key_vault_key" "good_example" {
+  name         = "generated-certificate"
+  key_vault_id = azurerm_key_vault.example.id
+  key_type     = "RSA"
+  key_size     = 2048
+  expiration_date = "1982-12-31T00:00:00Z"
+
+  key_opts = [
+    "decrypt",
+    "encrypt",
+    "sign",
+    "unwrapKey",
+    "verify",
+    "wrapKey",
+  ]
+}
+`,
+			mustExcludeResultCode: checks.AZUKeyVaultKeyExpirationDate,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			results := scanSource(test.source)
+			assertCheckCode(t, test.mustIncludeResultCode, test.mustExcludeResultCode, results)
+		})
+	}
+
+}