nebius/SWE-rebench-V2-PRs huggingface dataset:
Repository: tfsec/tfsec
Pull request #460 (2020-10-22 07:06:12)

logging does not need when s3 bucket is for logging
I try to implement that logging does not need when s3 bucket is for logging.

Resolves https://github.com/tfsec/tfsec/issues/458

I am looking for opinions (ex. better implementation ideas).

It may be better to check whether the bucket is specified by other bucket as logging target, but I didn't immediately know how to realize it.

owenrumney: Hey @hgsgtk, thanks for the contribution we're sorry it's taken a while to respond. 

I like the rationale of this check, my hesitation is around using the ACL as an indicator of intent. I think in this case it's probably okay.

I think the only alternative is to use a local ignore on the bucket definition which possibly is no more desirable.



Patch:
diff --git a/internal/app/tfsec/checks/aws002.go b/internal/app/tfsec/checks/aws002.go
index 2a4f27d97..d6e22abff 100644
--- a/internal/app/tfsec/checks/aws002.go
+++ b/internal/app/tfsec/checks/aws002.go
@@ -44,6 +44,9 @@ func init() {
 		RequiredLabels: []string{"aws_s3_bucket"},
 		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
 			if loggingBlock := block.GetBlock("logging"); loggingBlock == nil {
+				if block.GetAttribute("acl") != nil && block.GetAttribute("acl").Value().AsString() == "log-delivery-write" {
+					return nil
+				}
 				return []scanner.Result{
 					check.NewResult(
 						fmt.Sprintf("Resource '%s' does not have logging enabled.", block.FullName()),


Test patch:
diff --git a/internal/app/tfsec/test/aws002_test.go b/internal/app/tfsec/test/aws002_test.go
index 3168cbe87..e47d972d5 100644
--- a/internal/app/tfsec/test/aws002_test.go
+++ b/internal/app/tfsec/test/aws002_test.go
@@ -30,6 +30,14 @@ resource "aws_s3_bucket" "my-bucket" {
 	logging {
 		target_bucket = "target-bucket"
 	}
+}`,
+			mustExcludeResultCode: checks.AWSNoBucketLogging,
+		},
+		{
+			name: "check bucket with acl 'log-delivery-write' for logging",
+			source: `
+resource "aws_s3_bucket" "my-bucket" {
+	acl = "log-delivery-write"
 }`,
 			mustExcludeResultCode: checks.AWSNoBucketLogging,
 		},
Repository: tfsec/tfsec
Pull request #536 (2020-12-14 13:04:43)

AWS KMS key rotation not available for SIGN_VERIFY keys
This should allow folks to avoid ignoring cases they can do nothing about.


Patch:
diff --git a/internal/app/tfsec/checks/aws019.go b/internal/app/tfsec/checks/aws019.go
index 193e47fc4..89b4fbc89 100644
--- a/internal/app/tfsec/checks/aws019.go
+++ b/internal/app/tfsec/checks/aws019.go
@@ -41,6 +41,12 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_kms_key"},
 		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
+			keyUsageAttr := block.GetAttribute("key_usage")
+
+			if keyUsageAttr != nil && keyUsageAttr.Equals("SIGN_VERIFY") {
+				return nil
+			}
+
 			keyRotationAttr := block.GetAttribute("enable_key_rotation")
 
 			if keyRotationAttr == nil {


Test patch:
diff --git a/internal/app/tfsec/test/aws019_test.go b/internal/app/tfsec/test/aws019_test.go
index 94e06734c..aa2efad22 100644
--- a/internal/app/tfsec/test/aws019_test.go
+++ b/internal/app/tfsec/test/aws019_test.go
@@ -32,6 +32,14 @@ resource "aws_kms_key" "kms_key" {
 			source: `
 resource "aws_kms_key" "kms_key" {
 	enable_key_rotation = true
+}`,
+			mustExcludeResultCode: checks.AWSNoKMSAutoRotate,
+		},
+		{
+			name: "check SIGN_VERIFY KMS Key with auto-rotation disabled",
+			source: `
+resource "aws_kms_key" "kms_key" {
+	key_usage = "SIGN_VERIFY"
 }`,
 			mustExcludeResultCode: checks.AWSNoKMSAutoRotate,
 		},
Repository: tfsec/tfsec
Pull request #551 (2021-01-11 04:48:46)

Matchspec contains autoscaling grp support
Matchspec contains autoscaling grp support


Patch:
diff --git a/internal/app/tfsec/parser/attribute.go b/internal/app/tfsec/parser/attribute.go
index c69e250ee..2e0b89a36 100644
--- a/internal/app/tfsec/parser/attribute.go
+++ b/internal/app/tfsec/parser/attribute.go
@@ -73,6 +73,13 @@ func (attr *Attribute) Contains(checkValue interface{}) bool {
 	if val.Type().IsListType() || val.Type().IsTupleType() {
 		valueSlice := val.AsValueSlice()
 		for _, value := range valueSlice {
+			if value.Type().IsObjectType() || value.Type().IsMapType() {
+				valueMap := value.AsValueMap()
+				if valueMap["key"].AsString() == checkValue {
+					return true
+				}
+				return false
+			}
 			if value.AsString() == checkValue {
 				return true
 			}


Test patch:
diff --git a/internal/app/tfsec/parser/attribute_test.go b/internal/app/tfsec/parser/attribute_test.go
index 87380cc88..6205ef291 100644
--- a/internal/app/tfsec/parser/attribute_test.go
+++ b/internal/app/tfsec/parser/attribute_test.go
@@ -178,6 +178,27 @@ resource "aws_security_group" "my-security_group" {
 			checkValue:     "172.0.0.0/8",
 			expectedResult: true,
 		},
+		{
+			name: "autoscaling group has propagated key defined",
+			source: `
+resource "aws_autoscaling_group" "my-aws_autoscaling_group" {		
+	tags = [
+		{
+			"key"                 = "Name"
+			"propagate_at_launch" = "true"
+			"value"               = "couchbase-seb-develop-dev"
+		},
+		{
+			"key"                 = "app"
+			"propagate_at_launch" = "true"
+			"value"               = "myapp"
+		}
+		]
+}`,
+			checkAttribute: "tags",
+			checkValue:     "Name",
+			expectedResult: true,
+		},
 	}
 
 	for _, test := range tests {