Repository: tfsec/tfsec
Pull request #484 (2020-10-27 18:38:57)

Added check: Ensure AKS logging to Azure Monitoring is Configured
Added check: Ensure AKS logging to Azure Monitoring is Configured


Patch:
diff --git a/internal/app/tfsec/checks/azu009.go b/internal/app/tfsec/checks/azu009.go
new file mode 100644
index 000000000..72e748bf8
--- /dev/null
+++ b/internal/app/tfsec/checks/azu009.go
@@ -0,0 +1,88 @@
+package checks
+
+import (
+	"fmt"
+	"github.com/tfsec/tfsec/internal/app/tfsec/parser"
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+	"github.com/zclconf/go-cty/cty"
+)
+
+const AZUAKSAzureMonitor scanner.RuleCode = "AZU009"
+const AZUAKSAzureMonitorDescription scanner.RuleSummary = "Ensure AKS logging to Azure Monitoring is Configured"
+const AZUAKSAzureMonitorExplanation = `
+Ensure AKS logging to Azure Monitoring is configured for containers to monitor the performance of workloads.
+`
+const AZUAKSAzureMonitorBadExample = `
+resource "azurerm_kubernetes_cluster" "my-aks-cluster" {
+    addon_profile {}
+}
+`
+const AZUAKSAzureMonitorGoodExample = `
+resource "azurerm_kubernetes_cluster" "my-aks-cluster" {
+    addon_profile {
+		oms_agent {
+			enabled = true
+		}
+	}
+}
+`
+
+func init() {
+	scanner.RegisterCheck(scanner.Check{
+		Code: AZUAKSAzureMonitor,
+		Documentation: scanner.CheckDocumentation{
+			Summary:     AZUAKSAzureMonitorDescription,
+			Explanation: AZUAKSAzureMonitorExplanation,
+			BadExample:  AZUAKSAzureMonitorBadExample,
+			GoodExample: AZUAKSAzureMonitorGoodExample,
+			Links: []string{
+				"https://www.terraform.io/docs/providers/azurerm/r/kubernetes_cluster.html#oms_agent",
+				"https://docs.microsoft.com/en-us/azure/azure-monitor/insights/container-insights-onboard",
+			},
+		},
+		Provider:       scanner.AzureProvider,
+		RequiredTypes:  []string{"resource"},
+		RequiredLabels: []string{"azurerm_kubernetes_cluster"},
+		CheckFunc: func(check *scanner.Check, block *parser.Block, _ *scanner.Context) []scanner.Result {
+
+			addonprofileBlock := block.GetBlock("addon_profile")
+			if addonprofileBlock == nil {
+				return []scanner.Result{
+					check.NewResult(
+						fmt.Sprintf("Resource '%s' AKS logging to Azure Monitoring is not configured (missing addon_profile).", block.FullName()),
+						block.Range(),
+						scanner.SeverityError,
+					),
+				}
+			}
+
+			omsagentBlock := addonprofileBlock.GetBlock("oms_agent")
+			if omsagentBlock == nil {
+				return []scanner.Result{
+					check.NewResult(
+						fmt.Sprintf("Resource '%s' AKS logging to Azure Monitoring is not configured (missing oms_agent).", block.FullName()),
+						block.Range(),
+						scanner.SeverityError,
+					),
+				}
+			}
+
+			enabledAttr := omsagentBlock.GetAttribute("enabled")
+			if enabledAttr.Type() == cty.Bool && enabledAttr.Value().False() || enabledAttr == nil{
+				return []scanner.Result{
+					check.NewResultWithValueAnnotation(
+						fmt.Sprintf(
+							"Resource '%s' AKS logging to Azure Monitoring is not configured (oms_agent disabled).",
+							block.FullName(),
+						),
+						enabledAttr.Range(),
+						enabledAttr,
+						scanner.SeverityError,
+					),
+				}
+			}
+
+			return nil
+		},
+	})
+}


Test patch:
diff --git a/internal/app/tfsec/test/azu009_test.go b/internal/app/tfsec/test/azu009_test.go
new file mode 100644
index 000000000..12ad3c258
--- /dev/null
+++ b/internal/app/tfsec/test/azu009_test.go
@@ -0,0 +1,66 @@
+package test
+
+import (
+	"testing"
+
+	"github.com/tfsec/tfsec/internal/app/tfsec/checks"
+	"github.com/tfsec/tfsec/internal/app/tfsec/scanner"
+)
+
+func Test_AZUAKSAzureMonitor(t *testing.T) {
+
+	var tests = []struct {
+		name                  string
+		source                string
+		mustIncludeResultCode scanner.RuleCode
+		mustExcludeResultCode scanner.RuleCode
+	}{
+		{
+			name: "check azurerm_kubernetes_cluster with no addon_profile define",
+			source: `
+resource "azurerm_kubernetes_cluster" "my-aks-cluster" {
+}`,
+			mustIncludeResultCode: checks.AZUAKSAzureMonitor,
+		},
+		{
+			name: "check azurerm_kubernetes_cluster with no oms_agent define",
+			source: `
+resource "azurerm_kubernetes_cluster" "my-aks-cluster" {
+	addon_profile {}
+}`,
+			mustIncludeResultCode: checks.AZUAKSAzureMonitor,
+		},
+		{
+			name: "check azurerm_kubernetes_cluster with oms_agent disabled",
+			source: `
+resource "azurerm_kubernetes_cluster" "my-aks-cluster" {
+	addon_profile {
+		oms_agent {
+			enabled = false
+		}
+	}
+}`,
+			mustIncludeResultCode: checks.AZUAKSAzureMonitor,
+		},
+		{
+			name: "check azurerm_kubernetes_cluster with oms_agent enabled",
+			source: `
+resource "azurerm_kubernetes_cluster" "my-aks-cluster" {
+	addon_profile {
+		oms_agent {
+			enabled = true
+		}
+	}
+}`,
+			mustExcludeResultCode: checks.AZUAKSAzureMonitor,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			results := scanSource(test.source)
+			assertCheckCode(t, test.mustIncludeResultCode, test.mustExcludeResultCode, results)
+		})
+	}
+
+}