Repository: tfsec/tfsec
Pull request #447 (2020-10-17 16:30:40)

Add documentation for AWS018
Added explanation, examples and reference links to _AWS018_ `AWSNoDescriptionInSecurityGroup` check. Added the  examples to the test as well.

Renamed the 3 documentation constants to match the scanner constants above.

Relates to #269 (actual check is already implemented here)



Patch:
diff --git a/internal/app/tfsec/checks/aws018.go b/internal/app/tfsec/checks/aws018.go
index dc3d2b987..e3c0603b6 100644
--- a/internal/app/tfsec/checks/aws018.go
+++ b/internal/app/tfsec/checks/aws018.go
@@ -13,14 +13,37 @@ import (
 // AWSNoDescriptionInSecurityGroup See https://github.com/tfsec/tfsec#included-checks for check info
 const AWSNoDescriptionInSecurityGroup scanner.RuleCode = "AWS018"
 const AWSNoDescriptionInSecurityGroupDescription scanner.RuleSummary = "Missing description for security group/security group rule."
-const AWSNoInSecurityGroupExplanation = `
+const AWSNoDescriptionInSecurityGroupExplanation = `
+Security groups and security group rules should include a description for auditing purposes.
 
+Simplifies auditing, debugging, and managing security groups.
 `
-const AWSNoInSecurityGroupBadExample = `
+const AWSNoDescriptionInSecurityGroupBadExample = `
+resource "aws_security_group" "http" {
+  name        = "http"
 
+  ingress {
+    description = "HTTP from VPC"
+    from_port   = 80
+    to_port     = 80
+    protocol    = "tcp"
+    cidr_blocks = [aws_vpc.main.cidr_block]
+  }
+}
 `
-const AWSNoInSecurityGroupGoodExample = `
+const AWSNoDescriptionInSecurityGroupGoodExample = `
+resource "aws_security_group" "http" {
+  name        = "http"
+  description = "Allow inbound HTTP traffic"
 
+  ingress {
+    description = "HTTP from VPC"
+    from_port   = 80
+    to_port     = 80
+    protocol    = "tcp"
+    cidr_blocks = [aws_vpc.main.cidr_block]
+  }
+}
 `
 
 func init() {
@@ -28,10 +51,14 @@ func init() {
 		Code: AWSNoDescriptionInSecurityGroup,
 		Documentation: scanner.CheckDocumentation{
 			Summary:     AWSNoDescriptionInSecurityGroupDescription,
-			Explanation: AWSNoInSecurityGroupExplanation,
-			BadExample:  AWSNoInSecurityGroupBadExample,
-			GoodExample: AWSNoInSecurityGroupGoodExample,
-			Links:       []string{},
+			Explanation: AWSNoDescriptionInSecurityGroupExplanation,
+			BadExample:  AWSNoDescriptionInSecurityGroupBadExample,
+			GoodExample: AWSNoDescriptionInSecurityGroupGoodExample,
+			Links: []string{
+				"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group",
+				"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule",
+				"https://www.cloudconformity.com/knowledge-base/aws/EC2/security-group-rules-description.html",
+			},
 		},
 		Provider:       scanner.AWSProvider,
 		RequiredTypes:  []string{"resource"},


Test patch:
diff --git a/internal/app/tfsec/test/aws018_test.go b/internal/app/tfsec/test/aws018_test.go
index 6f0a7c04d..a1f3d78f0 100644
--- a/internal/app/tfsec/test/aws018_test.go
+++ b/internal/app/tfsec/test/aws018_test.go
@@ -47,6 +47,16 @@ resource "aws_security_group_rule" "my-rule" {
 }`,
 			mustExcludeResultCode: checks.AWSNoDescriptionInSecurityGroup,
 		},
+		{
+			name:                  "check aws_security_group good example",
+			source:                checks.AWSNoDescriptionInSecurityGroupGoodExample,
+			mustExcludeResultCode: checks.AWSNoDescriptionInSecurityGroup,
+		},
+		{
+			name:                  "check aws_security_group bad example",
+			source:                checks.AWSNoDescriptionInSecurityGroupBadExample,
+			mustIncludeResultCode: checks.AWSNoDescriptionInSecurityGroup,
+		},
 	}
 
 	for _, test := range tests {