Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix/sql allowed authorized networks.rego #126

Merged
merged 19 commits into from
Oct 4, 2019
Merged

Fix/sql allowed authorized networks.rego #126

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
cc0565e
Add 'Constraint' to the package statement
FanchenBao Jul 23, 2019
194fcd6
Add 'data' field to the statement that retrieves 'authorizedNetworks'…
FanchenBao Jul 23, 2019
712ab6f
Modify logic to include additional checking for situation where 'auth…
FanchenBao Jul 23, 2019
be624c4
Make same changes to the rego code in gcp_sql_allowed_authorized_netw…
FanchenBao Jul 23, 2019
24999cb
Merge branch 'master' of https://github.com/FanchenBao/policy-library…
FanchenBao Jul 24, 2019
be34ccc
Update branch with master
FanchenBao Jul 26, 2019
96892a6
Add 'data' field to validator/test/fixtures/sql_allowed_authorized_ne…
FanchenBao Jul 26, 2019
f2709a2
change format
FanchenBao Aug 10, 2019
72dbb91
Revert "change format"
FanchenBao Aug 10, 2019
4acd765
Format rego code
FanchenBao Aug 10, 2019
a1339fe
Format template yaml file
FanchenBao Aug 10, 2019
2067bf5
Merge branch 'master' into fix/sql_allowed_authorized_networks.rego
AdrienWalkowiak Sep 11, 2019
11046a2
Merge branch 'master' into fix/sql_allowed_authorized_networks.rego
AdrienWalkowiak Sep 16, 2019
22744c5
Merge branch 'master' into fix/sql_allowed_authorized_networks.rego
FanchenBao Oct 4, 2019
cce6f00
Update sql_allowed_authorized_networks.rego according to master
FanchenBao Oct 4, 2019
068f0a8
Add 'data' field for the new fixture
FanchenBao Oct 4, 2019
f2299f0
Fix typo
FanchenBao Oct 4, 2019
cde6f79
Add 'data' field to policy rego code
FanchenBao Oct 4, 2019
5dfe5a7
Inlining and formatting
FanchenBao Oct 4, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion policies/templates/gcp_cmek_settings_v1.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,6 @@ spec:
}] {
constraint := input.constraint
lib.get_constraint_params(constraint, params)
exempt_list := lib.get_default(params, "exemptions", [])
asset := input.asset
asset.asset_type == "cloudkms.googleapis.com/CryptoKey"

Expand Down
4 changes: 2 additions & 2 deletions policies/templates/gcp_sql_allowed_authorized_networks_v1.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,7 @@ spec:
asset := input.asset
asset.asset_type == "sqladmin.googleapis.com/Instance"

check_ssl(params, asset.resource.settings.ipConfiguration) == false
check_ssl(params, asset.resource.data.settings.ipConfiguration) == false

message := sprintf("%v has networks with SSL settings in violation of policy", [asset.name])
metadata := {"resource": asset.name}
Expand All @@ -86,7 +86,7 @@ spec:
asset := input.asset
asset.asset_type == "sqladmin.googleapis.com/Instance"

forbidden := forbidden_networks(params, asset.resource.settings.ipConfiguration)
forbidden := forbidden_networks(params, asset.resource.data.settings.ipConfiguration)
count(forbidden) > 0

message := sprintf("%v has authorized networks that are not allowed: %v", [asset.name, forbidden])
Expand Down
4 changes: 2 additions & 2 deletions validator/sql_allowed_authorized_networks.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ deny[{
asset := input.asset
asset.asset_type == "sqladmin.googleapis.com/Instance"

check_ssl(params, asset.resource.settings.ipConfiguration) == false
check_ssl(params, asset.resource.data.settings.ipConfiguration) == false

message := sprintf("%v has networks with SSL settings in violation of policy", [asset.name])
metadata := {"resource": asset.name}
Expand All @@ -44,7 +44,7 @@ deny[{
asset := input.asset
asset.asset_type == "sqladmin.googleapis.com/Instance"

forbidden := forbidden_networks(params, asset.resource.settings.ipConfiguration)
forbidden := forbidden_networks(params, asset.resource.data.settings.ipConfiguration)
count(forbidden) > 0

message := sprintf("%v has authorized networks that are not allowed: %v", [asset.name, forbidden])
Expand Down
2 changes: 1 addition & 1 deletion validator/sql_allowed_authorized_networks_test.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ test_sql_allowed_authorized_networks_default {
violation.details.resource == "//cloudsql.googleapis.com/projects/noble-history-87417/instances/authorized-networks-35"
}

test_sql_allowed_authorized_networks_ssl_disabled {
test_sql_allowed_authorized_networks_ssl_enabled {
constraints := [fixture_constraints.ssl_enabled]
violations := find_violations with data.test_constraints as constraints
count(violations) == 1
Expand Down
4 changes: 4 additions & 0 deletions validator/test/fixtures/sql_allowed_authorized_networks/assets/data.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
"name": "//cloudsql.googleapis.com/projects/noble-history-87417/instances/no-authorized-networks",
"asset_type": "sqladmin.googleapis.com/Instance",
"resource": {
"data": {
"settings": {
"activationPolicy": "ALWAYS",
"backupConfiguration": {
Expand Down Expand Up @@ -35,11 +36,13 @@
},
"state": "RUNNABLE"
}
}
},
{
"name": "//cloudsql.googleapis.com/projects/noble-history-87417/instances/authorized-networks-35",
"asset_type": "sqladmin.googleapis.com/Instance",
"resource": {
"data":{
"settings": {
"activationPolicy": "ALWAYS",
"backupConfiguration": {
Expand Down Expand Up @@ -94,4 +97,5 @@
},
"state": "RUNNABLE"
}
}
}]