False Positive Terraform Azure misconfiguration avd-azu-0048,avd-azu-0050

[WhiteTomX]

IDs

avd-azu-0050, avd-azu-0048

Description

Although my nsg only opens port 53 for DNS, trivy reports open SSH and RDP. I tried to look in the checks, but couldn't figure out why.

Reproduction Steps

Create following `main.tf`


resource "azurerm_resource_group" "this" {
  name     = "rg-test"
  location = "swedencentral"
}

resource "azurerm_network_security_group" "this" {
  name                = "nsg-test"
  location            = azurerm_resource_group.this.location
  resource_group_name = azurerm_resource_group.this.name

  security_rule {
    name                       = "allow dns"
    priority                   = 1001
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = 53
    source_address_prefix      = "*" #tfsec:ignore:azure-network-no-public-ingress
    destination_address_prefix = "192.168.10.10"
  }
}

run docker run -v $PWD:/infra aquasec/trivy fs /infra --scanners secret,misconfig --exit-code 1 --trace

### Target

Filesystem

### Scanner

Misconfiguration

### Target OS

_No response_

### Debug Output

```bash
2024-10-08T13:22:55Z    DEBUG   No plugins loaded
2024-10-08T13:22:55Z    DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2024-10-08T13:22:55Z    DEBUG   Cache dir       dir="/root/.cache/trivy"
2024-10-08T13:22:55Z    DEBUG   Cache dir       dir="/root/.cache/trivy"
2024-10-08T13:22:55Z    DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-10-08T13:22:55Z    DEBUG   Ignore statuses statuses=[]
2024-10-08T13:22:55Z    INFO    [misconfig] Misconfiguration scanning is enabled
2024-10-08T13:22:55Z    DEBUG   [misconfig] Failed to open the check metadata   err="open /root/.cache/trivy/policy/metadata.json: no such file or directory"
2024-10-08T13:22:55Z    INFO    [misconfig] Need to update the built-in checks
2024-10-08T13:22:55Z    INFO    [misconfig] Downloading the built-in checks...
2024-10-08T13:22:55Z    DEBUG   [misconfig] Loading check bundle        repository="ghcr.io/aquasecurity/trivy-checks:1"
2024-10-08T13:22:57Z    ERROR   [misconfig] Falling back to embedded checks     err="failed to download built-in policies: download error: OCI repository error: 1 error occurred:\n\t* GET https://ghcr.io/v2/aquasecurity/trivy-checks/manifests/1: TOOMANYREQUESTS: retry-after: 44.465µs, allowed: 44000/minute\n\n"
2024-10-08T13:22:57Z    INFO    [secret] Secret scanning is enabled
2024-10-08T13:22:57Z    INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-10-08T13:22:57Z    INFO    [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-10-08T13:22:57Z    DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-10-08T13:22:57Z    DEBUG   Initializing scan cache...      type="memory"
2024-10-08T13:22:57Z    DEBUG   [secret] No secret config detected      config_path="trivy-secret.yaml"
2024-10-08T13:22:57Z    DEBUG   Skipping path   path=".git"
2024-10-08T13:22:57Z    DEBUG   Scanning files for misconfigurations... scanner="Terraform"
2024-10-08T13:22:57Z    DEBUG   [terraform scanner] Scanning directory  file_path="."
2024-10-08T13:22:57Z    DEBUG   [rego] Embedded libraries are loaded    count=13
2024-10-08T13:22:57Z    DEBUG   [rego] Embedded checks are loaded       count=508
2024-10-08T13:22:57Z    DEBUG   [rego] Overriding filesystem for data
2024-10-08T13:22:58Z    DEBUG   [terraform parser] Setting project/module root  module="root" file_path="."
2024-10-08T13:22:58Z    DEBUG   [terraform parser] Parsing FS   module="root" file_path="."
2024-10-08T13:22:58Z    DEBUG   [terraform parser] Parsing      module="root" file_path="main.tf"
2024-10-08T13:22:58Z    DEBUG   [terraform parser] Added file   module="root" file_path="main.tf"
2024-10-08T13:22:58Z    INFO    [terraform scanner] Scanning root module        file_path="."
2024-10-08T13:22:58Z    DEBUG   [terraform parser] Setting project/module root  module="root" file_path="."
2024-10-08T13:22:58Z    DEBUG   [terraform parser] Parsing FS   module="root" file_path="."
2024-10-08T13:22:58Z    DEBUG   [terraform parser] Parsing      module="root" file_path="main.tf"
2024-10-08T13:22:58Z    DEBUG   [terraform parser] Added file   module="root" file_path="main.tf"
2024-10-08T13:22:58Z    DEBUG   [terraform parser] Loading module       module="root" module="root"
2024-10-08T13:22:58Z    DEBUG   [terraform parser] Read block(s) and ignore(s)  module="root" blocks=2 ignores=1
2024-10-08T13:22:58Z    DEBUG   [terraform parser] Added input variables from tfvars    module="root" count=0
2024-10-08T13:22:58Z    DEBUG   [terraform parser] Working directory for module evaluation      module="root" file_path="/"
2024-10-08T13:22:58Z    DEBUG   [terraform evaluator] Starting module evaluation...     path="."
2024-10-08T13:22:58Z    DEBUG   [terraform evaluator] Starting iteration        iteration=0
2024-10-08T13:22:58Z    DEBUG   [terraform evaluator] Starting iteration        iteration=1
2024-10-08T13:22:58Z    DEBUG   [terraform evaluator] Starting iteration        iteration=2
2024-10-08T13:22:58Z    DEBUG   [terraform evaluator] Context unchanged iteration=2
2024-10-08T13:22:58Z    DEBUG   [terraform evaluator] Starting post-submodules evaluation...
2024-10-08T13:22:58Z    DEBUG   [terraform evaluator] Starting iteration        iteration=0
2024-10-08T13:22:58Z    DEBUG   [terraform evaluator] Starting iteration        iteration=1
2024-10-08T13:22:58Z    DEBUG   [terraform evaluator] Context unchanged iteration=1
2024-10-08T13:22:58Z    DEBUG   [terraform evaluator] Module evaluation complete.
2024-10-08T13:22:58Z    DEBUG   [terraform parser] Finished parsing module      module="root"
2024-10-08T13:22:58Z    DEBUG   [terraform executor] Adapting modules...
2024-10-08T13:22:58Z    DEBUG   [terraform executor] Adapted module(s) into state data. count=1
2024-10-08T13:22:58Z    DEBUG   [terraform executor] Using max routines count=1
2024-10-08T13:22:58Z    DEBUG   [terraform executor] Initialized Go check(s).   count=482
2024-10-08T13:22:58Z    DEBUG   [rego] Scanning inputs  count=1
2024-10-08T13:22:58Z    DEBUG   [terraform executor] Finished applying rules.
2024-10-08T13:22:58Z    DEBUG   [terraform executor] Applying ignores...
2024-10-08T13:22:58Z    INFO    [terraform executor] Ignore finding     rule="azure-network-no-public-ingress" range="main.tf:19"
2024-10-08T13:22:58Z    DEBUG   OS is not detected.
2024-10-08T13:22:58Z    INFO    Detected config files   num=2
2024-10-08T13:22:58Z    DEBUG   Scanned config file     file_path="main.tf"
2024-10-08T13:22:58Z    DEBUG   Scanned config file     file_path="."
2024-10-08T13:22:58Z    DEBUG   [vex] VEX filtering is disabled

main.tf (terraform)
===================
Tests: 3 (SUCCESSES: 0, FAILURES: 2, EXCEPTIONS: 1)
Failures: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 2)

CRITICAL: Security group rule allows ingress to RDP port from multiple public internet addresses.
════════════════════════════════════════
RDP access can be configured on either the network security group or in the network security group rule.
RDP access should not be permitted from the internet (*, 0.0.0.0, /0, internet, any). Consider using the Azure Bastion Service.


See https://avd.aquasec.com/misconfig/avd-azu-0048
────────────────────────────────────────
 main.tf:19
   via main.tf:11-21 (security_rule)
    via main.tf:6-22 (azurerm_network_security_group.this)
────────────────────────────────────────
   6   resource "azurerm_network_security_group" "this" {
   .   
  19 [     source_address_prefix      = "*" #tfsec:ignore:azure-network-no-public-ingress
  ..   
  22   }
────────────────────────────────────────


CRITICAL: Security group rule allows ingress to SSH port from multiple public internet addresses.
════════════════════════════════════════
SSH access can be configured on either the network security group or in the network security group rule.
SSH access should not be permitted from the internet (*, 0.0.0.0, /0, internet, any)


See https://avd.aquasec.com/misconfig/avd-azu-0050
────────────────────────────────────────
 main.tf:19
   via main.tf:11-21 (security_rule)
    via main.tf:6-22 (azurerm_network_security_group.this)
────────────────────────────────────────
   6   resource "azurerm_network_security_group" "this" {
   .   
  19 [     source_address_prefix      = "*" #tfsec:ignore:azure-network-no-public-ingress
  ..   
  22   }
────────────────────────────────────────

Version

❯ docker run -v $PWD:/infra aquasec/trivy  --version
Version: 0.56.1

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[simar7]

hi @WhiteTomX thanks for the report!

@nikpivkin I think we need to handle the destination_port_range being a single value instead of a list, as listed here

[nikpivkin]

We already support that attribute. I found that the checks are not handling ports correctly.

[nikpivkin]

Track #7681