Skip to content

fix(terraform): resolve counted IAM policy documents#8051

Open
omribz156 wants to merge 1 commit into
Checkmarx:masterfrom
omribz156:codex/kics-s3-policy-data-source-count
Open

fix(terraform): resolve counted IAM policy documents#8051
omribz156 wants to merge 1 commit into
Checkmarx:masterfrom
omribz156:codex/kics-s3-policy-data-source-count

Conversation

@omribz156
Copy link
Copy Markdown

Closes #8050

Reason for Proposed Changes

  • The Terraform parser resolved data.aws_iam_policy_document.<name>.json, but counted policy documents referenced as data.aws_iam_policy_document.<name>[0].json stayed unresolved and could make S3 Bucket Policy Accepts HTTP Requests report a false positive.

Proposed Changes

  • Store counted IAM policy documents as indexed values in the Terraform data-source evaluation map.
  • Ignore Terraform data-source meta-arguments while decoding IAM policy document bodies, so count does not break policy JSON generation.
  • Add parser and query regression coverage for a counted S3 bucket policy that denies insecure transport.

Verification:

  • go test ./pkg/parser/terraform -count=1
  • go test ./test -run 'TestQueries/.*s3_bucket_policy_accepts_http_requests_negative' -count=1
  • go run ./cmd/console/main.go scan -p assets/queries/terraform/aws/s3_bucket_policy_accepts_http_requests/test/negative9.tf -q assets/queries/terraform/aws/s3_bucket_policy_accepts_http_requests --type Terraform --disable-secrets --no-progress --silent --report-formats json --output-path .tmp-kics-output --output-name negative9 --ignore-on-exit results returned total_counter: 0.

This was implemented with Codex assistance, with the patch kept focused and manually reviewed.

I submit this contribution under the Apache-2.0 license.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug(terraform aws): false positive for s3 bucket policy accepts http requests

1 participant