Add tags field to each cloud resource

[vmorkunas]

Description

Currently cloud schema (in my case AWS) does not contain resource tags, so I cannot run tag based checks on AWS resources, for example to check if specific tag exits. Would be a nice and useful feature to have not just for me I believe

Target

Filesystem

Scanner

Misconfiguration

[simar7]

hi @vmorkunas can you give us an example input and the expected output results? Is this for IaC scanning or AWS Cloud scanning?

[vmorkunas]

Hi,

I am trying to create a rego check to check if AWS resource has specific tag on it.

I have a dummy rego check which prints out all resources and details:

package user

default allow = false

deny[msg] {
    resource := input.aws[_]
    msg := sprintf("Resource %s", [resource])
}

Then I am running

trivy config --debug --ignorefile .trivyignore --config-check custom_checks/aws_tags.rego --check-namespaces user tfplan.json

on terraform plan json file, but in the output I can see only these kind of details (plan contains sns resources):

{
  "topics": [
    {
      "__defsec_metadata": {
        "endline": 66,
        "explicit": false,
        "filepath": "main.tf",
        "fskey": "94fbfc3b6d560857c8e3c00510db1d4d2de3c144118295330ecdbcddc8df302d",
        "managed": true,
        "resource": "aws_sns_topic.default_872632512c1976bd340b6d3359ebe53b",
        "sourceprefix": "",
        "startline": 45
      },
      "arn": {
        "endline": 66,
        "explicit": false,
        "filepath": "main.tf",
        "fskey": "94fbfc3b6d560857c8e3c00510db1d4d2de3c144118295330ecdbcddc8df302d",
        "managed": true,
        "resource": "aws_sns_topic.default_872632512c1976bd340b6d3359ebe53b",
        "sourceprefix": "",
        "startline": 45,
        "value": ""
      },
      "encryption": {
        "__defsec_metadata": {
          "endline": 66,
          "explicit": false,
          "filepath": "main.tf",
          "fskey": "94fbfc3b6d560857c8e3c00510db1d4d2de3c144118295330ecdbcddc8df302d",
          "managed": true,
          "resource": "aws_sns_topic.default_872632512c1976bd340b6d3359ebe53b",
          "sourceprefix": "",
          "startline": 45
        },
        "kmskeyid": {
          "endline": 66,
          "explicit": false,
          "filepath": "main.tf",
          "fskey": "94fbfc3b6d560857c8e3c00510db1d4d2de3c144118295330ecdbcddc8df302d",
          "managed": true,
          "resource": "aws_sns_topic.default_872632512c1976bd340b6d3359ebe53b",
          "sourceprefix": "",
          "startline": 45,
          "value": ""
        }
      }
    },
    {
      "__defsec_metadata": {
        "endline": 89,
        "explicit": false,
        "filepath": "main.tf",
        "fskey": "94fbfc3b6d560857c8e3c00510db1d4d2de3c144118295330ecdbcddc8df302d",
        "managed": true,
        "resource": "aws_sns_topic.default_872632512c1976bd340b6d3359ebe53b",
        "sourceprefix": "",
        "startline": 68
      },
      "arn": {
        "endline": 89,
        "explicit": false,
        "filepath": "main.tf",
        "fskey": "94fbfc3b6d560857c8e3c00510db1d4d2de3c144118295330ecdbcddc8df302d",
        "managed": true,
        "resource": "aws_sns_topic.default_872632512c1976bd340b6d3359ebe53b",
        "sourceprefix": "",
        "startline": 68,
        "value": ""
      },
      "encryption": {
        "__defsec_metadata": {
          "endline": 89,
          "explicit": false,
          "filepath": "main.tf",
          "fskey": "94fbfc3b6d560857c8e3c00510db1d4d2de3c144118295330ecdbcddc8df302d",
          "managed": true,
          "resource": "aws_sns_topic.default_872632512c1976bd340b6d3359ebe53b",
          "sourceprefix": "",
          "startline": 68
        },
        "kmskeyid": {
          "endline": 89,
          "explicit": false,
          "filepath": "main.tf",
          "fskey": "94fbfc3b6d560857c8e3c00510db1d4d2de3c144118295330ecdbcddc8df302d",
          "managed": true,
          "resource": "aws_sns_topic.default_872632512c1976bd340b6d3359ebe53b",
          "sourceprefix": "",
          "startline": 68,
          "value": ""
        }
      }
    },
    {
      "__defsec_metadata": {
        "endline": 112,
        "explicit": false,
        "filepath": "main.tf",
        "fskey": "94fbfc3b6d560857c8e3c00510db1d4d2de3c144118295330ecdbcddc8df302d",
        "managed": true,
        "resource": "aws_sns_topic.default_872632512c1976bd340b6d3359ebe53b",
        "sourceprefix": "",
        "startline": 91
      },
      "arn": {
        "endline": 112,
        "explicit": false,
        "filepath": "main.tf",
        "fskey": "94fbfc3b6d560857c8e3c00510db1d4d2de3c144118295330ecdbcddc8df302d",
        "managed": true,
        "resource": "aws_sns_topic.default_872632512c1976bd340b6d3359ebe53b",
        "sourceprefix": "",
        "startline": 91,
        "value": ""
      },
      "encryption": {
        "__defsec_metadata": {
          "endline": 112,
          "explicit": false,
          "filepath": "main.tf",
          "fskey": "94fbfc3b6d560857c8e3c00510db1d4d2de3c144118295330ecdbcddc8df302d",
          "managed": true,
          "resource": "aws_sns_topic.default_872632512c1976bd340b6d3359ebe53b",
          "sourceprefix": "",
          "startline": 91
        },
        "kmskeyid": {
          "endline": 112,
          "explicit": false,
          "filepath": "main.tf",
          "fskey": "94fbfc3b6d560857c8e3c00510db1d4d2de3c144118295330ecdbcddc8df302d",
          "managed": true,
          "resource": "aws_sns_topic.default_872632512c1976bd340b6d3359ebe53b",
          "sourceprefix": "",
          "startline": 91,
          "value": ""
        }
      }
    }
  ]
}

If this object would contain more information like tags and tags_all object, then custom checks checking tags would be easy to do.

TFPlan contains this kind of information (tags, tags_all almost on each resource):

 "resources": [
            {
              "address": "module.sns.aws_sns_topic.default[\"sns\"]",
              "mode": "managed",
              "type": "aws_sns_topic",
              "name": "default",
              "index": "sns",
              "provider_name": "registry.terraform.io/hashicorp/aws",
              "schema_version": 0,
              "values": {
                "application_failure_feedback_role_arn": "",
                "application_success_feedback_role_arn": "",
                "application_success_feedback_sample_rate": 0,
                "archive_policy": "",
                "arn": "arn:aws:sns:eu-central-1::BETA-PLAY-SNS",
                "beginning_archive_time": "",
                "content_based_deduplication": false,
                "delivery_policy": "",
                "display_name": "BETA-SNS-TOPIC",
                "fifo_topic": false,
                "firehose_failure_feedback_role_arn": "",
                "firehose_success_feedback_role_arn": "",
                "firehose_success_feedback_sample_rate": 0,
                "http_failure_feedback_role_arn": "",
                "http_success_feedback_role_arn": "",
                "http_success_feedback_sample_rate": 0,
                "id": "arn:aws:sns:eu-central-1::BETA-SNS",
                "kms_master_key_id": "",
                "lambda_failure_feedback_role_arn": "",
                "lambda_success_feedback_role_arn": "",
                "lambda_success_feedback_sample_rate": 0,
                "name": "BETA-SNS",
                "name_prefix": "BETA-SNS-TOPIC",
                "owner": "",
                "policy": "{\"Id\":\"__default_policy_ID\",\"Statement\":[{\"Action\":...\"Version\":\"2008-10-17\"}",
                "signature_version": 0,
                "sqs_failure_feedback_role_arn": "",
                "sqs_success_feedback_role_arn": "",
                "sqs_success_feedback_sample_rate": 0,
                "tags": {
                  "Name": "BETA"
                },
                "tags_all": {
                  "Deployable": "CORE",
                  "Environment": "BETA-PLAY",
                  "Name": "BETA",
                  "Owner": "CORE",
                  "Region": "EU-CENTRAL-1",
                  "Repository": "INFRA",
                  "Repository_Url": "https://gitlab.com/..."
                },
                "tracing_config": ""
              },
              "sensitive_values": {
                "tags": {},
                "tags_all": {}
              }
            },
            ...

[jamesrwhite]

We're also quite keen to have this functionality, without it we can't migrate from tfsec.

I was hoping it would be possible to write a check like the following, similar to one we have for enforcing default_tags on the provider:

# METADATA
# title: AWS S3 bucket required tags
# description: Check if an S3 bucket has the required tags set on it
# scope: package
# schemas:
#   - input: schema["cloud"]
# custom:
#   id: FCC02
#   severity: CRITICAL
#   short_code: required-aws-s3-bucket-tags
#   recommended_actions: "Add the required tags to the S3 bucket."
#   input:
#     selector:
#     - type: cloud
#       subtypes:
#       - provider: aws
#         service: s3
package fc.terraform.FCC02

import rego.v1

required_tags = ["Access", "Owner"]

deny contains res if {
  bucket := input.aws.s3.buckets[_]
  bucket_tags := object.keys(bucket.tags.value)

  some tag in required_tags
  not tag in bucket_tags

  res := result.new(
    sprintf("An AWS S3 bucket must have the '%s' tag", [tag]]),
    bucket
  )
}

For our use cases we only require it for S3 buckets and security groups.

Would you be open to a PR for just those resources initially or prefer to try and add support for all taggable resources at once?

[nikpivkin]

Hi @vmorkunas @jamesrwhite !

Is there any reason why you can't scan terraform-plan as json and write a check for the raw plan?

Check:

# METADATA
# title: AWS S3 bucket required tags
# description: Check if an S3 bucket has the required tags set on it
# scope: package
# custom:
#   id: FCC02
#   severity: CRITICAL
#   short_code: required-aws-s3-bucket-tags
#   recommended_actions: "Add the required tags to the S3 bucket."
#   input:
#     selector:
#       - type: json
package fc.terraform.FCC02

import rego.v1

required_tags = ["Access", "Owner"]

deny contains res if {
  some resource in input.planned_values.root_module.resources
  resource.type == "aws_s3_bucket"
  bucket_tags := object.keys(resource.values.tags)

  some tag in required_tags
  not tag in bucket_tags

  res := result.new(
    sprintf("An AWS S3 bucket %q must have the %q tag", [resource.values.bucket, tag]),
    tag
  )
}

Output:

❯ trivy conf tfplan.json --misconfig-scanners json --config-check required_tags.rego --check-namespaces fc -q

tfplan.json (json)

Tests: 2 (SUCCESSES: 0, FAILURES: 2)
Failures: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 2)

 (CRITICAL): An AWS S3 bucket "test" must have the "Access" tag
════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Check if an S3 bucket has the required tags set on it
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────


 (CRITICAL): An AWS S3 bucket "test" must have the "Owner" tag
════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Check if an S3 bucket has the required tags set on it
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

[jamesrwhite]

@nikpivkin thanks for the suggestion! That would work I suppose but it would require changing the order of all of our pipelines across many repos as we'd need to run the plan before trivy where previously we either ran tfsec and then the plan or both concurrently. We are really trying to avoid having to make changes across all repos during this migration.

The output of this is also a bit less friendly in pointing you to exactly which file the issue is in.

With that in mind my preference would still to be able to run the check statically on the terraform code as we did before. Is supporting this planned?