def test_success(self):
hcl_res = hcl2.loads("""
resource "aws_security_group" "example_sg" {
egress {
description = "Allow outgoing communication"
cidr_blocks = ["0.0.0.0/0"]
from_port = "0"
protocol = "-1"
self = "false"
to_port = "0"
}
ingress {
description = "Self Reference"
from_port = "0"
protocol = "-1"
self = "true"
to_port = "0"
}
name = "example-lambda"
tags = {
Name = "example-sg"
}
vpc_id = aws_vpc.vpc.id
}
""")
resource_conf = hcl_res['resource'][0]['aws_security_group'][
'example_sg']
scan_result = check.scan_resource_conf(conf=resource_conf)
self.assertEqual(CheckResult.PASSED, scan_result)
def test_failure_sg_rule(self):
hcl_res = hcl2.loads("""
resource "aws_security_group_rule" "example_sg_rule_failure" {
type = "ingress"
from_port = 3389
to_port = 3389
protocol = "tcp"
cidr_blocks = "0.0.0.0/0"
security_group_id = "sg-123456"
}
""")
resource_conf = hcl_res['resource'][0]['aws_security_group_rule'][
'example_sg_rule_failure']
scan_result = check.scan_resource_conf(conf=resource_conf)
self.assertEqual(CheckResult.FAILED, scan_result)
def test_failure(self):
resource_conf = {
"name": "allow_ssh",
"vpc_id": "${aws_vpc.main.id}",
"ingress": {
# TLS (change to whatever ports you need),
"from_port": 22,
"to_port": 22,
"protocol": "-1",
"cidr_blocks": ['0.0.0.0/0'],
},
"egress": {
"from_port": 0,
"to_port": 0,
"protocol": "-1",
"cidr_blocks": ["0.0.0.0/0"],
"prefix_list_ids": ["pl-12c4e678"],
}
}
scan_result = check.scan_resource_conf(conf=resource_conf)
self.assertEqual(CheckResult.FAILED, scan_result)
def test_success(self):
resource_conf = {
"name": "allow_ssh",
"description": "Allow SSH inbound traffic",
"vpc_id": "${aws_vpc.main.id}",
"ingress": {
# TLS (change to whatever ports you need),
"from_port": 443,
"to_port": 443,
"protocol": "-1",
"cidr_blocks": ['0.0.0.0/0'],
},
"egress": {
"from_port": 0,
"to_port": 0,
"protocol": "-1",
"cidr_blocks": ["0.0.0.0/0"],
"prefix_list_ids": ["pl-12c4e678"],
}
}
scan_result = check.scan_resource_conf(conf=resource_conf)
self.assertEqual(CheckResult.PASSED, scan_result)