@intentius/chant-lexicon-terraform 0.101.0 → 0.104.0

package/src/lint/post-synth/fixtures/TF031/positive-heredoc.tf

@@ -0,0 +1,149 @@
+# Vendored for TF031 (chant #2286), unmodified below this header.
+# Source: https://github.com/terraform-community-modules/tf_aws_ecs/blob/4a41e9c5acf4b71893bcb1ab3856c7c630f283d6/iam.tf
+# Repository: terraform-community-modules/tf_aws_ecs, path iam.tf, commit 4a41e9c5acf4b71893bcb1ab3856c7c630f283d6
+# Licence: MIT
+#
+# A heredoc with no interpolation is a literal string in the parse, so TF031
+# reads it as JSON: aws_iam_policy.ecs_policy (Resource "*") fires, and so does
+# data.aws_iam_policy_document.consul_task_policy. aws_iam_policy.custom_ecs_policy
+# is "${var.custom_iam_policy}" and is reported as not determined.
+#
+# Copyright (c) 2016 Tim Hartmann
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+resource "aws_iam_instance_profile" "ecs_profile" {
+  name_prefix = "${replace(format("%.102s", replace("tf-ECSProfile-${var.name}-", "_", "-")), "/\\s/", "-")}"
+  role        = "${aws_iam_role.ecs_role.name}"
+  path        = "${var.iam_path}"
+}
+
+resource "aws_iam_role" "ecs_role" {
+  name_prefix = "${replace(format("%.32s", replace("tf-ECSInRole-${var.name}-", "_", "-")), "/\\s/", "-")}"
+  path        = "${var.iam_path}"
+
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+      "Service": ["ecs.amazonaws.com", "ec2.amazonaws.com"]
+
+    },
+    "Effect": "Allow",
+    "Sid": ""
+    }
+  ]
+}
+EOF
+}
+
+# It may be useful to add the following for troubleshooting the InstanceStatus
+# Health check if using the fitnesskeeper/consul docker image
+# "ec2:Describe*",
+# "autoscaling:Describe*",
+
+resource "aws_iam_policy" "ecs_policy" {
+  name_prefix = "${replace(format("%.102s", replace("tf-ECSInPol-${var.name}-", "_", "-")), "/\\s/", "-")}"
+  description = "A terraform created policy for ECS"
+  path        = "${var.iam_path}"
+  count       = "${length(var.custom_iam_policy) > 0 ? 0 : 1}"
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "ecs:CreateCluster",
+        "ecs:DeregisterContainerInstance",
+        "ecs:DiscoverPollEndpoint",
+        "ecs:Poll",
+        "ecs:RegisterContainerInstance",
+        "ecs:StartTelemetrySession",
+        "ecs:Submit*",
+        "ecr:GetAuthorizationToken",
+        "ecr:BatchCheckLayerAvailability",
+        "ecr:GetDownloadUrlForLayer",
+        "ecr:BatchGetImage",
+        "logs:CreateLogStream",
+        "logs:PutLogEvents"
+      ],
+      "Resource": "*"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_policy" "custom_ecs_policy" {
+  name_prefix = "${replace(format("%.102s", replace("tf-ECSInPol-${var.name}-", "_", "-")), "/\\s/", "-")}"
+  description = "A terraform created policy for ECS"
+  path        = "${var.iam_path}"
+  count       = "${length(var.custom_iam_policy) > 0 ? 1 : 0}"
+
+  policy = "${var.custom_iam_policy}"
+}
+
+resource "aws_iam_policy_attachment" "attach_ecs" {
+  name       = "ecs-attachment"
+  roles      = ["${aws_iam_role.ecs_role.name}"]
+  policy_arn = "${element(concat(aws_iam_policy.ecs_policy.*.arn, aws_iam_policy.custom_ecs_policy.*.arn), 0)}"
+}
+
+# IAM Resources for Consul and Registrator Agents
+
+data "aws_iam_policy_document" "consul_task_policy" {
+  statement {
+    actions = [
+      "ec2:Describe*",
+      "autoscaling:Describe*",
+    ]
+
+    resources = ["*"]
+  }
+}
+
+data "aws_iam_policy_document" "assume_role_consul_task" {
+  statement {
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["ecs-tasks.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_role" "consul_task" {
+  count              = "${var.enable_agents ? 1 : 0}"
+  name_prefix        = "${replace(format("%.32s", replace("tf-agentTaskRole-${var.name}-", "_", "-")), "/\\s/", "-")}"
+  path               = "${var.iam_path}"
+  assume_role_policy = "${data.aws_iam_policy_document.assume_role_consul_task.json}"
+}
+
+resource "aws_iam_role_policy" "consul_ecs_task" {
+  count       = "${var.enable_agents ? 1 : 0}"
+  name_prefix = "${replace(format("%.102s", replace("tf-agentTaskPol-${var.name}-", "_", "-")), "/\\s/", "-")}"
+  role        = "${aws_iam_role.consul_task.id}"
+  policy      = "${data.aws_iam_policy_document.consul_task_policy.json}"
+}

package/src/lint/post-synth/fixtures/TF031/positive-jsonencode.tf

@@ -0,0 +1,115 @@
+# Vendored for TF031 (chant #2286), unmodified below this header.
+# Source: https://github.com/BishopFox/iam-vulnerable/blob/0f298666f9b7cfa01488b86912afdb211773188a/modules/free-resources/privesc-paths/privesc-AssumeRole.tf
+# Repository: BishopFox/iam-vulnerable, path modules/free-resources/privesc-paths/privesc-AssumeRole.tf, commit 0f298666f9b7cfa01488b86912afdb211773188a
+# Licence: MIT
+#
+# TF031 fires on aws_iam_policy.privesc-AssumeRole-high-priv-policy: a literal
+# jsonencode() policy whose one Allow statement has Action "*" and Resource "*".
+# The three roles' assume_role_policy documents carry a reference Principal
+# beside a literal Action, and are read as scoped, not as not determined.
+#
+# Copyright (c) 2021 Bishop Fox
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+resource "aws_iam_policy" "privesc-AssumeRole-high-priv-policy" {
+  name        = "privesc-AssumeRole-high-priv-policy"
+  path        = "/"
+  description = "Allows privesc via targeted sts:AssumeRole"
+
+  # Terraform's "jsonencode" function converts a
+  # Terraform expression result to valid JSON syntax.
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect   = "Allow"
+        Action = "*"
+        Resource = "*"
+      },
+    ]
+  })
+}
+
+resource "aws_iam_role" "privesc-AssumeRole-starting-role" {
+  name                = "privesc-AssumeRole-starting-role"
+  assume_role_policy  = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = "sts:AssumeRole"
+        Effect = "Allow"
+        Sid    = ""
+        Principal = {
+          AWS = var.aws_assume_role_arn
+        }
+      },
+    ]
+  })
+}
+
+resource "aws_iam_role" "privesc-AssumeRole-intermediate-role" {
+  name                = "privesc-AssumeRole-intermediate-role"
+  assume_role_policy  = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = "sts:AssumeRole"
+        Effect = "Allow"
+        Sid    = ""
+        Principal = {
+          AWS = aws_iam_role.privesc-AssumeRole-starting-role.arn
+        }
+      },
+    ]
+  })
+}
+
+
+resource "aws_iam_role" "privesc-AssumeRole-ending-role" {
+  name                = "privesc-AssumeRole-ending-role"
+  assume_role_policy  = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = "sts:AssumeRole"
+        Effect = "Allow"
+        Sid    = ""
+        Principal = {
+          AWS = aws_iam_role.privesc-AssumeRole-intermediate-role.arn
+        }
+      },
+    ]
+  })
+}
+
+
+
+resource "aws_iam_user" "privesc-AssumeRole-start-user" {
+  name = "privesc-AssumeRole-start-user"
+  path = "/"
+}
+resource "aws_iam_access_key" "privesc-AssumeRole-start-user" {
+  user = aws_iam_user.privesc-AssumeRole-start-user.name
+}
+resource "aws_iam_role_policy_attachment" "privesc-AssumeRole-high-priv-policy-role-attach-policy" {
+  role       = aws_iam_role.privesc-AssumeRole-ending-role.name
+  policy_arn = aws_iam_policy.privesc-AssumeRole-high-priv-policy.arn
+
+}  

package/src/lint/post-synth/fixtures/TF032/negative-heredoc.tf

@@ -0,0 +1,20 @@
+# Vendored for TF032 (chant #2287). Source: https://github.com/aquasecurity/trivy-checks
+# Path: checks/cloud/aws/ecs/no_plaintext_secrets.yaml (terraform.good[0])
+# Commit: 71c05d02845cc2c3a5dfa4fe914a68a052cc88bf
+# Licence: MIT
+# Copyright (c) 2024 Aqua Security. MIT licence: https://github.com/aquasecurity/trivy-checks/blob/71c05d02845cc2c3a5dfa4fe914a68a052cc88bf/LICENSE
+# The upstream check's own passing example, lifted out of its YAML block scalar unchanged.
+# Silent: the one environment entry is not a credential.
+
+resource "aws_ecs_task_definition" "good_example" {
+  container_definitions = <<EOF
+ [
+   {
+     "name": "my_service",
+     "environment": [
+       { "name": "ENVIRONMENT", "value": "development" }
+     ]
+   }
+ ]
+ EOF
+}

package/src/lint/post-synth/fixtures/TF032/negative-references.tf

@@ -0,0 +1,214 @@
+# Vendored for TF032 (chant #2287). Source: https://github.com/testdrivenio/django-ecs-terraform
+# Path: terraform/07_ecs.tf
+# Commit: 6571bcce48cee37fa10b1ee9a5caec147356b047
+# Licence: MIT
+# Copyright (c) 2023 TestDriven.io. MIT licence: https://github.com/testdrivenio/django-ecs-terraform/blob/6571bcce48cee37fa10b1ee9a5caec147356b047/LICENSE
+# Copied verbatim below this header. No finding: RDS_PASSWORD is var.rds_password (a reference, not a literal), and the collectstatic task has no environment. The app task's container_definitions is data.template_file.app.rendered, which is not determined.
+
+resource "aws_ecs_cluster" "production" {
+  name = "${var.ecs_cluster_name}-cluster"
+}
+
+data "template_file" "app" {
+  template = file("templates/django_app.json.tpl")
+
+  vars = {
+    docker_image_url_django = var.docker_image_url_django
+    docker_image_url_nginx  = var.docker_image_url_nginx
+    region                  = var.region
+    rds_db_name             = var.rds_db_name
+    rds_username            = var.rds_username
+    rds_password            = var.rds_password
+    rds_hostname            = aws_db_instance.production.address
+    allowed_hosts           = var.allowed_hosts
+  }
+}
+
+resource "aws_ecs_task_definition" "app" {
+  family                   = "django-app"
+  depends_on               = [aws_db_instance.production]
+  network_mode             = "awsvpc" # Required for Fargate
+  requires_compatibilities = ["FARGATE"]
+  cpu                      = "${var.fargate_cpu}"
+  memory                   = "${var.fargate_memory}"
+  execution_role_arn       = aws_iam_role.ecs-task-execution-role.arn
+  task_role_arn            = aws_iam_role.ecs-task-execution-role.arn
+  container_definitions    = data.template_file.app.rendered
+  volume {
+    name = "efs-volume"
+    efs_volume_configuration {
+      file_system_id          = aws_efs_file_system.efs.id
+      root_directory          = "/"
+      transit_encryption      = "ENABLED"
+      transit_encryption_port = 2049
+      authorization_config {
+        access_point_id = aws_efs_access_point.app_access_point.id
+        iam             = "ENABLED"
+      }
+    }
+  }
+}
+
+resource "aws_ecs_service" "production" {
+  name            = "${var.ecs_cluster_name}-service"
+  cluster         = aws_ecs_cluster.production.id
+  task_definition = aws_ecs_task_definition.app.arn
+  launch_type     = "FARGATE"
+  desired_count   = var.app_count
+  network_configuration {
+    subnets          = [aws_subnet.public-subnet-1.id, aws_subnet.public-subnet-2.id]
+    security_groups  = [aws_security_group.ecs-fargate.id]
+    assign_public_ip = true
+  }
+
+  load_balancer {
+    target_group_arn = aws_alb_target_group.default-target-group.arn
+    container_name   = "nginx"
+    container_port   = 80
+  }
+}
+
+resource "aws_ecs_task_definition" "django_migration" {
+  family                = "django-migration-task"
+  network_mode          = "awsvpc"
+  requires_compatibilities = ["FARGATE"]
+  cpu                   = var.fargate_cpu
+  memory                = var.fargate_memory
+  execution_role_arn    = aws_iam_role.ecs-task-execution-role.arn
+
+  container_definitions = jsonencode([
+    {
+      name  = "django-migration-container"
+      image = var.docker_image_url_django
+      environment: [
+        {
+            "name": "RDS_DB_NAME",
+            "value": var.rds_db_name
+        },
+        {
+            "name": "RDS_USERNAME",
+            "value": var.rds_username
+        },
+        {
+            "name": "RDS_PASSWORD",
+            "value": var.rds_password
+        },
+        {
+            "name": "RDS_HOSTNAME",
+            "value": aws_db_instance.production.address
+        },
+        {
+            "name": "RDS_PORT",
+            "value": "5432"
+        }
+      ],
+      # Run migrations as the command
+      command = ["python", "manage.py", "migrate"]
+
+      # Add log configuration for CloudWatch
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          awslogs-group         = "/ecs/django-app"
+          awslogs-region        = var.region
+          awslogs-stream-prefix = "ecs"
+        }
+      }
+
+      # Other required configurations go here...
+      portMappings = [
+        {
+          containerPort = 8000
+        }
+      ]
+    }
+  ])
+}
+
+resource "aws_efs_file_system" "efs" {
+  lifecycle_policy {
+    transition_to_ia = "AFTER_30_DAYS"
+  }
+}
+
+resource "aws_efs_access_point" "app_access_point" {
+  file_system_id = aws_efs_file_system.efs.id
+  posix_user {
+    uid = 1000
+    gid = 1000
+  }
+  root_directory {
+    path = "/efs"
+    creation_info {
+      owner_uid   = 1000
+      owner_gid   = 1000
+      permissions = "755"
+    }
+  }
+}
+
+resource "aws_efs_mount_target" "efs_mount" {
+  count           = length([aws_subnet.public-subnet-1.id, aws_subnet.public-subnet-2.id])
+  file_system_id  = aws_efs_file_system.efs.id
+  subnet_id       = [aws_subnet.public-subnet-1.id, aws_subnet.public-subnet-2.id][count.index]
+  security_groups = [aws_security_group.efs_sg.id]
+}
+
+resource "aws_ecs_task_definition" "django_collectstatic" {
+  family                = "django-collectstatic-task"
+  network_mode          = "awsvpc"
+  requires_compatibilities = ["FARGATE"]
+  cpu                   = var.fargate_cpu
+  memory                = var.fargate_memory
+  execution_role_arn    = aws_iam_role.ecs-task-execution-role.arn
+  task_role_arn         = aws_iam_role.ecs-task-execution-role.arn
+  volume {
+    name = "efs-volume"
+    efs_volume_configuration {
+      file_system_id          = aws_efs_file_system.efs.id
+      root_directory          = "/"
+      transit_encryption      = "ENABLED"
+      transit_encryption_port = 2049
+      authorization_config {
+        access_point_id = aws_efs_access_point.app_access_point.id
+        iam             = "ENABLED"
+      }
+    }
+  }
+  container_definitions = jsonencode([
+    {
+      name  = "django-collectstatic-container"
+      image = var.docker_image_url_django
+      linuxParameters = {
+        user = "1000:1000"
+      },
+      # Run collectstatic as the command
+      command = ["python", "manage.py", "collectstatic", "--no-input", "-v", "3"]
+
+      mountPoints = [
+        {
+          sourceVolume = "efs-volume",
+          containerPath = "/efs/staticfiles/",
+          readOnly = false
+        }
+      ]
+
+      # Add log configuration for CloudWatch
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          awslogs-group         = "/ecs/django-app"
+          awslogs-region        = var.region
+          awslogs-stream-prefix = "ecs"
+        }
+      }
+
+      # Other required configurations go here...
+      portMappings = [
+        {
+          containerPort = 8000
+        }
+      ]
+    }
+  ])
+}

package/src/lint/post-synth/fixtures/TF032/negative.tf

@@ -0,0 +1,99 @@
+# Vendored for TF032 (chant #2287). Source: https://github.com/vapor/penny-bot
+# Path: infra/ecs.tf
+# Commit: e1481d187e703649e2116d36c3cb022357946916
+# Licence: Apache-2.0
+# Copyright the penny-bot contributors. Licensed under the Apache License, Version 2.0: https://github.com/vapor/penny-bot/blob/e1481d187e703649e2116d36c3cb022357946916/LICENSE
+# Copied verbatim below this header. Unmodified. Silent: BOT_TOKEN and SO_API_KEY arrive through secrets/valueFrom, and environment holds only a literal stage name and a reference.
+
+resource "aws_ecs_cluster" "penny" {
+  name = module.constants.ecs_cluster_name
+}
+
+resource "aws_ecs_task_definition" "penny" {
+  family                   = "penny-bot"
+  skip_destroy             = true
+  cpu                      = "256"
+  memory                   = "512"
+  network_mode             = "awsvpc"
+  requires_compatibilities = ["FARGATE"]
+  execution_role_arn       = data.aws_iam_role.ecs_task_execution.arn
+  task_role_arn            = data.aws_iam_role.ecs_task.arn
+
+  runtime_platform {
+    cpu_architecture        = "ARM64"
+    operating_system_family = "LINUX"
+  }
+
+  container_definitions = jsonencode([
+    {
+      name           = "penny-bot"
+      image          = "${aws_ecr_repository.penny_bot_discord_image.repository_url}:${local.penny_image_tag}"
+      cpu            = 0
+      essential      = true
+      portMappings   = []
+      mountPoints    = []
+      volumesFrom    = []
+      systemControls = []
+      environment = [
+        {
+          name  = "DEPLOYMENT_ENVIRONMENT"
+          value = "prod"
+        },
+        {
+          name  = "GH_OAUTH_CLIENT_ID"
+          value = module.constants.gh_oauth_client_id
+        }
+      ]
+      secrets = [
+        {
+          name      = "BOT_TOKEN"
+          valueFrom = aws_secretsmanager_secret.discord_bot_token.arn
+        },
+        {
+          name      = "LOGGING_WEBHOOK_URL"
+          valueFrom = aws_secretsmanager_secret.logs_webhook_url.arn
+        },
+        {
+          name      = "ACCOUNT_LINKING_OAUTH_FLOW_PRIV_KEY"
+          valueFrom = aws_secretsmanager_secret.account_linking_priv_key.arn
+        },
+        {
+          name      = "SO_API_KEY"
+          valueFrom = aws_secretsmanager_secret.stack_overflow_api_key.arn
+        }
+      ]
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          awslogs-group         = aws_cloudwatch_log_group.ecs_api.name
+          awslogs-region        = local.region
+          awslogs-stream-prefix = "ecs"
+        }
+      }
+    }
+  ])
+}
+
+resource "aws_ecs_service" "penny" {
+  name                  = module.constants.ecs_service_name
+  cluster               = aws_ecs_cluster.penny.id
+  task_definition       = "${aws_ecs_task_definition.penny.family}:${aws_ecs_task_definition.penny.revision}"
+  desired_count         = 1
+  launch_type           = "FARGATE"
+  platform_version      = "1.4.0"
+  wait_for_steady_state = true
+
+  deployment_minimum_healthy_percent = 100
+  deployment_maximum_percent         = 200
+
+  deployment_circuit_breaker {
+    enable   = true
+    rollback = true
+  }
+
+  network_configuration {
+    subnets          = data.aws_subnets.default.ids
+    security_groups  = [aws_security_group.ecs_service.id]
+    assign_public_ip = true
+  }
+}

package/src/lint/post-synth/fixtures/TF032/positive-heredoc.tf

@@ -0,0 +1,22 @@
+# Vendored for TF032 (chant #2287). Source: https://github.com/aquasecurity/trivy-checks
+# Path: checks/cloud/aws/ecs/no_plaintext_secrets.yaml (terraform.bad[0])
+# Commit: 71c05d02845cc2c3a5dfa4fe914a68a052cc88bf
+# Licence: MIT
+# Copyright (c) 2024 Aqua Security. MIT licence: https://github.com/aquasecurity/trivy-checks/blob/71c05d02845cc2c3a5dfa4fe914a68a052cc88bf/LICENSE
+# The upstream check's own failing example, lifted out of its YAML block scalar unchanged.
+# A heredoc with no interpolation arrives from hcl2json as a plain string, so it is read
+# as JSON. Fires once, on DATABASE_PASSWORD.
+
+resource "aws_ecs_task_definition" "bad_example" {
+  container_definitions = <<EOF
+ [
+   {
+     "name": "my_service",
+     "environment": [
+       { "name": "ENVIRONMENT", "value": "development" },
+       { "name": "DATABASE_PASSWORD", "value": "oh no D:"}
+     ]
+   }
+ ]
+ EOF
+}