You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Sep 3, 2024. It is now read-only.
Describe the bug
Regula cli returning incorrect response for terraform files in same directory
How you're running Regula
Please include versions of all relevant tools. Some examples:
I'm using Regula v2.10.0 as a CLI tool and my Terraform source code as an input:
regula run /tmp/regula_test/folder3 -i /Users/ssodhi/go/src/github.intuit.com/cloud-ops/policy-engine-v2-policies/buildtime/gcp/tf/google_storage_no_public_access.rego
1. sample_tf_fail.tf
Operating System
macOS Monterey (12.6)
Steps to reproduce
Policy Link to replace "/Users/ssodhi/go/src/github.intuit.com/cloud-ops/policy-engine-v2-policies/buildtime/gcp/tf/google_storage_no_public_access.rego"
Added below terraform files in a directory folder3 and ran the command above: a. sample_tf_fail.tf
{
"rule_results": [
{
"controls": [
"IS044.1",
"IS044.2"
],
"families": [
"IS044.1"
],
"filepath": "folder3/sample_tf_fail.tf",
"input_type": "tf",
"provider": "google",
"resource_id": "google_storage_bucket.bucket",
"resource_type": "google_storage_bucket",
"resource_tags": {},
"rule_description": "Storage buckets should not be anonymously or publicly accessible. Cloud Storage bucket permissions should not be configured to allow 'allUsers' or 'allAuthenticatedUsers' access. These permissions provides broad, public access, which can result in unknown or undesired data access.",
"rule_id": "gcp_tf_google_storage_no_public_access",
"rule_message": "",
"rule_name": "gcp_tf_google_storage_no_public_access",
"rule_raw_result": false,
"rule_remediation_doc": "https://github.intuit.com/cloud-ops/ACP-Remediation-Links/blob/master/IS044.1-gcp-google-storage-no-public-access.md",
"rule_result": "FAIL",
"rule_severity": "Informational",
"rule_summary": "Storage buckets should not be anonymously or publicly accessible",
"source_location": [
{
"path": "folder3/sample_tf_fail.tf",
"line": 13,
"column": 1
}
]
},
{
"controls": [
"IS044.1",
"IS044.2"
],
"families": [
"IS044.1"
],
"filepath": "folder3/sample_tf_pass.tf",
"input_type": "tf",
"provider": "google",
"resource_id": "google_storage_bucket.bucket1",
"resource_type": "google_storage_bucket",
"resource_tags": {},
"rule_description": "Storage buckets should not be anonymously or publicly accessible. Cloud Storage bucket permissions should not be configured to allow 'allUsers' or 'allAuthenticatedUsers' access. These permissions provides broad, public access, which can result in unknown or undesired data access.",
"rule_id": "gcp_tf_google_storage_no_public_access",
"rule_message": "",
"rule_name": "gcp_tf_google_storage_no_public_access",
"rule_raw_result": false,
"rule_remediation_doc": "https://github.intuit.com/cloud-ops/ACP-Remediation-Links/blob/master/IS044.1-gcp-google-storage-no-public-access.md",
"rule_result": "FAIL",
"rule_severity": "Informational",
"rule_summary": "Storage buckets should not be anonymously or publicly accessible",
"source_location": [
{
"path": "folder3/sample_tf_pass.tf",
"line": 1,
"column": 1
}
]
}
],
"summary": {
"filepaths": [
"folder3/sample_tf_fail.tf",
"folder3/sample_tf_pass.tf"
],
"rule_results": {
"FAIL": 2,
"PASS": 0,
"WAIVED": 0
},
"severities": {
"Critical": 0,
"High": 0,
"Informational": 2,
"Low": 0,
"Medium": 0,
"Unknown": 0
}
}
}
ssodhi@macos-C02CJ5YPMD6N pe-policyguard-service % regula run ./folder3 -i /Users/ssodhi/go/src/github.intuit.com/cloud-ops/policy-engine-v2-policies/buildtime/gcp/tf/google_storage_no_public_access.rego --no-built-ins --format json
{
"rule_results": [
{
"controls": [
"IS044.1",
"IS044.2"
],
"families": [
"IS044.1"
],
"filepath": "folder3/sample_tf_fail.tf",
"input_type": "tf",
"provider": "google",
"resource_id": "google_storage_bucket.bucket",
"resource_type": "google_storage_bucket",
"resource_tags": {},
"rule_description": "Storage buckets should not be anonymously or publicly accessible. Cloud Storage bucket permissions should not be configured to allow 'allUsers' or 'allAuthenticatedUsers' access. These permissions provides broad, public access, which can result in unknown or undesired data access.",
"rule_id": "gcp_tf_google_storage_no_public_access",
"rule_message": "",
"rule_name": "gcp_tf_google_storage_no_public_access",
"rule_raw_result": false,
"rule_remediation_doc": "https://github.intuit.com/cloud-ops/ACP-Remediation-Links/blob/master/IS044.1-gcp-google-storage-no-public-access.md",
"rule_result": "FAIL",
"rule_severity": "Informational",
"rule_summary": "Storage buckets should not be anonymously or publicly accessible",
"source_location": [
{
"path": "folder3/sample_tf_fail.tf",
"line": 13,
"column": 1
}
]
},
{
"controls": [
"IS044.1",
"IS044.2"
],
"families": [
"IS044.1"
],
"filepath": "folder3/sample_tf_pass.tf",
"input_type": "tf",
"provider": "google",
"resource_id": "google_storage_bucket.bucket1",
"resource_type": "google_storage_bucket",
"resource_tags": {},
"rule_description": "Storage buckets should not be anonymously or publicly accessible. Cloud Storage bucket permissions should not be configured to allow 'allUsers' or 'allAuthenticatedUsers' access. These permissions provides broad, public access, which can result in unknown or undesired data access.",
"rule_id": "gcp_tf_google_storage_no_public_access",
"rule_message": "",
"rule_name": "gcp_tf_google_storage_no_public_access",
"rule_raw_result": false,
"rule_remediation_doc": "https://github.intuit.com/cloud-ops/ACP-Remediation-Links/blob/master/IS044.1-gcp-google-storage-no-public-access.md",
"rule_result": "FAIL",
"rule_severity": "Informational",
"rule_summary": "Storage buckets should not be anonymously or publicly accessible",
"source_location": [
{
"path": "folder3/sample_tf_pass.tf",
"line": 1,
"column": 1
}
]
}
],
"summary": {
"filepaths": [
"folder3/sample_tf_fail.tf",
"folder3/sample_tf_pass.tf"
],
"rule_results": {
"FAIL": 2,
"PASS": 0,
"WAIVED": 0
},
"severities": {
"Critical": 0,
"High": 0,
"Informational": 2,
"Low": 0,
"Medium": 0,
"Unknown": 0
}
}
}
Expected Response:
One pass and one fail
IaC Configuration
If applicable, please include a minimal configuration that we can use to reproduce the issue. Valid configurations save us a lot of time in troubleshooting. So please, try using what you post to reproduce the issue to verify that it demonstrates the problem.
Additional context
Add any other context about the problem here.
The text was updated successfully, but these errors were encountered:
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Describe the bug
Regula cli returning incorrect response for terraform files in same directory
How you're running Regula
Please include versions of all relevant tools. Some examples:
Operating System
macOS Monterey (12.6)
Steps to reproduce
Policy Link to replace "/Users/ssodhi/go/src/github.intuit.com/cloud-ops/policy-engine-v2-policies/buildtime/gcp/tf/google_storage_no_public_access.rego"
Added below terraform files in a directory folder3 and ran the command above:
a. sample_tf_fail.tf
b. sample_tf_pass.tf
Response from library:
Expected Response:
One pass and one fail
IaC Configuration
If applicable, please include a minimal configuration that we can use to reproduce the issue. Valid configurations save us a lot of time in troubleshooting. So please, try using what you post to reproduce the issue to verify that it demonstrates the problem.
Additional context
Add any other context about the problem here.
The text was updated successfully, but these errors were encountered: