fix(ansible): Fix CKV2_ANSIBLE_2

checkov/ansible/checks/graph_checks/GetUrlHttpsOnly.yaml

@@ -3,10 +3,18 @@ metadata:
   name: "Ensure that HTTPS url is used with get_url"
   category: "NETWORKING"
 definition:
-  cond_type: attribute
-  resource_types:
-    - tasks.ansible.builtin.get_url
-    - tasks.get_url
-  attribute: url
-  operator: starting_with
-  value: "https://"
+  and:
+    - cond_type: attribute
+      resource_types:
+        - tasks.ansible.builtin.get_url
+        - tasks.get_url
+      attribute: url
+      operator: not_starting_with
+      value: "http://"
+    - cond_type: attribute
+      resource_types:
+        - tasks.ansible.builtin.get_url
+        - tasks.get_url
+      attribute: url
+      operator: not_starting_with
+      value: "ftp://"

tests/ansible/checks/graph_checks/resources/GetUrlHttpsOnly/expected.yaml

@@ -1,5 +1,6 @@
 pass:
   - "tasks.ansible.builtin.get_url.https"
+  - "tasks.get_url.unknown" # update test when variable rendering is supported
 fail:
   - "tasks.get_url.http"
 evaluated_keys:

tests/ansible/checks/graph_checks/resources/GetUrlHttpsOnly/unknown.yaml

@@ -0,0 +1,11 @@
+---
+- name: Verify tests
+  hosts: all
+  vars:
+    variable_url: https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
+  tasks:
+    - name: unknown
+      get_url:
+        url: "{{ variable_url }}"
+        dest: /etc/foo.conf
+        force_basic_auth: yes