feat(general): Add multiple checks to match runtime checks

checkov/cloudformation/checks/graph_checks/ACMWildcardDomainName.yaml

@@ -0,0 +1,24 @@
+metadata:
+  id: "CKV2_AWS_71"
+  name: "Ensure AWS ACM Certificate domain name does not include wildcards"
+  category: "NETWORKING"
+definition:
+  and:
+    - cond_type: "attribute"
+      resource_types:
+        - "AWS::CertificateManager::Certificate"
+      attribute: "DomainName"
+      operator: "not_contains"
+      value: "*"
+    - or:
+      - cond_type: "attribute"
+        resource_types:
+          - "AWS::CertificateManager::Certificate"
+        attribute: "SubjectAlternativeNames"
+        operator: "not_exists"
+      - cond_type: "attribute"
+        resource_types:
+          - "AWS::CertificateManager::Certificate"
+        attribute: "SubjectAlternativeNames.*"
+        operator: "not_contains"
+        value: "*"

checkov/cloudformation/checks/graph_checks/CloudfrontOriginNotHTTPSOnly.yaml

@@ -0,0 +1,36 @@
+metadata:
+  id: "CKV2_AWS_72"
+  name: "Ensure AWS CloudFront origin protocol policy enforces HTTPS-only"
+  category: "NETWORKING"
+definition:
+  or:
+    - cond_type: "attribute"
+      resource_types:
+        - "AWS::CloudFront::Distribution"
+      attribute: "DistributionConfig.Enabled"
+      operator: "equals"
+      value: "false"
+    - cond_type: "attribute"
+      resource_types:
+        - "AWS::CloudFront::Distribution"
+      attribute: "DistributionConfig.Origins.*.CustomOriginConfig"
+      operator: "not_exists"
+    - and:
+      - cond_type: "attribute"
+        resource_types:
+          - "AWS::CloudFront::Distribution"
+        attribute: DistributionConfig.Origins[?(@.CustomOriginConfig.OriginProtocolPolicy != 'https-only')].DomainName
+        operator: "jsonpath_not_contains"
+        value: ".mediastore."
+      - cond_type: "attribute"
+        resource_types:
+          - "AWS::CloudFront::Distribution"
+        attribute: DistributionConfig.Origins[?(@.CustomOriginConfig.OriginProtocolPolicy != 'https-only')].DomainName
+        operator: "jsonpath_not_contains"
+        value: ".mediapackage."
+      - cond_type: "attribute"
+        resource_types:
+          - "AWS::CloudFront::Distribution"
+        attribute: DistributionConfig.Origins[?(@.CustomOriginConfig.OriginProtocolPolicy != 'https-only')].DomainName
+        operator: "jsonpath_not_contains"
+        value: ".elb."

checkov/terraform/checks/graph_checks/aws/ACMWildcardDomainName.yaml

@@ -0,0 +1,24 @@
+metadata:
+  id: "CKV2_AWS_71"
+  name: "Ensure AWS ACM Certificate domain name does not include wildcards"
+  category: "NETWORKING"
+definition:
+  and:
+    - cond_type: "attribute"
+      resource_types:
+        - "aws_acm_certificate"
+      attribute: "domain_name"
+      operator: "not_contains"
+      value: "*"
+    - or:
+      - cond_type: "attribute"
+        resource_types:
+          - "aws_acm_certificate"
+        attribute: "subject_alternative_names"
+        operator: "not_exists"
+      - cond_type: "attribute"
+        resource_types:
+          - "aws_acm_certificate"
+        attribute: "subject_alternative_names.*"
+        operator: "not_contains"
+        value: "*"

checkov/terraform/checks/graph_checks/aws/CloudfrontOriginNotHTTPSOnly.yaml

@@ -0,0 +1,36 @@
+metadata:
+  id: "CKV2_AWS_72"
+  name: "Ensure AWS CloudFront origin protocol policy enforces HTTPS-only"
+  category: "NETWORKING"
+definition:
+  or:
+    - cond_type: "attribute"
+      resource_types:
+        - "aws_cloudfront_distribution"
+      attribute: "enabled"
+      operator: "equals"
+      value: "false"
+    - cond_type: "attribute"
+      resource_types:
+        - "aws_cloudfront_distribution"
+      attribute: "origin.*.custom_origin_config"
+      operator: "not_exists"
+    - and:
+      - cond_type: "attribute"
+        resource_types:
+          - "aws_cloudfront_distribution"
+        attribute: origin[?(@.custom_origin_config.origin_protocol_policy != 'https-only')].domain_name
+        operator: "jsonpath_not_contains"
+        value: ".mediastore."
+      - cond_type: "attribute"
+        resource_types:
+          - "aws_cloudfront_distribution"
+        attribute: origin[?(@.custom_origin_config.origin_protocol_policy != 'https-only')].domain_name
+        operator: "jsonpath_not_contains"
+        value: ".mediapackage."
+      - cond_type: "attribute"
+        resource_types:
+          - "aws_cloudfront_distribution"
+        attribute: origin[?(@.custom_origin_config.origin_protocol_policy != 'https-only')].domain_name
+        operator: "jsonpath_not_contains"
+        value: ".elb."

tests/cloudformation/graph/checks/resources/ACMWildcardDomainName/expected.yaml

@@ -0,0 +1,11 @@
+pass:
+  - "AWS::CertificateManager::Certificate.ExamplePassCertificate"
+  - "AWS::CertificateManager::Certificate.ExamplePass2Certificate"
+fail:
+  - "AWS::CertificateManager::Certificate.ExampleFailCertificate"
+  - "AWS::CertificateManager::Certificate.ExampleFailBadSubjectCertificate"
+  - "AWS::CertificateManager::Certificate.ExampleFailBadDomainCertificate"
+evaluated_keys:
+  - "DomainName"
+  - "SubjectAlternativeNames"
+  - "SubjectAlternativeNames/*"

tests/cloudformation/graph/checks/resources/ACMWildcardDomainName/template.yaml

@@ -0,0 +1,48 @@
+Resources:
+  ExamplePassCertificate:
+    Type: "AWS::CertificateManager::Certificate"
+    Properties:
+      DomainName: "www.example.com"
+      ValidationMethod: "DNS"
+      DomainValidationOptions:
+        - DomainName: "www.example.com"
+          ValidationDomain: "example.com"
+
+  ExamplePass2Certificate:
+    Type: "AWS::CertificateManager::Certificate"
+    Properties:
+      DomainName: "example.com"
+      ValidationMethod: "DNS"
+      SubjectAlternativeNames:
+        - "www.example.com"
+        - "blog.example.com"
+        - "shop.example.com"
+
+  ExampleFailCertificate:
+    Type: "AWS::CertificateManager::Certificate"
+    Properties:
+      DomainName: "*.example.com"
+      ValidationMethod: "DNS"
+      DomainValidationOptions:
+        - DomainName: "*.example.com"
+          ValidationDomain: "example.com"
+
+  ExampleFailBadSubjectCertificate:
+    Type: "AWS::CertificateManager::Certificate"
+    Properties:
+      DomainName: "example.com"
+      ValidationMethod: "DNS"
+      SubjectAlternativeNames:
+        - "*.sub.example.com"
+        - "www.example.com"
+        - "api.example.com"
+
+  ExampleFailBadDomainCertificate:
+    Type: "AWS::CertificateManager::Certificate"
+    Properties:
+      DomainName: "*example.com"
+      ValidationMethod: "DNS"
+      SubjectAlternativeNames:
+        - "sub.example.com"
+        - "www.example.com"
+        - "api.example.com"

tests/cloudformation/graph/checks/resources/CloudfrontOriginNotHTTPSOnly/expected.yaml

@@ -0,0 +1,13 @@
+pass:
+  - "AWS::CloudFront::Distribution.ExamplePassDisabledDistribution"
+  - "AWS::CloudFront::Distribution.ExamplePassNoCustomOriginDistribution"
+  - "AWS::CloudFront::Distribution.ExamplePassHttpsOnlyDistribution"
+  - "AWS::CloudFront::Distribution.ExamplePassDomainDistribution"
+fail:
+  - "AWS::CloudFront::Distribution.ExampleFailDistribution"
+  - "AWS::CloudFront::Distribution.ExampleFailOneGoodOneBadDistribution"
+  - "AWS::CloudFront::Distribution.ExampleFailOneMissingOneBadDistribution"
+evaluated_keys:
+  - "DistributionConfig/Enabled"
+  - "DistributionConfig/Origins[?(@/CustomOriginConfig/OriginProtocolPolicy != 'https-only')]/DomainName"
+  - "DistributionConfig/Origins/*/CustomOriginConfig"