forked from bridgecrewio/checkov
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'bridgecrewio:main' into prdeshpande-main
- Loading branch information
Showing
13 changed files
with
4,599 additions
and
4,340 deletions.
There are no files selected for viewing
39 changes: 39 additions & 0 deletions
39
checkov/cloudformation/checks/resource/aws/LambdaServicePermission.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| from __future__ import annotations | ||
|
|
||
| from typing import List, Any | ||
|
|
||
| from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck | ||
| from checkov.common.models.enums import CheckCategories, CheckResult | ||
|
|
||
|
|
||
| class LambdaServicePermission(BaseResourceCheck): | ||
| def __init__(self) -> None: | ||
| name = "Ensure that AWS Lambda function permissions delegated to AWS services are limited by SourceArn or SourceAccount" | ||
| id = "CKV_AWS_364" | ||
| supported_resources = ("AWS::Lambda::Permission",) | ||
| categories = (CheckCategories.IAM,) | ||
| super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) | ||
|
|
||
| def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: | ||
| properties = conf.get('Properties') | ||
| if properties and isinstance(properties, dict): | ||
| principal = properties.get('Principal') | ||
| if principal and isinstance(principal, str): | ||
| principal_parts = principal.split('.') | ||
| try: | ||
| if principal_parts[1] == 'amazonaws' and principal_parts[2] == 'com': | ||
| if properties.get('SourceArn') or properties.get('SourceAccount'): | ||
| return CheckResult.PASSED | ||
| else: | ||
| return CheckResult.FAILED | ||
| except IndexError: | ||
| print("Not a service principal") | ||
| # Not a service principal, so pass. | ||
| return CheckResult.UNKNOWN | ||
| return CheckResult.UNKNOWN | ||
|
|
||
| def get_evaluated_keys(self) -> List[str]: | ||
| return ['Properties/Principal', 'Properties/SourceArn', 'Properties/SourceAccount'] | ||
|
|
||
|
|
||
| check = LambdaServicePermission() |
38 changes: 38 additions & 0 deletions
38
checkov/terraform/checks/resource/aws/LambdaServicePermission.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| from __future__ import annotations | ||
|
|
||
| from typing import List, Any | ||
|
|
||
| from checkov.common.models.enums import CheckResult, CheckCategories | ||
| from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck | ||
|
|
||
|
|
||
| class LambdaServicePermission(BaseResourceCheck): | ||
| def __init__(self) -> None: | ||
| description = "Ensure that AWS Lambda function permissions delegated to AWS services are limited by SourceArn or SourceAccount" | ||
| id = "CKV_AWS_364" | ||
| supported_resources = ('aws_lambda_permission',) | ||
| categories = (CheckCategories.IAM,) | ||
| super().__init__(name=description, id=id, categories=categories, supported_resources=supported_resources) | ||
|
|
||
| def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: | ||
| # Replace this with the custom logic for your check | ||
| principal = conf.get("principal") | ||
| if principal and isinstance(principal, list) and isinstance(principal[0], str): | ||
| principal_parts = principal[0].split('.') | ||
| try: | ||
| if principal_parts[1] == 'amazonaws' and principal_parts[2] == 'com': # This confirms that the principal is set as a service principal. | ||
| if 'source_arn' in conf or 'source_account' in conf: # If either of these are set, we're good and the check should pass. | ||
| self.evaluated_keys = self.get_evaluated_keys() | ||
| return CheckResult.PASSED | ||
| else: | ||
| self.evaluated_keys = self.get_evaluated_keys() | ||
| return CheckResult.FAILED | ||
| except IndexError: | ||
| return CheckResult.UNKNOWN | ||
| return CheckResult.UNKNOWN | ||
|
|
||
| def get_evaluated_keys(self) -> List[str]: | ||
| return ["principal", "source_arn", "source_account"] | ||
|
|
||
|
|
||
| check = LambdaServicePermission() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| version = '2.5.6' | ||
| version = '2.5.7' |
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.