From 70a71b4a1f2ef7820dd49cde915a154f54ded494 Mon Sep 17 00:00:00 2001 From: "T.J. Corrigan" Date: Thu, 27 Oct 2022 11:16:06 -0500 Subject: [PATCH 1/5] bad NSG --- main.tf | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/main.tf b/main.tf index 22ae8df..5204f61 100644 --- a/main.tf +++ b/main.tf @@ -26,3 +26,22 @@ resource "azurerm_resource_group" "rg-aks" { name = var.resource_group_name location = var.location } + +# Sample NSG designed to raise a security alert. Delete for any real deployment. +resource "azurerm_network_security_group" "nsg-fail" { + name = "insecureNSG" + location = azurerm_resource_group.rg-aks.location + resource_group_name = azurerm_resource_group.rg-aks.name + + security_rule { + name = "badrule" + priority = 100 + direction = "Inbound" + access = "Allow" + protocol = "*" + source_port_range = "*" + destination_port_range = "*" + source_address_prefix = "*" + destination_address_prefix = "*" + } +} From ba974c31aaa454472ab9e52d5c31a2adb54c0f8c Mon Sep 17 00:00:00 2001 From: "T.J. Corrigan" Date: Thu, 27 Oct 2022 11:31:17 -0500 Subject: [PATCH 2/5] Update tf-unit-tests.yml --- .github/workflows/tf-unit-tests.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/tf-unit-tests.yml b/.github/workflows/tf-unit-tests.yml index e22bf51..7d54c10 100644 --- a/.github/workflows/tf-unit-tests.yml +++ b/.github/workflows/tf-unit-tests.yml @@ -40,6 +40,7 @@ jobs: # Upload results to GitHub Advanced Security - name: Upload SARIF file + if: success() || failure() uses: github/codeql-action/upload-sarif@v2 with: sarif_file: checkov.sarif From df395dd058b4082731b2b51bc1a03a11a0631140 Mon Sep 17 00:00:00 2001 From: "T.J. Corrigan" Date: Thu, 27 Oct 2022 11:34:24 -0500 Subject: [PATCH 3/5] Update tf-unit-tests.yml --- .github/workflows/tf-unit-tests.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/tf-unit-tests.yml b/.github/workflows/tf-unit-tests.yml index 7d54c10..9d72c55 100644 --- a/.github/workflows/tf-unit-tests.yml +++ b/.github/workflows/tf-unit-tests.yml @@ -37,6 +37,9 @@ jobs: framework: terraform output_format: sarif output_file_path: checkov.sarif + + - name: test + run: ls -lh # Upload results to GitHub Advanced Security - name: Upload SARIF file From 87f1561d4c6c24f5f4d9d1c3ac118ced4e18cd13 Mon Sep 17 00:00:00 2001 From: "T.J. Corrigan" Date: Thu, 27 Oct 2022 11:35:42 -0500 Subject: [PATCH 4/5] Update tf-unit-tests.yml --- .github/workflows/tf-unit-tests.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/tf-unit-tests.yml b/.github/workflows/tf-unit-tests.yml index 9d72c55..17f46f9 100644 --- a/.github/workflows/tf-unit-tests.yml +++ b/.github/workflows/tf-unit-tests.yml @@ -39,6 +39,7 @@ jobs: output_file_path: checkov.sarif - name: test + if: success() || failure() run: ls -lh # Upload results to GitHub Advanced Security From a2ae60f6b03d753c0e8ed5e878ce2d42bc5d0ee8 Mon Sep 17 00:00:00 2001 From: "T.J. Corrigan" Date: Thu, 27 Oct 2022 11:37:28 -0500 Subject: [PATCH 5/5] Update tf-unit-tests.yml --- .github/workflows/tf-unit-tests.yml | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/.github/workflows/tf-unit-tests.yml b/.github/workflows/tf-unit-tests.yml index 17f46f9..13fccb7 100644 --- a/.github/workflows/tf-unit-tests.yml +++ b/.github/workflows/tf-unit-tests.yml @@ -35,17 +35,11 @@ jobs: uses: bridgecrewio/checkov-action@master with: framework: terraform - output_format: sarif - output_file_path: checkov.sarif - - - name: test - if: success() || failure() - run: ls -lh - + # Upload results to GitHub Advanced Security - name: Upload SARIF file if: success() || failure() uses: github/codeql-action/upload-sarif@v2 with: - sarif_file: checkov.sarif + sarif_file: results.sarif category: checkov