feat(tf): Small updates

Author: GeekMasher

ql/lib/codeql/hcl/security/PublicStorage.qll

@@ -18,22 +18,22 @@ class AzurePublicStorage extends PublicStorage {
     )
     or
     // Azure Storage Accounts
-    exists(Azure::StorageAccount storage_acount |
+    exists(Azure::StorageAccount storage_account |
       (
         // v2
-        storage_acount.getAllowBlobPublicAccessValue() = true and
-        this = storage_acount.getAllowBlobPublicAccess()
+        storage_account.getAllowBlobPublicAccessValue() = true and
+        this = storage_account.getAllowBlobPublicAccess()
       )
       or
       (
         // v3
         (
-          storage_acount.getPublicNetworkAccessValue() = true
+          storage_account.getPublicNetworkAccessValue() = true
           or
-          storage_acount.getAllowNestedItemsToBePublicValue() = true
+          storage_account.getAllowNestedItemsToBePublicValue() = true
         )
         and
-        this = storage_acount
+        this = storage_account
       )
     )
   }

ql/test/queries-tests/Terraform/Azure/Storage/PublicAccess/PublicAccess.expected

@@ -1,2 +1,3 @@
-| storage.tf:9:1:15:1 | resource azurerm_storage_container insecure-storage-container | Azure Storage is Public |
-| storage.tf:18:1:28:1 | resource azurerm_storage_account insecure-storage-account | Azure Storage is Public |
+| storage.tf:15:1:22:1 | resource azurerm_storage_container insecure-storage-container | Azure Storage is Public |
+| storage.tf:25:1:33:1 | resource azurerm_storage_account insecure-storage-account | Azure Storage is Public |
+| storage.tf:49:1:59:1 | resource azurerm_storage_account insecure-storage-account | Azure Storage is Public |

ql/test/queries-tests/Terraform/Azure/Storage/PublicAccess/storage.tf

@@ -1,28 +1,59 @@
+# Resource Group
+resource "azurerm_resource_group" "example" {
+  name     = "example-resources"
+  location = "West Europe"
+}
 
 # secure
 resource "azurerm_storage_container" "secure" {
   name                  = "secure-storage-container"
+  location              = azurerm_resource_group.example.location
   container_access_type = "private"
 }
 
 # insecure
 resource "azurerm_storage_container" "insecure" {
   name                  = "insecure-storage-container"
+  location              = azurerm_resource_group.example.location
   container_access_type = "blob"
   properties = {
     "publicAccess" = "blob"
   }
 }
 
+# insecure defaults (v3) 
+resource "azurerm_storage_account" "insecure_storage_account" {
+  name                     = "insecure-storage-account"
+  location                 = azurerm_resource_group.example.location
+  account_kind             = "BlobStorage"
+  account_tier             = "Standard"
+  account_replication_type = "GRS"
+  resource_group_name      = azurerm_resource_group.example
+  min_tls_version          = "TLS1_2"
+}
+
+# Secure (v3)
+resource "azurerm_storage_account" "secure_storage_account" {
+  name                            = "secure-storage-account"
+  location                        = azurerm_resource_group.example.location
+  account_kind                    = "BlobStorage"
+  account_tier                    = "Standard"
+  account_replication_type        = "GRS"
+  resource_group_name             = azurerm_resource_group.example
+  public_network_access_enabled   = false
+  allow_nested_items_to_be_public = false
+  min_tls_version                 = "TLS1_2"
+}
+
 # insecure (v3)
 resource "azurerm_storage_account" "insecure_storage_account" {
   name                            = "insecure-storage-account"
-  location                        = var.location
-  account_kind                    = var.kind
-  account_tier                    = var.tier
-  account_replication_type        = var.replication_type
-  resource_group_name             = var.resource_group_name
+  location                        = azurerm_resource_group.example.location
+  account_kind                    = "BlobStorage"
+  account_tier                    = "Standard"
+  account_replication_type        = "GRS"
+  resource_group_name             = azurerm_resource_group.example
   public_network_access_enabled   = true
   allow_nested_items_to_be_public = true
-  min_tls_version                 = var.min_tls_version
+  min_tls_version                 = "TLS1_2"
 }