Skip to content

Commit 88dfbb2

Browse files
GeekMasherGeekMasher
committed
feat: QL src
1 parent 24c907c commit 88dfbb2

19 files changed

+376
-0
lines changed

‎ql/src/Security/Terraform/AWS/ESDisabledLogging.ql‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
/**
2+
* @name Elastic Search Logging Disabled
3+
* @description Elastic Search Logging Disabled
4+
* @kind problem
5+
* @problem.severity error
6+
* @security-severity 6.0
7+
* @precision high
8+
* @id hcl/aws/elastic-search-disabled-logging
9+
* @tags security
10+
*/
11+
12+
import hcl
13+
14+
from Resource r
15+
where
16+
r.getResourceType() = "aws_elasticsearch_domain" and
17+
// Disabled by default (in-secure), if present the default if turned on (secure)
18+
not r.hasAttribute("log_publishing_options")
19+
or
20+
exists(Block block |
21+
block = r.getAttribute("log_publishing_options") and
22+
r.getAttribute("enabled").(BooleanLiteral).getBool() = false and
23+
block = r
24+
)
25+
select r, "Logging Disabled"

‎ql/src/Security/Terraform/AWS/RDBUnencrypted.ql‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/**
2+
* @name RDS Database Unencrypted
3+
* @description RDS Database Unencrypted
4+
* @kind problem
5+
* @problem.severity warning
6+
* @security-severity 8.0
7+
* @precision high
8+
* @id hcl/aws/rds-database-unencrytped
9+
* @tags security
10+
*/
11+
12+
import hcl
13+
14+
from Resource r
15+
where
16+
r.getResourceType() = "aws_db_instance" and
17+
not r.hasAttribute("storage_encrypted")
18+
// TODO: check if set to true
19+
select r, "S3 Bucket Unencrypted: \"" + r.getName() + "\""

‎ql/src/Security/Terraform/AWS/S3LoggingDisabled.ql‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
/**
2+
* @name S3 Bucket Logging Disabled
3+
* @description S3 Bucket Logging Disabled
4+
* @kind problem
5+
* @problem.severity warning
6+
* @security-severity 8.0
7+
* @precision high
8+
* @id hcl/aws/s3-logging-disabled
9+
* @tags security
10+
*/
11+
12+
import hcl
13+
14+
from Resource r
15+
where
16+
r.getResourceType() = "aws_s3_bucket" and
17+
// Disable by default
18+
not r.hasAttribute("logging")
19+
// target_bucket = "target-bucket"
20+
select r, "Logging disabled for: \"" + r.getName() + "\""

‎ql/src/Security/Terraform/AWS/S3PublicBucket.ql‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
/**
2+
* @name Public S3 Bucket
3+
* @description Public S3 Bucket
4+
* @kind problem
5+
* @problem.severity error
6+
* @security-severity 10.0
7+
* @precision high
8+
* @id hcl/aws/public-s3-bucket
9+
* @tags security
10+
*/
11+
12+
import hcl
13+
14+
from Resource r
15+
where
16+
r.getResourceType() = "aws_s3_bucket" and
17+
(
18+
// Default is public
19+
not r.hasAttribute("acl")
20+
or
21+
// If the ACL is set to "public-read"
22+
exists(StringLiteral str |
23+
str = r.getAttribute("acl") and
24+
str.getValue() = "public-read"
25+
)
26+
)
27+
select r, "Public S3 Bucket resource"

‎ql/src/Security/Terraform/AWS/S3PublicBucketAccessEnabled.ql‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/**
2+
* @name S3 Access Policy Allows Public Buckets
3+
* @description S3 Access Policy Allows Public Buckets
4+
* @kind problem
5+
* @problem.severity warning
6+
* @security-severity 5.0
7+
* @precision high
8+
* @id hcl/aws/s3-public-access-disabled
9+
* @tags security
10+
*/
11+
12+
import hcl
13+
14+
from Resource r
15+
where
16+
r.getResourceType() = "aws_s3_bucket_public_access_block" and
17+
not r.hasAttribute("restrict_public_buckets")
18+
// TODO: check if set to try
19+
select r, "Access Policy"

‎ql/src/Security/Terraform/AWS/S3UnencryptedBucket.ql‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
/**
2+
* @name Unencrytped S3 Bucket
3+
* @description Unencrytped S3 Bucket
4+
* @kind problem
5+
* @problem.severity warning
6+
* @security-severity 8.0
7+
* @precision high
8+
* @id hcl/aws/unencrytped-s3-bucket
9+
* @tags security
10+
*/
11+
12+
import hcl
13+
14+
from Resource r
15+
where
16+
r.getResourceType() = "aws_s3_bucket" and
17+
not r.hasAttribute("server_side_encryption_configuration")
18+
select r, "S3 Bucket Unencrypted: \"" + r.getName() + "\""

‎ql/src/Security/Terraform/AWS/S3VersioningDisabled.ql‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
/**
2+
* @name S3 Bucket Versioning Disabled
3+
* @description S3 Bucket Versioning Disabled
4+
* @kind problem
5+
* @problem.severity warning
6+
* @security-severity 8.0
7+
* @precision high
8+
* @id hcl/aws/s3-versioning-disabled
9+
* @tags security
10+
*/
11+
12+
import hcl
13+
14+
from Resource resource
15+
where
16+
exists(Resource aws |
17+
aws.getResourceType() = "aws_s3_bucket" and
18+
// Disable by default
19+
(
20+
not aws.hasAttribute("versioning") and
21+
resource = aws
22+
)
23+
or
24+
exists(Block block |
25+
// versioning {
26+
// enabled = false
27+
// }
28+
block = aws.getAttribute("versioning") and
29+
block.getAttribute("enabled").(BooleanLiteral).getBool() = false and
30+
block = resource
31+
)
32+
)
33+
select resource, "Versioning disabled for: \"" + resource.getName() + "\""

‎ql/src/Security/Terraform/Alicloud/PublicBucket.ql‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
/**
2+
* @name Alicloud Public Bucket
3+
* @description Elastic Search Logging Disabled
4+
* @kind problem
5+
* @problem.severity error
6+
* @security-severity 10.0
7+
* @precision high
8+
* @id hcl/alicloud/public-bucket
9+
* @tags security
10+
*/
11+
12+
import hcl
13+
14+
from Resource r
15+
where
16+
r.getResourceType() = "alicloud_oss_bucket" and
17+
exists(StringLiteral str |
18+
str = r.getAttribute("acl") and
19+
str.getValue() = "public-read-write"
20+
)
21+
select r, "Public and Writeable"

‎ql/src/Security/Terraform/Azure/ManagedStorageUnencrypted.ql‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
/**
2+
* @name Azure Managed Storage is Unencrypted
3+
* @description Azure Storage is Unencrypted
4+
* @kind problem
5+
* @problem.severity warning
6+
* @security-severity 8.0
7+
* @precision high
8+
* @id hcl/azure/storage-unencrypted
9+
* @tags security
10+
*/
11+
12+
import hcl
13+
14+
// https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/managed_disk
15+
from Resource r, Block encryption_settings, Expr attr
16+
where
17+
r.getResourceType() = "azurerm_managed_disk" and
18+
// resource azurerm_managed_disk {
19+
// encryption_settings {
20+
// enabled = false
21+
// }
22+
// }
23+
encryption_settings = r.getAttribute("encryption_settings") and
24+
attr = encryption_settings.getAttribute("enabled") and
25+
attr.(BooleanLiteral).getBool() = false
26+
select attr, "Azure Storage is Unencrypted for '" + r.getName() + "'"

‎ql/src/Security/Terraform/Azure/SSLDisabled.ql‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/**
2+
* @name Azure Service TLS/SSL Disable
3+
* @description Azure Service TLS/SSL Disable
4+
* @kind problem
5+
* @problem.severity error
6+
* @security-severity 10.0
7+
* @precision high
8+
* @id hcl/azure/ssl-disabled
9+
* @tags security
10+
*/
11+
12+
import hcl
13+
14+
from Resource resource, Expr attr
15+
where
16+
resource.getResourceType() = ["azurerm_mysql_server", "azurerm_postgresql_server"] and
17+
attr = resource.getAttribute("ssl_enforcement_enabled")
18+
// TODO: attr check to make sure its false
19+
select attr, "TLS/SSL Disabled"

0 commit comments

Comments
 (0)