fix(query): allow cloudformation db security group /24 cidrs

Author: omribz156

assets/queries/cloudFormation/aws/db_security_group_open_to_large_scope/query.rego

@@ -32,7 +32,7 @@ large_scope(ip_address, cidr) {
 	to_number(input_mask[1]) < 120		# should be 120-128
 } else {
 	input_mask := split(ip_address, "/")
-	to_number(input_mask[1]) < 25	# should be 25-32
+	to_number(input_mask[1]) < 24	# should be 24-32
 }
 
 exposed_inline_or_standalone_ingress(res, ing_index, type, resource_index) = results { # inline ingresses

assets/queries/cloudFormation/aws/db_security_group_open_to_large_scope/test/negative1.yaml

@@ -13,10 +13,11 @@ Resources:
       GroupDescription: "Ingress for Amazon EC2 security group"
       SecurityGroupIngress:
         - CidrIp: 1.2.3.4/28
+        - CidrIp: 10.0.0.0/24
 
   DbSecurityByEC2SecurityGroup2:
     Type: AWS::EC2::SecurityGroup
     Properties:
       GroupDescription: "Ingress for Amazon EC2 security group"
       SecurityGroupIngress:
-        - CidrIpv6: 2001:db8:a::123/121
+        - CidrIpv6: 2001:db8:a::123/121

assets/queries/cloudFormation/aws/db_security_group_open_to_large_scope/test/negative2.yaml

@@ -12,6 +12,12 @@ Resources:
       GroupId: !Ref DbSecurityByEC2SecurityGroup1
       CidrIp: 1.2.3.4/28
 
+  StandaloneIngressIPv4Max256Hosts:
+    Type: AWS::EC2::SecurityGroupIngress
+    Properties:
+      GroupId: !Ref DbSecurityByEC2SecurityGroup1
+      CidrIp: 10.0.0.0/24
+
   StandaloneIngressIPv6:
     Type: AWS::EC2::SecurityGroupIngress
     Properties: