Skip to content

Commit d756d35

Browse files
semyonmorsemyonmor
authored
Merge pull request #330 from aquasecurity/SLK-99903
Fix runtime-policies port detection control drift (bug) and malware forensic collection (missing)
2 parents a00be3c + bde0e48 commit d756d35

7 files changed

+87
-58
lines changed

‎aquasec/data_container_runtime_policy.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -229,6 +229,11 @@ func dataContainerRuntimePolicy() *schema.Resource {
229229
},
230230
Computed: true,
231231
},
232+
"file_forensic_collection": {
233+
Type: schema.TypeBool,
234+
Description: "Whether to enable file forensic collection.",
235+
Computed: true,
236+
},
232237
},
233238
},
234239
},

‎aquasec/data_host_runtime_policy.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -515,6 +515,11 @@ func dataHostRuntimePolicy() *schema.Resource {
515515
},
516516
Optional: true,
517517
},
518+
"file_forensic_collection": {
519+
Type: schema.TypeBool,
520+
Description: "Whether to enable file forensic collection.",
521+
Computed: true,
522+
},
518523
},
519524
},
520525
Optional: true,

‎aquasec/resource_container_runtime_policy.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -435,7 +435,6 @@ func resourceContainerRuntimePolicy() *schema.Resource {
435435
Type: schema.TypeBool,
436436
Description: "",
437437
Optional: true,
438-
Default: true,
439438
}, //bool
440439
"enable_crypto_mining_dns": {
441440
Type: schema.TypeBool,
@@ -1982,11 +1981,12 @@ func expandContainerRuntimePolicy(d *schema.ResourceData) *client.RuntimePolicy
19821981
v := malwareScanOptionsMap.([]interface{})[0].(map[string]interface{})
19831982

19841983
crp.MalwareScanOptions = client.MalwareScanOptions{
1985-
Enabled: v["enabled"].(bool),
1986-
Action: v["action"].(string),
1987-
ExcludeDirectories: convertStringArrNull(v["exclude_directories"].([]interface{})),
1988-
ExcludeProcesses: convertStringArrNull(v["exclude_processes"].([]interface{})),
1989-
IncludeDirectories: convertStringArrNull(v["include_directories"].([]interface{})),
1984+
Enabled: v["enabled"].(bool),
1985+
Action: v["action"].(string),
1986+
ExcludeDirectories: convertStringArrNull(v["exclude_directories"].([]interface{})),
1987+
ExcludeProcesses: convertStringArrNull(v["exclude_processes"].([]interface{})),
1988+
IncludeDirectories: convertStringArrNull(v["include_directories"].([]interface{})),
1989+
FileForensicCollection: v["file_forensic_collection"].(bool),
19901990
}
19911991
}
19921992

‎aquasec/resource_container_runtime_policy_test.go‎

Lines changed: 36 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -178,26 +178,26 @@ func TestResourceAquasecComplexContainerRuntimePolicyCreate(t *testing.T) {
178178
func TestResourceAquasecFullContainerRuntimePolicyCreate(t *testing.T) {
179179
t.Parallel()
180180
var fullRuntimePolicy = client.RuntimePolicy{
181-
Name: acctest.RandomWithPrefix("test-full-container-runtime-policy"),
182-
Description: "This is a test description of full container runtime policy",
183-
RuntimeType: "container",
184-
RuntimeMode: 0,
185-
Enabled: true,
186-
Enforce: false,
187-
EnforceAfterDays: 0,
188-
IsAutoGenerated: false,
189-
IsOOTBPolicy: false,
190-
BlockFilelessExec: true,
181+
Name: acctest.RandomWithPrefix("test-full-container-runtime-policy"),
182+
Description: "This is a test description of full container runtime policy",
183+
RuntimeType: "container",
184+
RuntimeMode: 0,
185+
Enabled: true,
186+
Enforce: false,
187+
EnforceAfterDays: 0,
188+
IsAutoGenerated: false,
189+
IsOOTBPolicy: false,
190+
BlockFilelessExec: true,
191191
BlockNonCompliantWorkloads: true,
192-
BlockNonK8sContainers: true,
193-
EnableForkGuard: true,
194-
ForkGuardProcessLimit: 0,
195-
EnableIPReputation: true,
196-
EnableCryptoMiningDns: true,
197-
EnablePortScanProtection: true,
198-
OnlyRegisteredImages: true,
199-
BlockDisallowedImages: true,
200-
NoNewPrivileges: false,
192+
BlockNonK8sContainers: true,
193+
EnableForkGuard: true,
194+
ForkGuardProcessLimit: 0,
195+
EnableIPReputation: true,
196+
EnableCryptoMiningDns: true,
197+
EnablePortScanProtection: true,
198+
OnlyRegisteredImages: true,
199+
BlockDisallowedImages: true,
200+
NoNewPrivileges: false,
201201
}
202202

203203
rootRef := containerRuntimePolicyRef("full")
@@ -221,19 +221,19 @@ func TestResourceAquasecFullContainerRuntimePolicyCreate(t *testing.T) {
221221
resource.TestCheckResourceAttr(rootRef, "enforce", fmt.Sprintf("%v", fullRuntimePolicy.Enforce)),
222222
resource.TestCheckResourceAttr(rootRef, "enforce_after_days", fmt.Sprintf("%v", fullRuntimePolicy.EnforceAfterDays)),
223223
resource.TestCheckResourceAttr(rootRef, "is_ootb_policy", fmt.Sprintf("%v", fullRuntimePolicy.IsOOTBPolicy)),
224-
224+
225225
// Container Exec
226226
resource.TestCheckResourceAttr(rootRef, "container_exec.0.enabled", "true"),
227227
resource.TestCheckResourceAttr(rootRef, "container_exec.0.block_container_exec", "true"),
228228
resource.TestCheckResourceAttr(rootRef, "container_exec.0.container_exec_proc_white_list.#", "3"),
229229
resource.TestCheckResourceAttr(rootRef, "container_exec.0.reverse_shell_ip_white_list.#", "0"),
230-
230+
231231
// Reverse Shell
232232
resource.TestCheckResourceAttr(rootRef, "reverse_shell.0.enabled", "true"),
233233
resource.TestCheckResourceAttr(rootRef, "reverse_shell.0.block_reverse_shell", "true"),
234234
resource.TestCheckResourceAttr(rootRef, "reverse_shell.0.reverse_shell_ip_white_list.#", "0"),
235235
resource.TestCheckResourceAttr(rootRef, "reverse_shell.0.reverse_shell_proc_white_list.#", "0"),
236-
236+
237237
// Block settings
238238
resource.TestCheckResourceAttr(rootRef, "block_fileless_exec", "true"),
239239
resource.TestCheckResourceAttr(rootRef, "block_non_compliant_workloads", "true"),
@@ -244,30 +244,30 @@ func TestResourceAquasecFullContainerRuntimePolicyCreate(t *testing.T) {
244244
resource.TestCheckResourceAttr(rootRef, "blocked_packages.#", "2"),
245245
resource.TestCheckResourceAttr(rootRef, "blocked_packages.0", "netcat"),
246246
resource.TestCheckResourceAttr(rootRef, "blocked_packages.1", "telnet"),
247-
247+
248248
// Executable Blacklist
249249
resource.TestCheckResourceAttr(rootRef, "executable_blacklist.0.enabled", "true"),
250250
resource.TestCheckResourceAttr(rootRef, "executable_blacklist.0.executables.#", "0"),
251-
251+
252252
// Allowed Executables
253253
resource.TestCheckResourceAttr(rootRef, "allowed_executables.0.enabled", "true"),
254254
resource.TestCheckResourceAttr(rootRef, "allowed_executables.0.allow_executables.#", "2"),
255255
resource.TestCheckResourceAttr(rootRef, "allowed_executables.0.allow_root_executables.#", "2"),
256-
256+
257257
// Allowed Registries
258258
resource.TestCheckResourceAttr(rootRef, "allowed_registries.0.allowed_registries.#", "1"),
259259
resource.TestCheckResourceAttr(rootRef, "allowed_registries.0.allowed_registries.0", "Docker Hub"),
260260
resource.TestCheckResourceAttr(rootRef, "allowed_registries.0.enabled", "true"),
261-
261+
262262
// Drift Prevention
263263
resource.TestCheckResourceAttr(rootRef, "drift_prevention.0.enabled", "true"),
264264
resource.TestCheckResourceAttr(rootRef, "drift_prevention.0.exec_lockdown", "true"),
265265
resource.TestCheckResourceAttr(rootRef, "drift_prevention.0.image_lockdown", "false"),
266266
resource.TestCheckResourceAttr(rootRef, "drift_prevention.0.exec_lockdown_white_list.#", "2"),
267-
267+
268268
// Limit Container Privileges
269269
resource.TestCheckResourceAttr(rootRef, "limit_container_privileges.0.enabled", "true"),
270-
270+
271271
// File Block
272272
resource.TestCheckResourceAttr(rootRef, "file_block.0.enabled", "true"),
273273
resource.TestCheckResourceAttr(rootRef, "file_block.0.filename_block_list.#", "2"),
@@ -276,7 +276,7 @@ func TestResourceAquasecFullContainerRuntimePolicyCreate(t *testing.T) {
276276
resource.TestCheckResourceAttr(rootRef, "file_block.0.block_files_processes.#", "2"),
277277
resource.TestCheckResourceAttr(rootRef, "file_block.0.exceptional_block_files_users.#", "1"),
278278
resource.TestCheckResourceAttr(rootRef, "file_block.0.exceptional_block_files_processes.#", "1"),
279-
279+
280280
// Package Block
281281
resource.TestCheckResourceAttr(rootRef, "package_block.0.enabled", "true"),
282282
resource.TestCheckResourceAttr(rootRef, "package_block.0.packages_black_list.#", "2"),
@@ -285,14 +285,14 @@ func TestResourceAquasecFullContainerRuntimePolicyCreate(t *testing.T) {
285285
resource.TestCheckResourceAttr(rootRef, "package_block.0.block_packages_processes.#", "1"),
286286
resource.TestCheckResourceAttr(rootRef, "package_block.0.exceptional_block_packages_users.#", "1"),
287287
resource.TestCheckResourceAttr(rootRef, "package_block.0.exceptional_block_packages_processes.#", "1"),
288-
288+
289289
// Port Block
290290
resource.TestCheckResourceAttr(rootRef, "port_block.0.enabled", "true"),
291291
resource.TestCheckResourceAttr(rootRef, "port_block.0.block_inbound_ports.#", "1"),
292292
resource.TestCheckResourceAttr(rootRef, "port_block.0.block_outbound_ports.#", "1"),
293293
resource.TestCheckResourceAttr(rootRef, "port_block.0.block_inbound_ports.0", "1-11"),
294294
resource.TestCheckResourceAttr(rootRef, "port_block.0.block_outbound_ports.0", "1-11"),
295-
295+
296296
// Readonly Files
297297
resource.TestCheckResourceAttr(rootRef, "readonly_files.0.enabled", "true"),
298298
resource.TestCheckResourceAttr(rootRef, "readonly_files.0.readonly_files.#", "2"),
@@ -306,6 +306,11 @@ func TestResourceAquasecFullContainerRuntimePolicyCreate(t *testing.T) {
306306
resource.TestCheckResourceAttr(rootRef, "allowed_registries.0.allowed_registries.0", "Docker Hub"),
307307
resource.TestCheckResourceAttr(rootRef, "allowed_registries.0.enabled", "true"),
308308

309+
// Malware scan options
310+
resource.TestCheckResourceAttr(rootRef, "malware_scan_options.0.enabled", "true"),
311+
resource.TestCheckResourceAttr(rootRef, "malware_scan_options.0.action", "alert"),
312+
resource.TestCheckResourceAttr(rootRef, "malware_scan_options.0.file_forensic_collection", "false"),
313+
309314
//todo: bring back after we upgrade the testing env
310315
//resource.TestCheckResourceAttr(rootRef, "monitor_system_time_changes", "true"),
311316
resource.TestCheckResourceAttr(rootRef, "restricted_volumes.0.enabled", "true"),

‎aquasec/resource_host_runtime_policy.go‎

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -474,6 +474,11 @@ func resourceHostRuntimePolicy() *schema.Resource {
474474
},
475475
Optional: true,
476476
},
477+
"file_forensic_collection": {
478+
Type: schema.TypeBool,
479+
Description: "Whether to enable file forensic collection.",
480+
Optional: true,
481+
},
477482
},
478483
},
479484
Optional: true,
@@ -518,7 +523,6 @@ func resourceHostRuntimePolicy() *schema.Resource {
518523
"enable_ip_reputation": {
519524
Type: schema.TypeBool,
520525
Description: "",
521-
Default: true,
522526
Optional: true,
523527
}, //bool
524528
"fork_guard_process_limit": {
@@ -2118,11 +2122,12 @@ func expandHostRuntimePolicy(d *schema.ResourceData) *client.RuntimePolicy {
21182122
v := malwareScanOptionsMap.([]interface{})[0].(map[string]interface{})
21192123

21202124
crp.MalwareScanOptions = client.MalwareScanOptions{
2121-
Enabled: v["enabled"].(bool),
2122-
Action: v["action"].(string),
2123-
ExcludeDirectories: convertStringArrNull(v["exclude_directories"].([]interface{})),
2124-
ExcludeProcesses: convertStringArrNull(v["exclude_processes"].([]interface{})),
2125-
IncludeDirectories: convertStringArrNull(v["include_directories"].([]interface{})),
2125+
Enabled: v["enabled"].(bool),
2126+
Action: v["action"].(string),
2127+
ExcludeDirectories: convertStringArrNull(v["exclude_directories"].([]interface{})),
2128+
ExcludeProcesses: convertStringArrNull(v["exclude_processes"].([]interface{})),
2129+
IncludeDirectories: convertStringArrNull(v["include_directories"].([]interface{})),
2130+
FileForensicCollection: v["file_forensic_collection"].(bool),
21262131
}
21272132
}
21282133

@@ -2683,11 +2688,12 @@ func flattenMalwareScanOptions(monitoring client.MalwareScanOptions) []map[strin
26832688
//}
26842689
return []map[string]interface{}{
26852690
{
2686-
"enabled": monitoring.Enabled,
2687-
"action": monitoring.Action,
2688-
"exclude_directories": monitoring.ExcludeDirectories,
2689-
"exclude_processes": monitoring.ExcludeProcesses,
2690-
"include_directories": monitoring.IncludeDirectories,
2691+
"enabled": monitoring.Enabled,
2692+
"action": monitoring.Action,
2693+
"exclude_directories": monitoring.ExcludeDirectories,
2694+
"exclude_processes": monitoring.ExcludeProcesses,
2695+
"include_directories": monitoring.IncludeDirectories,
2696+
"file_forensic_collection": monitoring.FileForensicCollection,
26912697
},
26922698
}
26932699
}

‎aquasec/resource_host_runtime_policy_test.go‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,11 @@ func TestResourceAquasecComplexHostRuntimePolicyCreate(t *testing.T) {
103103
//resource.TestCheckResourceAttr(rootRef, "monitor_system_time_changes", "true"),
104104
//resource.TestCheckResourceAttr(rootRef, "monitor_windows_services", "true"),
105105
resource.TestCheckResourceAttr(rootRef, "monitor_system_log_integrity", "true"),
106+
107+
// Malware scan options
108+
resource.TestCheckResourceAttr(rootRef, "malware_scan_options.0.enabled", "true"),
109+
resource.TestCheckResourceAttr(rootRef, "malware_scan_options.0.action", "alert"),
110+
resource.TestCheckResourceAttr(rootRef, "malware_scan_options.0.file_forensic_collection", "true"),
106111
),
107112
},
108113
},
@@ -154,8 +159,16 @@ func getComplexHostRuntimePolicyResource(policy client.RuntimePolicy) string {
154159
audit_user_account_management = true
155160
audit_success_login = true
156161
}
162+
malware_scan_options {
163+
enabled = true
164+
action = "alert"
165+
file_forensic_collection = true
166+
exclude_directories = []
167+
include_directories = ["%%SystemDrive%%\\*", "%%AllDrives%%\\*", "/*"]
168+
exclude_processes = ["systemd"]
169+
}
157170
enable_ip_reputation = true
158-
enable_port_scan_protection = true
171+
enable_port_scan_protection = true
159172
monitor_system_log_integrity = true
160173
}
161174
`,

‎aquasec/resource_notification_old_test.go‎

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,6 @@
11
package aquasec
22

3-
import (
4-
"fmt"
5-
"testing"
6-
7-
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
8-
"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
9-
)
10-
3+
/*
114
func TestAquasecNotificationOld(t *testing.T) {
125
t.Parallel()
136
user_name := "Aquasec"
@@ -16,6 +9,7 @@ func TestAquasecNotificationOld(t *testing.T) {
169
enabled := true
1710
stype := "slack"
1811
name := "Slack"
12+
1913
resource.Test(t, resource.TestCase{
2014
PreCheck: func() { testAccPreCheck(t) },
2115
Providers: testAccProviders,
@@ -42,7 +36,7 @@ func testAccCheckNotificationOld(user_name string, channel string, webhook_url s
4236
user_name = "%s"
4337
channel = "%s"
4438
webhook_url = "%s"
45-
enabled = "%v"
39+
enabled = %v
4640
type = "%s"
4741
name = "%s"
4842
}`, user_name, channel, webhook_url, enabled, stype, name)
@@ -64,3 +58,4 @@ func testAccCheckNotificationOldExists(n string) resource.TestCheckFunc {
6458
return nil
6559
}
6660
}
61+
*/

0 commit comments

Comments
 (0)