Require a known department label (#5)

* bump version

* require a known department

Author: chrisns

infra/checkov/require-known-department-label/fail0.tf

@@ -0,0 +1,3 @@
+resource "aws_s3_bucket" "b" {
+  bucket = "my-tf-test-bucket"
+}

infra/checkov/require-known-department-label/fail1.tf

@@ -0,0 +1,15 @@
+resource "aws_s3_bucket" "b" {
+  bucket = "my-tf-test-bucket"
+}
+
+resource "aws_ami" "example" {
+  name                = "terraform-example"
+  virtualization_type = "hvm"
+  root_device_name    = "/dev/xvda"
+
+  ebs_block_device {
+    device_name = "/dev/xvda"
+    snapshot_id = "snap-xxxxxxxx"
+    volume_size = 8
+  }
+}

infra/checkov/require-known-department-label/fail2.tf

@@ -0,0 +1,18 @@
+resource "aws_s3_bucket" "b" {
+  bucket = "my-tf-test-bucket"
+  tags = {
+    mycompany.com.department = "finance"
+  }
+}
+
+resource "aws_ami" "example" {
+  name                = "terraform-example"
+  virtualization_type = "hvm"
+  root_device_name    = "/dev/xvda"
+
+  ebs_block_device {
+    device_name = "/dev/xvda"
+    snapshot_id = "snap-xxxxxxxx"
+    volume_size = 8
+  }
+}

infra/checkov/require-known-department-label/pass0.tf

@@ -0,0 +1,6 @@
+resource "aws_s3_bucket" "b" {
+  bucket = "my-tf-test-bucket"
+  tags = {
+    mycompany.com.department = "hr"
+  }
+}

infra/checkov/require-known-department-label/pass1.tf

@@ -0,0 +1,20 @@
+resource "aws_s3_bucket" "b" {
+  bucket = "my-tf-test-bucket"
+  tags = {
+    mycompany.com.department = "hr"
+  }
+}
+
+resource "aws_ami" "example" {
+  name                = "terraform-example"
+  virtualization_type = "hvm"
+  root_device_name    = "/dev/xvda"
+  tags = {
+    mycompany.com.department = "hr"
+  }
+  ebs_block_device {
+    device_name = "/dev/xvda"
+    snapshot_id = "snap-xxxxxxxx"
+    volume_size = 8
+  }
+}

infra/checkov/require-known-department-label/policy.yaml

@@ -0,0 +1,28 @@
+metadata:
+  name: "Check that all resources are tagged with the key - department with a known value"
+  id: "CUSTOM_AWS_2"
+  category: "CONVENTION"
+scope:
+  provider: aws
+definition:
+  or:
+    - cond_type: "attribute"
+      resource_types: "all"
+      attribute: 'tags.mycompany.com.department'
+      operator: "equals"
+      value: tech
+    - cond_type: "attribute"
+      resource_types: "all"
+      attribute: 'tags.mycompany.com.department'
+      operator: "equals"
+      value: hr
+    - cond_type: "attribute"
+      resource_types: "all"
+      attribute: 'tags.mycompany.com.department'
+      operator: "equals"
+      value: ounts
+    - cond_type: "attribute"
+      resource_types: "all"
+      attribute: 'tags.mycompany.com.department'
+      operator: "equals"
+      value: servicedesk

kubernetes/kyverno/kustomization.yaml

@@ -1,10 +1,11 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
-nameSuffix: "-1.0.0"
+nameSuffix: "-2.0.0"
 
 commonLabels:
-  mycompany.com/policy-version: "1.0.0"
+  mycompany.com/policy-version: "2.0.0"
 
 resources:
   - require-department-label/policy.yaml
+  - require-known-department-label/policy.yaml

kubernetes/kyverno/require-department-label/fail0.yaml

@@ -3,7 +3,7 @@ kind: Pod
 metadata:
   name: require-department-label-fail0
   labels:
-    mycompany.com/policy-version: "1.0.0"
+    mycompany.com/policy-version: "2.0.0"
 spec:
   containers:
   - name: nginx

kubernetes/kyverno/require-department-label/pass0.yaml

@@ -4,7 +4,7 @@ metadata:
   name: require-department-label-pass0
   labels:
     mycompany.com/department: finance
-    mycompany.com/policy-version: "1.0.0"
+    mycompany.com/policy-version: "2.0.0"
 spec:
   containers:
   - name: nginx

kubernetes/kyverno/require-department-label/policy.yaml

@@ -39,7 +39,7 @@ spec:
             - "*"
           selector:
             matchLabels:
-              mycompany.com/policy-version: "1.0.0"
+              mycompany.com/policy-version: "2.0.0"
     validate:
       message: "The label `mycompany.com/department` is required."
       pattern: