fix: Fix terraform aws vpc flow logs detection (#1033)

aquasecurity · Oct 25, 2022 · 5b8f28b · 5b8f28b
1 parent c77561c
commit 5b8f28b
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 15 deletions.
diff --git a/internal/adapters/terraform/aws/ec2/vpc.go b/internal/adapters/terraform/aws/ec2/vpc.go
@@ -18,27 +18,33 @@ func adaptVPCs(modules terraform.Modules) []ec2.VPC {
  var vpcs []ec2.VPC
  for _, module := range modules {
  for _, resource := range module.GetResourcesByType("aws_default_vpc") {
- vpcs = append(vpcs, ec2.VPC{
- Metadata: resource.GetMetadata(),
- ID: defsecTypes.StringUnresolvable(resource.GetMetadata()),
- IsDefault: defsecTypes.Bool(true, resource.GetMetadata()),
- SecurityGroups: nil,
- FlowLogsEnabled: defsecTypes.BoolDefault(false, resource.GetMetadata()),
- })
+ vpcs = append(vpcs, adaptVPC(modules, resource, true))
  }
  for _, resource := range module.GetResourcesByType("aws_vpc") {
- vpcs = append(vpcs, ec2.VPC{
- Metadata: resource.GetMetadata(),
- ID: defsecTypes.StringUnresolvable(resource.GetMetadata()),
- IsDefault: defsecTypes.Bool(false, resource.GetMetadata()),
- SecurityGroups: nil,
- FlowLogsEnabled: defsecTypes.BoolDefault(false, resource.GetMetadata()),
- })
+ vpcs = append(vpcs, adaptVPC(modules, resource, false))
  }
  }
  return vpcs
 }
 
+func adaptVPC(modules terraform.Modules, block *terraform.Block, def bool) ec2.VPC {
+ var hasFlowLogs bool
+ for _, flow := range modules.GetResourcesByType("aws_flow_log") {
+ vpcAttr := flow.GetAttribute("vpc_id")
+ if vpcAttr.ReferencesBlock(block) {
+ hasFlowLogs = true
+ break
+ }
+ }
+ return ec2.VPC{
+ Metadata: block.GetMetadata(),
+ ID: defsecTypes.StringUnresolvable(block.GetMetadata()),
+ IsDefault: defsecTypes.Bool(def, block.GetMetadata()),
+ SecurityGroups: nil,
+ FlowLogsEnabled: defsecTypes.BoolDefault(hasFlowLogs, block.GetMetadata()),
+ }
+}
+
 func (a *sgAdapter) adaptSecurityGroups(modules terraform.Modules) []ec2.SecurityGroup {
  var securityGroups []ec2.SecurityGroup
  for _, resource := range modules.GetResourcesByType("aws_security_group") {

diff --git a/internal/adapters/terraform/aws/ec2/vpc_test.go b/internal/adapters/terraform/aws/ec2/vpc_test.go
@@ -23,6 +23,9 @@ func Test_AdaptVPC(t *testing.T) {
  {
  name: "defined",
  terraform: `
+ resource "aws_flow_log" "this" {
+ vpc_id = aws_vpc.main.id
+ }
  resource "aws_default_vpc" "default" {
  tags = {
  Name = "Default VPC"
@@ -84,7 +87,7 @@ func Test_AdaptVPC(t *testing.T) {
  Metadata: defsecTypes.NewTestMetadata(),
  IsDefault: defsecTypes.Bool(false, defsecTypes.NewTestMetadata()),
  ID: defsecTypes.String("", defsecTypes.NewTestMetadata()),
- FlowLogsEnabled: defsecTypes.Bool(false, defsecTypes.NewTestMetadata()),
+ FlowLogsEnabled: defsecTypes.Bool(true, defsecTypes.NewTestMetadata()),
  },
  },
  SecurityGroups: []ec2.SecurityGroup{