azurerm-block-allow-all-cidr.sentinel

import "tfplan"

# Get an array of all resources of the given type (or an empty array).
get_resources = func(type) {
	if length(tfplan.module_paths else []) > 0 { # always true in the real tfplan import
		return get_resources_all_modules(type)
	} else { # fallback for tests
		return get_resources_root_only(type)
	}
}

get_resources_root_only = func(type) {
	resources = []
	named_and_counted_resources = tfplan.resources[type] else {}
	# Get resource bodies out of nested resource maps, from:
	# {"name": {"0": {"applied": {...}, "diff": {...} }, "1": {...}}, "name": {...}}
	# to:
	# [{"applied": {...}, "diff": {...}}, {"applied": {...}, "diff": {...}}, ...]
	for named_and_counted_resources as _, instances {
		for instances as _, body {
			append(resources, body)
		}
	}
	return resources
}

get_resources_all_modules = func(type) {
	resources = []
	for tfplan.module_paths as path {
		named_and_counted_resources = tfplan.module(path).resources[type] else {}
		# Get resource bodies out of nested resource maps, from:
		# {"name": {"0": {"applied": {...}, "diff": {...} }, "1": {...}}, "name": {...}}
		# to:
		# [{"applied": {...}, "diff": {...}}, {"applied": {...}, "diff": {...}}, ...]
		for named_and_counted_resources as _, instances {
			for instances as _, body {
				append(resources, body)
			}
		}
	}
	return resources
}

disallowed_cidr_blocks = [
	"0.0.0.0/0",
	"*",
]

block_allow_all = rule {
	all get_resources("azurerm_network_security_group") as sg {
		all sg.applied.security_rule as _, sr {
			(sr.source_address_prefix not in disallowed_cidr_blocks) or sr.access == "Deny"
		}
	}
}

main = rule {
	(block_allow_all) else true
}