initial aws terraform policies

policy/terraform/aws/eks/deny_eks_controlplane_logging.rego

@@ -0,0 +1,24 @@
+package terraform_aws
+
+import data.lib as l
+import data.terraform
+
+check01 := "TF_AWS_01"
+
+aws_controlplane_logging_disabled(eks_cluster) {
+	not eks_cluster.enabled_cluster_log_types
+} else { 
+	eks_cluster.enabled_cluster_log_types != ["api", "audit", "authenticator", "controllerManager", "scheduler"]
+}
+
+# DENY(TF_AWS_01) - aws_eks_cluster
+deny_aws_controlplane_logging_disabled[msg] {
+	input.resource.aws_eks_cluster
+	eks_cluster := input.resource.aws_eks_cluster[_]
+
+	not make_exception(check01, eks_cluster)
+
+	aws_controlplane_logging_disabled(eks_cluster)
+
+	msg = sprintf("%s: enabled_cluster_log_types not set correctly in cluster %s. More info: %s", [check01, eks_cluster.name, l.get_url(check01)])
+}

policy/terraform/aws/eks/deny_eks_instance_type.rego

@@ -0,0 +1,22 @@
+package terraform_aws
+
+import data.lib as l
+import data.terraform
+
+check05 := "TF_AWS_05"
+
+aws_eks_node_group_instance_types(node_group) {
+	not node_group.instance_types
+}
+
+# DENY(TF_AWS_05) - aws_eks_node_group
+deny_aws_eks_node_group_instance_types[msg] {
+	input.resource.aws_eks_node_group
+	node_group := input.resource.aws_eks_node_group[i]
+
+	not make_exception(check05, node_group)
+
+	aws_eks_node_group_instance_types(node_group)
+
+	msg = sprintf("%s: Instance type not set on node group %s. More info: %s", [check05, node_group.node_group_name, l.get_url(check05)])
+}

policy/terraform/aws/eks/deny_eks_public_access.rego

@@ -0,0 +1,24 @@
+package terraform_aws
+
+import data.lib as l
+import data.terraform
+
+check02 := "TF_AWS_02"
+
+aws_public_access_enabled(eks_cluster) {
+	not eks_cluster.public_access_cidrs
+    } else { 
+	l.contains_element(["0.0.0.0/0"], eks_cluster.public_access_cidrs[i])
+}
+
+# DENY(TF_AWS_02) - aws_eks_cluster
+deny_aws_public_access_enabled[msg] {
+	input.resource.aws_eks_cluster
+	eks_cluster := input.resource.aws_eks_cluster[_]
+
+	not make_exception(check01, eks_cluster)
+
+	aws_public_access_enabled(eks_cluster)
+
+	msg = sprintf("%s: Public access enabled in cluster %s (enabled by default if not specified). More info: %s", [check02, eks_cluster.name, l.get_url(check02)])
+}

policy/terraform/aws/s3/deny_s3_public_acl.rego

@@ -0,0 +1,24 @@
+package terraform_aws
+
+import data.lib as l
+import data.terraform
+
+check04 := "TF_AWS_04"
+
+aws_s3_public_acl(s3_bucket) {
+	not regex.match("private.*", s3_bucket.acl)
+}
+
+
+
+# DENY(TF_AWS_04) - aws_s3_access_point
+deny_aws_s3_public_acl[msg] {
+	input.resource.aws_s3_access_point
+	s3_bucket := input.resource.aws_s3_access_point[i]
+
+	not make_exception(check04, s3_bucket)
+
+	aws_s3_public_acl(s3_bucket)
+
+	msg = sprintf("%s: ACL on bucket %s allows for public access. More info: %s", [check04, s3_bucket.name, l.get_url(check04)])
+}

policy/terraform/aws/s3/deny_s3_versioning.rego

@@ -0,0 +1,27 @@
+package terraform_aws
+
+import data.lib as l
+import data.terraform
+
+check03 := "TF_AWS_03"
+
+aws_s3_versioning_disabled(s3_bucket) {
+	not s3_bucket.versioning 
+} else {
+	l.is_false(s3_bucket.versioning.enabled)
+
+}
+
+
+
+# DENY(TF_AWS_03) - aws_s3_access_point
+deny_aws_s3_versioning_disabled[msg] {
+	input.resource.aws_s3_access_point
+	s3_bucket := input.resource.aws_s3_access_point[i]
+
+	not make_exception(check03, s3_bucket)
+
+	aws_s3_versioning_disabled(s3_bucket)
+
+	msg = sprintf("%s: Versioning not enabled on bucket %s. More info: %s", [check03, s3_bucket.name, l.get_url(check03)])
+}

policy/terraform/aws/terraform.rego

@@ -0,0 +1,8 @@
+package terraform_aws
+
+import data.lib as l
+
+make_exception(check, obj) {
+	checks := split(obj["//"], ",")
+	l.contains_element(checks, check)
+}