Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] rego/rules/tf/aws/waf/known_bad_inputs.rego#L37 doesn't recognize that managed rulesets MUST be overridden with "none" #426

Open
infowolfe opened this issue Jun 2, 2024 · 0 comments

Comments

@infowolfe
Copy link

infowolfe commented Jun 2, 2024

Describe the bug
This line doesn't recognize a no-op "none" override

See: this bug comment

How you're running Regula
3.2.1, build fed1e44, built with OPA v0.46.0-dev

cd cdktf.out/stacks/stackname
regula run

Operating System
MacOS.

Steps to reproduce
Try to use more than one AWSManagedRules<foo>RuleSet with the required override_action: { none }

IaC Configuration
If it looks weird, this comes from cdktf synth --hcl:

resource "aws_wafv2_web_acl" "wafacl" {
  description = "waf acls"
  name        = "wafacl"
  scope       = "REGIONAL"
  default_action {
    allow {

    }
  }
  rule {
    name     = "AWSManagedRulesKnownBadInputsRuleSet"
    priority = 100
    override_action {
      none {

      }
    }
    statement = [object Object]
    visibility_config {
      cloudwatch_metrics_enabled = false
      metric_name                = "AWSManagedRulesKnownBadInputsRuleSet"
      sampled_requests_enabled   = false
    }
  }
  rule {
    name     = "AWSManagedRulesCommonRuleSet"
    priority = 110
    override_action {
      none {

      }
    }
    statement = [object Object]
    visibility_config {
      cloudwatch_metrics_enabled = false
      metric_name                = "AWSManagedRulesCommonRuleSet"
      sampled_requests_enabled   = false
    }
  }
  visibility_config {
    cloudwatch_metrics_enabled = false
    metric_name                = "Dev-Magento-WAF"
    sampled_requests_enabled   = false
  }
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant