fix(query): fp for Storage Share File Allows All ACL Permissions#7612
Conversation
…l_ACL_Permissions--ARM
|
KICS version: v2.1.11
|
cx-artur-ribeiro
left a comment
There was a problem hiding this comment.
After reviewing the changes, it seems like we were already looking at the desired azurerm_storage_share resource and checking the permissions parameter.
Is it obligated to use the name of the resource azurerm_storage_share_file in the resource azurerm_storage_share in order for it to be used? I didn't find the documentation stating that but I understand that the query was already done this way so you didn't introduce this change.
If you could please make the changes requested I would approve the changes.
assets/queries/terraform/azure/storage_share_allows_all_acl_permissions/metadata.json
Outdated
Show resolved
Hide resolved
…ions--ARM' of https://github.com/Checkmarx/kics into AST-40740--FP-Storage_Share_File_Allows_All_ACL_Permissions--ARM
…l_ACL_Permissions--ARM
…l_ACL_Permissions--ARM
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 19562607 | Triggered | Generic Password | 250d49a | assets/queries/common/passwords_and_secrets/test/positive53.json | View secret |
| 4266022 | Triggered | Generic Password | 527d8fa | assets/queries/cloudFormation/aws/amplify_branch_basic_auth_config_password_exposed/test/negative7.yaml | View secret |
| 9419039 | Triggered | Username Password | 527d8fa | assets/queries/cloudFormation/aws/amplify_app_basic_auth_config_password_exposed/test/positive6.json | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secrets safely. Learn here the best practices.
- Revoke and rotate these secrets.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
Reason for Proposed Changes
azurerm_storage_share_fileresource which does not, itself, declare the ACL permissions associated with the query´s naming/purpose.storage_share_idwithin anazurerm_storage_share_file, and validates wether theazurerm_storage_shareresource associated with that id is declaringpermissions = "rwdl".azurerm_storage_share_fileresource is the one with dangerously permissive permissions field but it is actually theazurerm_storage_sharethat defines permissions forazurerm_storage_share_fileresources, and the query should reference the resource that directly "Allows All ACL Permissions" as stated in the query´s name.Proposed Changes
azurerm_storage_share.searchKey,keyExpectedValue,...)making this change even more warranted .I submit this contribution under the Apache-2.0 license.