Skip to content

Commit a52e458

Browse files
cx-miguel-silvacx-miguel-silva
authored
fix(masked_secrets): Mask Secrets in All Vulnerability Preview (#5949)
* add test file * mask secrets in all vulnerability preview * change approach * change e2e and fix go ci * fix more go ci * remove test.tf * update service.go * update e2e * add struct comment * update
1 parent ed46fa2 commit a52e458

File tree

8 files changed

+319
-135
lines changed

8 files changed

+319
-135
lines changed

‎e2e/fixtures/E2E_CLI_031_RESULT.html‎

Lines changed: 53 additions & 41 deletions
Large diffs are not rendered by default.

‎e2e/fixtures/E2E_CLI_032_RESULT.json‎

Lines changed: 131 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,25 @@
11
{
22
"kics_version": "development",
33
"files_scanned": 1,
4-
"lines_scanned": 278,
4+
"lines_scanned": 289,
55
"files_parsed": 1,
6-
"lines_parsed": 278,
6+
"lines_parsed": 289,
77
"files_failed_to_scan": 0,
8-
"queries_total": 495,
8+
"queries_total": 501,
99
"queries_failed_to_execute": 0,
1010
"queries_failed_to_compute_similarity_id": 0,
1111
"scan_id": "console",
1212
"severity_counters": {
13-
"HIGH": 6,
13+
"HIGH": 9,
1414
"INFO": 3,
1515
"LOW": 3,
16-
"MEDIUM": 9,
16+
"MEDIUM": 10,
1717
"TRACE": 0
1818
},
19-
"total_counter": 21,
19+
"total_counter": 25,
2020
"total_bom_resources": 0,
21-
"start": "2022-05-17T12:57:12.0455501+01:00",
22-
"end": "2022-05-17T12:57:27.2636532+01:00",
21+
"start": "2022-10-18T15:00:25.226787889+01:00",
22+
"end": "2022-10-18T15:00:35.433733848+01:00",
2323
"paths": [
2424
"/path/e2e/fixtures/samples/positive.yaml"
2525
],
@@ -115,6 +115,78 @@
115115
}
116116
]
117117
},
118+
{
119+
"query_name": "Passwords And Secrets - CloudFormation Secret Template",
120+
"query_id": "e0f01838-b1c2-4669-b84b-981949ebe5ed",
121+
"query_url": "https://docs.kics.io/latest/secrets/",
122+
"severity": "HIGH",
123+
"platform": "Common",
124+
"cloud_provider": "COMMON",
125+
"category": "Secret Management",
126+
"description": "Query to find passwords and secrets in infrastructure code.",
127+
"description_id": "d69d8a89",
128+
"files": [
129+
{
130+
"file_name": "/path/e2e/fixtures/samples/positive.yaml",
131+
"similarity_id": "5f948e5c0c97f3e7c43cd531de50c6c54a2cec221a45f113a34a571165d30553",
132+
"line": 273,
133+
"issue_type": "RedundantAttribute",
134+
"search_key": "",
135+
"search_line": 0,
136+
"search_value": "",
137+
"expected_value": "Hardcoded secret key should not appear in source",
138+
"actual_value": "Hardcoded secret key appears in source"
139+
}
140+
]
141+
},
142+
{
143+
"query_name": "Passwords And Secrets - Encryption Key",
144+
"query_id": "9fb1cd65-7a07-4531-9bcf-47589d0f82d6",
145+
"query_url": "https://docs.kics.io/latest/secrets/",
146+
"severity": "HIGH",
147+
"platform": "Common",
148+
"cloud_provider": "COMMON",
149+
"category": "Secret Management",
150+
"description": "Query to find passwords and secrets in infrastructure code.",
151+
"description_id": "d69d8a89",
152+
"files": [
153+
{
154+
"file_name": "/path/e2e/fixtures/samples/positive.yaml",
155+
"similarity_id": "844945794b3e1dde699997428753e3b29a7b39dd45a49a5010810c87566e41a4",
156+
"line": 275,
157+
"issue_type": "RedundantAttribute",
158+
"search_key": "",
159+
"search_line": 0,
160+
"search_value": "",
161+
"expected_value": "Hardcoded secret key should not appear in source",
162+
"actual_value": "Hardcoded secret key appears in source"
163+
}
164+
]
165+
},
166+
{
167+
"query_name": "Passwords And Secrets - Generic Password",
168+
"query_id": "487f4be7-3fd9-4506-a07a-eae252180c08",
169+
"query_url": "https://docs.kics.io/latest/secrets/",
170+
"severity": "HIGH",
171+
"platform": "Common",
172+
"cloud_provider": "COMMON",
173+
"category": "Secret Management",
174+
"description": "Query to find passwords and secrets in infrastructure code.",
175+
"description_id": "d69d8a89",
176+
"files": [
177+
{
178+
"file_name": "/path/e2e/fixtures/samples/positive.yaml",
179+
"similarity_id": "379b043925f80377f9a5c54a286392202b624f04f71e8d09f87da0ac414a5b04",
180+
"line": 276,
181+
"issue_type": "RedundantAttribute",
182+
"search_key": "",
183+
"search_line": 0,
184+
"search_value": "",
185+
"expected_value": "Hardcoded secret key should not appear in source",
186+
"actual_value": "Hardcoded secret key appears in source"
187+
}
188+
]
189+
},
118190
{
119191
"query_name": "Unrestricted Security Group Ingress",
120192
"query_id": "4a1e6b34-1008-4e61-a5f2-1f7c276f8d14",
@@ -310,6 +382,32 @@
310382
}
311383
]
312384
},
385+
{
386+
"query_name": "Secrets Manager Should Specify KmsKeyId",
387+
"query_id": "c8ae9ba9-c2f7-4e5c-b32e-a4b7712d4d22",
388+
"query_url": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-secretsmanager-secret.html",
389+
"severity": "MEDIUM",
390+
"platform": "CloudFormation",
391+
"cloud_provider": "AWS",
392+
"category": "Secret Management",
393+
"description": "Secrets Manager Secret should explicitly specify KmsKeyId, this will allow the secret to be shared cross-account",
394+
"description_id": "d78bb871",
395+
"files": [
396+
{
397+
"file_name": "/path/e2e/fixtures/samples/positive.yaml",
398+
"similarity_id": "fc5fc7cf72f42a639c6caf58ea2cdefd05811c7487abf44c401ad15225634ead",
399+
"line": 270,
400+
"resource_type": "AWS::SecretsManager::Secret",
401+
"resource_name": "MyAmpAppSecretManagerRotater",
402+
"issue_type": "MissingAttribute",
403+
"search_key": "Resources.MyAmpAppSecretManagerRotater.Properties",
404+
"search_line": 0,
405+
"search_value": "",
406+
"expected_value": "Resources.MyAmpAppSecretManagerRotater.Properties.KmsKeyId is defined",
407+
"actual_value": "Resources.MyAmpAppSecretManagerRotater.Properties.KmsKeyId is undefined"
408+
}
409+
]
410+
},
313411
{
314412
"query_name": "Security Group Ingress With Port Range",
315413
"query_id": "87482183-a8e7-4e42-a566-7a23ec231c16",
@@ -336,29 +434,29 @@
336434
},
337435
{
338436
"file_name": "/path/e2e/fixtures/samples/positive.yaml",
339-
"similarity_id": "000056cd0b9697e13f2f4561f1963e34c58c042b921c4d0fad0f2fa5214374eb",
340-
"line": 35,
437+
"similarity_id": "810487007189ac4de717dffc3204a05756e80e910b34f89ee08fd14f612328aa",
438+
"line": 27,
341439
"resource_type": "AWS::EC2::SecurityGroupIngress",
342-
"resource_name": "EcsSecurityGroupALBports",
440+
"resource_name": "EcsSecurityGroupSSHinbound",
343441
"issue_type": "IncorrectValue",
344-
"search_key": "Resources.EcsSecurityGroupALBports.Properties",
442+
"search_key": "Resources.EcsSecurityGroupSSHinbound.Properties",
345443
"search_line": 0,
346444
"search_value": "",
347-
"expected_value": "Resources.EcsSecurityGroupALBports.Properties.FromPort should equal to Resources.EcsSecurityGroupALBports.Properties.ToPort",
348-
"actual_value": "Resources.EcsSecurityGroupALBports.Properties.FromPort is not equal to Resources.EcsSecurityGroupALBports.Properties.ToPort"
445+
"expected_value": "Resources.EcsSecurityGroupSSHinbound.Properties.FromPort should equal to Resources.EcsSecurityGroupSSHinbound.Properties.ToPort",
446+
"actual_value": "Resources.EcsSecurityGroupSSHinbound.Properties.FromPort is not equal to Resources.EcsSecurityGroupSSHinbound.Properties.ToPort"
349447
},
350448
{
351449
"file_name": "/path/e2e/fixtures/samples/positive.yaml",
352-
"similarity_id": "810487007189ac4de717dffc3204a05756e80e910b34f89ee08fd14f612328aa",
353-
"line": 27,
450+
"similarity_id": "000056cd0b9697e13f2f4561f1963e34c58c042b921c4d0fad0f2fa5214374eb",
451+
"line": 35,
354452
"resource_type": "AWS::EC2::SecurityGroupIngress",
355-
"resource_name": "EcsSecurityGroupSSHinbound",
453+
"resource_name": "EcsSecurityGroupALBports",
356454
"issue_type": "IncorrectValue",
357-
"search_key": "Resources.EcsSecurityGroupSSHinbound.Properties",
455+
"search_key": "Resources.EcsSecurityGroupALBports.Properties",
358456
"search_line": 0,
359457
"search_value": "",
360-
"expected_value": "Resources.EcsSecurityGroupSSHinbound.Properties.FromPort should equal to Resources.EcsSecurityGroupSSHinbound.Properties.ToPort",
361-
"actual_value": "Resources.EcsSecurityGroupSSHinbound.Properties.FromPort is not equal to Resources.EcsSecurityGroupSSHinbound.Properties.ToPort"
458+
"expected_value": "Resources.EcsSecurityGroupALBports.Properties.FromPort should equal to Resources.EcsSecurityGroupALBports.Properties.ToPort",
459+
"actual_value": "Resources.EcsSecurityGroupALBports.Properties.FromPort is not equal to Resources.EcsSecurityGroupALBports.Properties.ToPort"
362460
}
363461
]
364462
},
@@ -438,6 +536,19 @@
438536
"description": "It's considered a best practice for AWS Security Group to have a description",
439537
"description_id": "f7c62b11",
440538
"files": [
539+
{
540+
"file_name": "/path/e2e/fixtures/samples/positive.yaml",
541+
"similarity_id": "39fec612777f59fb4181dd2330ee465ec860c962acfebb07a4f1ee1f122d24e7",
542+
"line": 35,
543+
"resource_type": "AWS::EC2::SecurityGroupIngress",
544+
"resource_name": "EcsSecurityGroupALBports",
545+
"issue_type": "MissingAttribute",
546+
"search_key": "Resources.EcsSecurityGroupALBports.Properties",
547+
"search_line": 0,
548+
"search_value": "",
549+
"expected_value": "Resources.EcsSecurityGroupALBports.Properties.Description should be set",
550+
"actual_value": "Resources.EcsSecurityGroupALBports.Properties.Description is undefined"
551+
},
441552
{
442553
"file_name": "/path/e2e/fixtures/samples/positive.yaml",
443554
"similarity_id": "e96cf20cc6e1e11dce2d40d9e2b37446a00f00c3f541aa7dd13861059f6fcce8",
@@ -463,19 +574,6 @@
463574
"search_value": "",
464575
"expected_value": "Resources.EcsSecurityGroupSSHinbound.Properties.Description should be set",
465576
"actual_value": "Resources.EcsSecurityGroupSSHinbound.Properties.Description is undefined"
466-
},
467-
{
468-
"file_name": "/path/e2e/fixtures/samples/positive.yaml",
469-
"similarity_id": "39fec612777f59fb4181dd2330ee465ec860c962acfebb07a4f1ee1f122d24e7",
470-
"line": 35,
471-
"resource_type": "AWS::EC2::SecurityGroupIngress",
472-
"resource_name": "EcsSecurityGroupALBports",
473-
"issue_type": "MissingAttribute",
474-
"search_key": "Resources.EcsSecurityGroupALBports.Properties",
475-
"search_line": 0,
476-
"search_value": "",
477-
"expected_value": "Resources.EcsSecurityGroupALBports.Properties.Description should be set",
478-
"actual_value": "Resources.EcsSecurityGroupALBports.Properties.Description is undefined"
479577
}
480578
]
481579
}

‎e2e/fixtures/E2E_CLI_036_RESULT.json‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
{
22
"kics_version": "development",
33
"files_scanned": 1,
4-
"lines_scanned": 278,
4+
"lines_scanned": 289,
55
"files_parsed": 1,
6-
"lines_parsed": 278,
6+
"lines_parsed": 289,
77
"files_failed_to_scan": 0,
88
"queries_total": 13,
99
"queries_failed_to_execute": 0,
@@ -18,8 +18,8 @@
1818
},
1919
"total_counter": 20,
2020
"total_bom_resources": 0,
21-
"start": "2022-05-17T14:26:40.9648352+01:00",
22-
"end": "2022-05-17T14:26:43.738301+01:00",
21+
"start": "2022-10-18T14:56:55.859960017+01:00",
22+
"end": "2022-10-18T14:56:56.399687664+01:00",
2323
"paths": [
2424
"/path/e2e/fixtures/samples/positive.yaml"
2525
],
@@ -412,19 +412,6 @@
412412
"description": "It's considered a best practice for AWS Security Group to have a description",
413413
"description_id": "f7c62b11",
414414
"files": [
415-
{
416-
"file_name": "fixtures\\samples\\positive.yaml",
417-
"similarity_id": "95883c9f983adb8f547c54e24837b6aa402978a00417be98441514959d4171d4",
418-
"line": 27,
419-
"resource_type": "AWS::EC2::SecurityGroupIngress",
420-
"resource_name": "EcsSecurityGroupSSHinbound",
421-
"issue_type": "MissingAttribute",
422-
"search_key": "Resources.EcsSecurityGroupSSHinbound.Properties",
423-
"search_line": 0,
424-
"search_value": "",
425-
"expected_value": "Resources.EcsSecurityGroupSSHinbound.Properties.Description should be set",
426-
"actual_value": "Resources.EcsSecurityGroupSSHinbound.Properties.Description is undefined"
427-
},
428415
{
429416
"file_name": "fixtures\\samples\\positive.yaml",
430417
"similarity_id": "39fec612777f59fb4181dd2330ee465ec860c962acfebb07a4f1ee1f122d24e7",
@@ -450,6 +437,19 @@
450437
"search_value": "",
451438
"expected_value": "Resources.EcsSecurityGroupHTTPinbound02.Properties.Description should be set",
452439
"actual_value": "Resources.EcsSecurityGroupHTTPinbound02.Properties.Description is undefined"
440+
},
441+
{
442+
"file_name": "fixtures\\samples\\positive.yaml",
443+
"similarity_id": "95883c9f983adb8f547c54e24837b6aa402978a00417be98441514959d4171d4",
444+
"line": 27,
445+
"resource_type": "AWS::EC2::SecurityGroupIngress",
446+
"resource_name": "EcsSecurityGroupSSHinbound",
447+
"issue_type": "MissingAttribute",
448+
"search_key": "Resources.EcsSecurityGroupSSHinbound.Properties",
449+
"search_line": 0,
450+
"search_value": "",
451+
"expected_value": "Resources.EcsSecurityGroupSSHinbound.Properties.Description should be set",
452+
"actual_value": "Resources.EcsSecurityGroupSSHinbound.Properties.Description is undefined"
453453
}
454454
]
455455
}

‎e2e/fixtures/E2E_CLI_036_RESULT_2.json‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
{
22
"kics_version": "development",
33
"files_scanned": 1,
4-
"lines_scanned": 278,
4+
"lines_scanned": 289,
55
"files_parsed": 1,
6-
"lines_parsed": 278,
6+
"lines_parsed": 289,
77
"files_failed_to_scan": 0,
88
"queries_total": 1,
99
"queries_failed_to_execute": 0,
@@ -18,8 +18,8 @@
1818
},
1919
"total_counter": 3,
2020
"total_bom_resources": 0,
21-
"start": "2022-05-17T14:24:50.4608512+01:00",
22-
"end": "2022-05-17T14:24:53.2007115+01:00",
21+
"start": "2022-10-18T14:59:06.170222354+01:00",
22+
"end": "2022-10-18T14:59:06.311345857+01:00",
2323
"paths": [
2424
"/path/e2e/fixtures/samples/positive.yaml"
2525
],
@@ -36,20 +36,7 @@
3636
"description_id": "5f2b65f3",
3737
"files": [
3838
{
39-
"file_name": "fixtures\\samples\\positive.yaml",
40-
"similarity_id": "810487007189ac4de717dffc3204a05756e80e910b34f89ee08fd14f612328aa",
41-
"line": 27,
42-
"resource_type": "AWS::EC2::SecurityGroupIngress",
43-
"resource_name": "EcsSecurityGroupSSHinbound",
44-
"issue_type": "IncorrectValue",
45-
"search_key": "Resources.EcsSecurityGroupSSHinbound.Properties",
46-
"search_line": 0,
47-
"search_value": "",
48-
"expected_value": "Resources.EcsSecurityGroupSSHinbound.Properties.FromPort should equal to Resources.EcsSecurityGroupSSHinbound.Properties.ToPort",
49-
"actual_value": "Resources.EcsSecurityGroupSSHinbound.Properties.FromPort is not equal to Resources.EcsSecurityGroupSSHinbound.Properties.ToPort"
50-
},
51-
{
52-
"file_name": "fixtures\\samples\\positive.yaml",
39+
"file_name": "/path/e2e/fixtures/samples/positive.yaml",
5340
"similarity_id": "000056cd0b9697e13f2f4561f1963e34c58c042b921c4d0fad0f2fa5214374eb",
5441
"line": 35,
5542
"resource_type": "AWS::EC2::SecurityGroupIngress",
@@ -62,7 +49,7 @@
6249
"actual_value": "Resources.EcsSecurityGroupALBports.Properties.FromPort is not equal to Resources.EcsSecurityGroupALBports.Properties.ToPort"
6350
},
6451
{
65-
"file_name": "fixtures\\samples\\positive.yaml",
52+
"file_name": "/path/e2e/fixtures/samples/positive.yaml",
6653
"similarity_id": "d60022e14f1b45c574f71c0f48b3fee882b471819597b770e3545988a8f5295a",
6754
"line": 19,
6855
"resource_type": "AWS::EC2::SecurityGroupIngress",
@@ -73,6 +60,19 @@
7360
"search_value": "",
7461
"expected_value": "Resources.EcsSecurityGroupHTTPinbound02.Properties.FromPort should equal to Resources.EcsSecurityGroupHTTPinbound02.Properties.ToPort",
7562
"actual_value": "Resources.EcsSecurityGroupHTTPinbound02.Properties.FromPort is not equal to Resources.EcsSecurityGroupHTTPinbound02.Properties.ToPort"
63+
},
64+
{
65+
"file_name": "/path/e2e/fixtures/samples/positive.yaml",
66+
"similarity_id": "810487007189ac4de717dffc3204a05756e80e910b34f89ee08fd14f612328aa",
67+
"line": 27,
68+
"resource_type": "AWS::EC2::SecurityGroupIngress",
69+
"resource_name": "EcsSecurityGroupSSHinbound",
70+
"issue_type": "IncorrectValue",
71+
"search_key": "Resources.EcsSecurityGroupSSHinbound.Properties",
72+
"search_line": 0,
73+
"search_value": "",
74+
"expected_value": "Resources.EcsSecurityGroupSSHinbound.Properties.FromPort should equal to Resources.EcsSecurityGroupSSHinbound.Properties.ToPort",
75+
"actual_value": "Resources.EcsSecurityGroupSSHinbound.Properties.FromPort is not equal to Resources.EcsSecurityGroupSSHinbound.Properties.ToPort"
7676
}
7777
]
7878
}

‎e2e/fixtures/E2E_CLI_040_RESULT.html‎

Lines changed: 34 additions & 23 deletions
Large diffs are not rendered by default.

‎e2e/fixtures/samples/positive.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -265,6 +265,17 @@ Resources:
265265
Properties:
266266
Path: /
267267
Roles: [!Ref 'EC2Role']
268+
MyAmpAppSecretManagerRotater:
269+
Type: AWS::SecretsManager::Secret
270+
Properties:
271+
Description: 'This is my amp app instance secret'
272+
GenerateSecretString:
273+
SecretStringTemplate: '{"username":"admin"}'
274+
GenerateStringKey: 'password'
275+
EncryptionKey: 'password'
276+
Password: 'password'
277+
PasswordLength: 16
278+
ExcludeCharacters: '"@/\'
268279
Outputs:
269280
ecsservice:
270281
Value: !Ref 'service'

0 commit comments

Comments
 (0)