Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Checkov flagging on non taggable resource #6924

Open
ctippur opened this issue Dec 24, 2024 · 0 comments
Open

Checkov flagging on non taggable resource #6924

ctippur opened this issue Dec 24, 2024 · 0 comments
Labels
checks Check additions or changes

Comments

@ctippur
Copy link

ctippur commented Dec 24, 2024

Describe the issue
If it is related to an existing check, please note the relevant check ID.
Also, explain the logic for this addition / change.

I am trying to use checkov to validate resources enforcing tagging policy over a terraform plan json file. Terraform json has resources under root_module and child_modules.
Despite days of efforts with permutations and combinations, I am looking to

  1. resources that support tags but dont have them. For example, aws_lb_target_group_attachment
  2. resources that are being called as modules (child modules)
  3. Skip checks on resources that dont support tags

What I have found is in resources that dont support tags, terrafrom plan json would not have the key "tags".
Observation is that with the below config, checkov is failing on resources that dont support tags.

Examples
Please share an example code sample (in the IaC of your choice) + the expected outcomes.

metadata:
  name: "Tag check skipping TGA"
  id: "CUSTOM_AWS_TAGS"
  description: "Require tags for everything except LB attachments"
  severity: "MEDIUM"
  category: "GENERAL_SECURITY"

scope:
  provider: "aws"

definition:
  and:
    # 1) If it’s recognized as TGA, let’s just pass it
    - or:
        - cond_type: "attribute"
          attribute: "type"
          operator: "equals"
          value: "aws_lb_target_group_attachment"
        - cond_type: "attribute"
          attribute: "tags"
          operator: "exists"

In this example, I was hoping that checkov would skip resource aws_lb_target_group_attachment

checkov command I am running checkov -f plan.json --external-checks-dir ckv/ --output json --check CUSTOM_AWS_TAGS

I made sure that there is only 1 checkov yaml filde under folder ckv

Version (please complete the following information):

  • Checkov Version [e.g. 22]

3.2.244

Additional context
Add any other context about the problem here.

@ctippur ctippur added the checks Check additions or changes label Dec 24, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
checks Check additions or changes
Projects
None yet
Development

No branches or pull requests

1 participant