diff --git a/checkov/terraform/checks/resource/azure/AppServiceSlotHTTPSOnly.py b/checkov/terraform/checks/resource/azure/AppServiceSlotHTTPSOnly.py index cf80b55ec85..f9ea1d6e8f7 100644 --- a/checkov/terraform/checks/resource/azure/AppServiceSlotHTTPSOnly.py +++ b/checkov/terraform/checks/resource/azure/AppServiceSlotHTTPSOnly.py @@ -6,12 +6,12 @@ class AppServiceSlotHTTPSOnly(BaseResourceValueCheck): def __init__(self): name = "Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot" id = "CKV_AZURE_153" - supported_resources = ['azurerm_app_service_slot'] + supported_resources = ["azurerm_app_service_slot", "azurerm_linux_web_app_slot", "azurerm_windows_web_app_slot"] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): - return 'https_only/[0]' + return "https_only/[0]" check = AppServiceSlotHTTPSOnly() diff --git a/tests/terraform/checks/resource/azure/example_AppServiceSlotHTTPSOnly/main.tf b/tests/terraform/checks/resource/azure/example_AppServiceSlotHTTPSOnly/main.tf index e981a4e2144..ffcbd1462e4 100644 --- a/tests/terraform/checks/resource/azure/example_AppServiceSlotHTTPSOnly/main.tf +++ b/tests/terraform/checks/resource/azure/example_AppServiceSlotHTTPSOnly/main.tf @@ -26,6 +26,23 @@ resource "azurerm_app_service_slot" "fail" { } +resource "azurerm_linux_web_app_slot" "fail" { + name = "fail-slot" + app_service_id = azurerm_linux_web_app.fail.id + https_only = false + + site_config {} +} + +resource "azurerm_windows_web_app_slot" "fail" { + name = "fail-slot" + app_service_id = azurerm_windows_web_app.fail.id + https_only = false + + site_config {} +} + + resource "azurerm_app_service_slot" "fail2" { name = random_id.server.hex app_service_name = azurerm_app_service.example.name @@ -77,3 +94,19 @@ resource "azurerm_app_service_slot" "pass" { value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } + +resource "azurerm_linux_web_app_slot" "pass" { + name = "pass-slot" + app_service_id = azurerm_linux_web_app.pass.id + https_only = true + + site_config {} +} + +resource "azurerm_windows_web_app_slot" "pass" { + name = "pass-slot" + app_service_id = azurerm_windows_web_app.pass.id + https_only = true + + site_config {} +} \ No newline at end of file diff --git a/tests/terraform/checks/resource/azure/test_AppServiceSlotHTTPSOnly.py b/tests/terraform/checks/resource/azure/test_AppServiceSlotHTTPSOnly.py index 7ffe4f37eb8..f627a7966f8 100644 --- a/tests/terraform/checks/resource/azure/test_AppServiceSlotHTTPSOnly.py +++ b/tests/terraform/checks/resource/azure/test_AppServiceSlotHTTPSOnly.py @@ -20,18 +20,23 @@ def test(self): passing_resources = { "azurerm_app_service_slot.pass", + "azurerm_linux_web_app_slot.pass", + "azurerm_windows_web_app_slot.pass", } failing_resources = { "azurerm_app_service_slot.fail", "azurerm_app_service_slot.fail2", + "azurerm_linux_web_app_slot.fail", + "azurerm_windows_web_app_slot.fail", } + skipped_resources = {} passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} - self.assertEqual(summary["passed"], 1) - self.assertEqual(summary["failed"], 2) - self.assertEqual(summary["skipped"], 0) + self.assertEqual(summary['passed'], len(passing_resources)) + self.assertEqual(summary['failed'], len(failing_resources)) + self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) diff --git a/tests/terraform/image_referencer/test_runner_azure_resources.py b/tests/terraform/image_referencer/test_runner_azure_resources.py index a44cbc6de09..7ea411ff3a3 100644 --- a/tests/terraform/image_referencer/test_runner_azure_resources.py +++ b/tests/terraform/image_referencer/test_runner_azure_resources.py @@ -182,7 +182,7 @@ def test_app_service_linux_web_resources(mocker: MockerFixture, graph_framework) assert len(tf_report.resources) == 2 assert len(tf_report.passed_checks) == 4 - assert len(tf_report.failed_checks) == 13 + assert len(tf_report.failed_checks) == 14 assert len(tf_report.skipped_checks) == 0 assert len(tf_report.parsing_errors) == 0 @@ -271,7 +271,8 @@ def test_app_service_windows_web_resources(mocker: MockerFixture, graph_framewor assert len(tf_report.resources) == 2 assert len(tf_report.passed_checks) == 4 - assert len(tf_report.failed_checks) == 13 + # Changed from 13 to 14 due to PR #5687 + assert len(tf_report.failed_checks) == 14 assert len(tf_report.skipped_checks) == 0 assert len(tf_report.parsing_errors) == 0