Checkov custom yaml policy for json document validation

29 Views Asked by At

I have following terraform code with a policy that is overly permissive for resources.. I want to check this using Checkov custom yaml policy but I don't find a way to validate the json policy document that is part of resources. Is there a way to do it ?

  name        = "test_policy"
  path        = "/"
  description = "My test policy"

  # Terraform's "jsonencode" function converts a
  # Terraform expression result to valid JSON syntax.
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "ec2:Describe*",
        ]
        Effect   = "Allow"
        Resource = "*"
      },
    ]
  })
}```
1

There are 1 best solutions below

0
deals my On

Disregard this, i am able to find the policy. For anybody who stops by here looking for a solution..

metadata:
  name: <name>
  id : <some_id>
  category: "general"
  severity: "high"
  guidelines: <some guideline on how to fix it"
scope:
  provider: "aws"
definition:
  cond_type: "attribute"
  resource_types:
    - "aws_iam_policy"
  attribute: "policy.Statement.Resource"
  operator: "not_contains"
  value: "*"

Thank you.