nas

Documentation

Index

• Variables

Variables

var CheckAddDescriptionToNASSecurityGroup = rules.Register(
	scan.Rule{
		AVDID:      "AVD-NIF-0015",
		Aliases:    []string{"nifcloud-nas-add-description-to-nas-security-group"},
		Provider:   providers.NifcloudProvider,
		Service:    "nas",
		ShortCode:  "add-description-to-nas-security-group",
		Summary:    "Missing description for nas security group.",
		Impact:     "Descriptions provide context for the firewall rule reasons",
		Resolution: "Add descriptions for all nas security groups",
		Explanation: `NAS security groups should include a description for auditing purposes.

Simplifies auditing, debugging, and managing nas security groups.`,
		Links: []string{
			"https://pfs.nifcloud.com/help/nas/fw_new.htm",
		},
		Terraform: &scan.EngineMetadata{
			GoodExamples:        terraformAddDescriptionToNASSecurityGroupGoodExamples,
			BadExamples:         terraformAddDescriptionToNASSecurityGroupBadExamples,
			Links:               terraformAddDescriptionToNASSecurityGroupLinks,
			RemediationMarkdown: terraformAddDescriptionToNASSecurityGroupRemediationMarkdown,
		},
		Severity: severity.Low,
	},
	func(s *state.State) (results scan.Results) {
		for _, group := range s.Nifcloud.NAS.NASSecurityGroups {
			if group.Metadata.IsUnmanaged() {
				continue
			}
			if group.Description.IsEmpty() {
				results.Add(
					"NAS security group does not have a description.",
					group.Description,
				)
			} else if group.Description.EqualTo("Managed by Terraform") {
				results.Add(
					"NAS security group explicitly uses the default description.",
					group.Description,
				)
			} else {
				results.AddPassed(&group)
			}
		}
		return
	},
)

var CheckNoCommonPrivateNASInstance = rules.Register(
	scan.Rule{
		AVDID:       "AVD-NIF-0013",
		Aliases:     []string{"nifcloud-nas-no-common-private-nas-instance"},
		Provider:    providers.NifcloudProvider,
		Service:     "nas",
		ShortCode:   "no-common-private-nas-instance",
		Summary:     "The nas instance has common private network",
		Impact:      "The common private network is shared with other users",
		Resolution:  "Use private LAN",
		Explanation: `When handling sensitive data between servers, please consider using a private LAN to isolate the private side network from the shared network.`,
		Links: []string{
			"https://pfs.nifcloud.com/service/plan.htm",
		},
		Terraform: &scan.EngineMetadata{
			GoodExamples:        terraformNoCommonPrivateNASInstanceGoodExamples,
			BadExamples:         terraformNoCommonPrivateNASInstanceBadExamples,
			Links:               terraformNoCommonPrivateNASInstanceLinks,
			RemediationMarkdown: terraformNoCommonPrivateNASInstanceRemediationMarkdown,
		},
		Severity: severity.Low,
	},
	func(s *state.State) (results scan.Results) {
		for _, instance := range s.Nifcloud.NAS.NASInstances {
			if instance.NetworkID.EqualTo("net-COMMON_PRIVATE") {
				results.Add(
					"The nas instance has common private network",
					instance.NetworkID,
				)
			} else {
				results.AddPassed(&instance)
			}
		}
		return
	},
)

var CheckNoPublicIngressNASSgr = rules.Register(
	scan.Rule{
		AVDID:       "AVD-NIF-0014",
		Aliases:     []string{"nifcloud-nas-no-public-ingress-nas-sgr"},
		Provider:    providers.NifcloudProvider,
		Service:     "nas",
		ShortCode:   "no-public-ingress-nas-sgr",
		Summary:     "An ingress nas security group rule allows traffic from /0.",
		Impact:      "Your port exposed to the internet",
		Resolution:  "Set a more restrictive cidr range",
		Explanation: `Opening up ports to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that explicitly require it where possible.`,
		Links: []string{
			"https://pfs.nifcloud.com/api/nas/AuthorizeNASSecurityGroupIngress.htm",
		},
		Terraform: &scan.EngineMetadata{
			GoodExamples:        terraformNoPublicIngressNASSgrGoodExamples,
			BadExamples:         terraformNoPublicIngressNASSgrBadExamples,
			Links:               terraformNoPublicIngressNASSgrLinks,
			RemediationMarkdown: terraformNoPublicIngressNASSgrRemediationMarkdown,
		},
		Severity: severity.Critical,
	},
	func(s *state.State) (results scan.Results) {
		for _, group := range s.Nifcloud.NAS.NASSecurityGroups {
			for _, rule := range group.CIDRs {
				if cidr.IsPublic(rule.Value()) && cidr.CountAddresses(rule.Value()) > 1 {
					results.Add(
						"NAS Security group rule allows ingress from public internet.",
						rule,
					)
				} else {
					results.AddPassed(&group)
				}
			}
		}
		return
	},
)